Cybersecurity regulation in Poland (2026)

Poland's amended Act on the National Cybersecurity System became fully operative, expanding mandatory cybersecurity obligations to an estimated 42,000 entities across 18 sectors and introducing a High-Risk Vendor (HRV) mechanism allowing the Minister of Digital Affairs to ban ICT suppliers deemed threats to national security—extended beyond telecoms to all NIS2-covered sectors.

Poland's Digital Minister confirmed unauthorized access to POLSA's IT infrastructure; the agency immediately severed its network and staff were directed to use phones instead of email. Preliminary analysis pointed to capabilities consistent with state-sponsored actors, with Russia's APT28 (GRU) cited as a leading suspect—consistent with Poland's designation as the EU's most cyber-targeted member state.

Poland's two national incident-response teams issued a joint technical advisory documenting a large-scale phishing campaign attributed to Russia's APT28 (GRU) that targeted Polish government institutions, deploying a multi-stage redirect chain to download a disguised executable that harvested credentials from Microsoft Exchange mailboxes.

Security researchers confirmed sustained exploitation of a critical Microsoft Outlook vulnerability by Russia's APT28 against Polish government and private-sector targets, part of a broader NATO-wide campaign that began as a zero-day in April 2022; the incidents drove CERT Polska to escalate threat warnings to Polish network administrators.

The Killnet hacktivist collective targeted Poland's Ministry of Foreign Affairs, Senate, Border Control, and Police websites with sustained DDoS attacks in retaliation for Poland's support of Ukraine, marking the onset of an enduring pattern of Russian-aligned hybrid cyber operations against Polish state institutions that CSIRT GOV has had to counter continuously since.

The Council of Ministers approved Poland's second national cybersecurity strategy, establishing five objectives: maturing the KSC system, hardening public-administration and private-sector resilience, building national R&D capacity in cybersecurity, raising public awareness, and strengthening Poland's international cyber standing—with the Ministry of Digital Affairs as coordinator.

Poland's first comprehensive cybersecurity statute entered into force, establishing three national CSIRTs (CSIRT GOV at the Internal Security Agency ABW, CSIRT MON at the Ministry of Defence, and CSIRT NASK/CERT Polska), mandatory incident-reporting obligations for operators of essential services and digital service providers, and a supervisory regime—fully transposing EU NIS Directive 2016/1148.

Poland's first computer emergency response team was created within the state-owned NASK (Research and Academic Computer Network), laying the institutional foundation for national-level cyber-incident handling; CERT Polska joined FIRST in 1998 and TF-CSIRT in 2000, and was formally designated CSIRT NASK under the 2018 KSC Act.