uksc.pl - is your company covered by Poland's Cybersecurity Act? A one-minute qualifier

Since 3 April 2026, Poland has been applying an amended National Cybersecurity System Act (UKSC), which implements the EU's NIS2 directive. Tens of thousands of companies now have to work out for themselves whether the act applies to them - and if it does, apply for entry in the official register by 3 October 2026. To make that decision possible in a minute rather than weeks, we built uksc.pl - the UKSC Cybersecurity Qualifier.

Why does qualification matter?

The new act is based on self-identification. Nobody will send a company a letter saying it has become an essential or important entity. It is up to the management board to check whether the company meets the criteria, apply for entry in the register kept by the Minister of Digital Affairs and implement the obligations. Failing to apply on time is a punishable offence in itself.

A lot depends on the outcome:

• whether the company has any obligations under the act at all - and if not, it is worth having that documented for auditors, banks or business partners,
• which supervisory regime applies - essential entities are subject to ex ante supervision (inspections, audits), important entities to ex post supervision, triggered for example by an incident,
• which measures must be implemented: systematic risk management, incident handling and reporting through the S46 system, supply chain security, management training,
• how high the fines can be: up to EUR 10 million or 2% of annual revenue for essential entities and up to EUR 7 million or 1.4% of revenue for important entities. A separate fine of up to 300% of salary can be imposed on the head of the entity.

The problem is that qualification is far from obvious. It means matching business activity codes and actual operations against the annexes to the act, calculating company size and accounting for exceptions. Without a tool, it usually ends with a call to a lawyer - and waiting for an answer.

Who is covered by the act?

The amendment covers well over a dozen sectors of the economy - far more than the previous act. Whether and how a company is covered depends on three things.

1. Sector

The act splits sectors into two groups. The first (sectors of high criticality) includes energy, transport, banking and financial market infrastructure, healthcare, drinking water and waste water, digital infrastructure, ICT service management, public administration and space. The second (other critical sectors) includes postal and courier services, waste management, chemicals, food production and distribution, manufacturing (e.g. medical devices, electronics, machinery, vehicles), digital providers and research.

2. Company size

As a rule, the act covers medium-sized and large enterprises, i.e. companies with at least 50 employees or with both turnover and balance sheet total above EUR 10 million. Small and micro businesses are usually out of scope - with important exceptions, e.g. trust service providers, domain name registries and DNS providers, which are covered regardless of size.

The most common pitfall: size is calculated together with linked and partner enterprises. A company with 30 employees that belongs to a larger group may count as a medium-sized or large enterprise under the act.

3. Category: essential or important?

Sector plus size gives the category. Put simply: large companies in high-criticality sectors are essential entities, while medium-sized companies in those sectors and medium-sized and large companies in other critical sectors are important entities. Public entities and some telecommunications providers are entered in the register automatically.

How uksc.pl works

The qualifier guides you through the whole process - from a KRS number to a finished report. Here is what it looks like in practice (the interface is in Polish):

1. Quick check - on the uksc.pl home page you enter a KRS number and get a preliminary qualification without signing in.
2. Full qualifier - after signing in you choose a data source: enter data manually, upload documents or use public data. In the last option, a KRS number or company name is enough - the system finds the company in the registers itself.
3. Rule engine and legal rationale - the qualification engine applies the criteria of the act: sector, company size, links, exceptions. The result - essential, important or not covered - comes with a rationale and references to the relevant provisions.
4. Report and export - you export the qualification report to PDF (for the board, legal team or auditor) or JSON (for further automation), and every analysis is kept in your account history.

Every new user gets one full report free to start with.

Data sources: raporta.pl

A qualification is only as good as the data behind it. That is why uksc.pl does not rely on what users remember about their own company, but on public register data supplied by raporta.pl - a service for searching and monitoring Polish companies by KRS number, NIP tax ID or name, which we co-develop.

From raporta.pl, the qualifier retrieves:

• KRS register data - legal form, address, business activity,
• financial data from filed statements - the basis for assessing company size,
• capital and personal links - subsidiaries, board members and shareholders.

The links matter precisely because of the pitfall described above. In the uksc.pl report they are shown as a connection graph - companies, people and shareholdings in one view, and in a table as well. You can see at a glance whether a company operates on its own or within a group that changes its status under the act.

Where public data may be less up to date than internal documents (e.g. the latest financial statement has not been filed yet), the qualifier says so clearly and lets you upload your own documents.

What we built

For our studio, uksc.pl brought together several things we enjoy most: a demanding domain, hard data and an outcome that real decisions depend on.

• A rule engine instead of a "black box" - every qualification follows explicit rules based on the act, so it can be traced and defended in front of an auditor.
• Integration with raporta.pl - KRS data, financials and links retrieved automatically, with no manual retyping.
• A connection graph - a clear visualisation of capital and personal structure, including for large groups.
• PDF and JSON reports - a document ready for the board and the auditor, plus data for further automation.
• Accounts, analysis history and a credit model - with a free quick check as the entry point and a free report to start.

The qualifier supports compliance decisions but does not replace legal advice in unusual cases. Its job is to give a clear answer for typical cases within a minute - so that lawyers can focus on the genuinely unusual ones.

Who is it for?

• Boards and business owners who need to decide whether to apply for entry in the register before 3 October 2026,
• Compliance and IT security teams who need a documented qualification for audits,
• Law firms and advisors who qualify many clients and want to start from a reliable screening,
• Suppliers of essential and important entities - because supply chain requirements will reach them sooner or later.

Check your company

Go to uksc.pl, enter a KRS number and see the preliminary qualification without signing in. You get the full report with a legal rationale after creating an account - the first one is free.

Do you work in a field where regulations, registers and financial data need to be turned into a clear decision? We design tools like this every day. Get in touch.