Czy ustawa o KSC wymaga szkoleń dla pracowników?

Tak. Art. 8 ust. 1 pkt 2 lit. i ustawy o krajowym systemie cyberbezpieczeństwa wymienia edukację z zakresu cyberbezpieczeństwa dla personelu podmiotu jako środek, który podmiot kluczowy lub ważny musi wdrożyć, a lit. j dodaje podstawowe zasady cyberhigieny. Art. 8d pkt 4 nakłada na kierownika obowiązek zapewnienia, że personel jest świadomy obowiązków z zakresu cyberbezpieczeństwa.

Czy kierownictwo też musi się szkolić?

Tak. Zgodnie z art. 8e ust. 1 kierownik podmiotu kluczowego lub ważnego oraz osoba, której powierzono jego obowiązki, raz w roku kalendarzowym przechodzi szkolenie. Art. 8e ust. 3 wymaga, aby udział w szkoleniu był udokumentowany.

Jaka jest kara za brak szkolenia?

Art. 73a ust. 1 pkt 3 i 4 przewiduje karę pieniężną nakładaną osobiście na kierownika podmiotu za niewykonanie obowiązków z art. 8d i art. 8e. Kara może wynieść do 300% wynagrodzenia kierownika, a w podmiocie publicznym do 100% — niezależnie od kary nakładanej na sam podmiot.

Od kiedy obowiązują te przepisy?

Nowelizacja (Dz.U. 2026 poz. 252) została ogłoszona 2 marca 2026 r. i zgodnie z art. 49 weszła w życie po upływie miesiąca, czyli 3 kwietnia 2026 r. Podmioty, które w tym dniu spełniały już przesłanki uznania za kluczowe lub ważne, mają na wdrożenie obowiązków z rozdziału 3 — a więc także art. 8, 8d i 8e — 12 miesięcy, zgodnie z art. 33 ust. 1 ustawy nowelizującej, czyli czas do 3 kwietnia 2027 r. Podmioty uzyskujące ten status później liczą terminy od dnia spełnienia przesłanek. Nie jest to jednak rok bezczynności: art. 8e ust. 1 wymaga szkolenia kierownictwa raz w roku kalendarzowym, a ust. 3 — udokumentowania udziału.

Compliance

In Poland, training is now a statutory duty

What the Polish Act on the National Cybersecurity System actually says. This is no longer „a directive someone will implement one day" — the amendment has been in force since 3 April 2026 and, for essential and important entities, it names staff education and annual management training explicitly, with a separate fine for failing at either.

Start a training programme Read the analysis of the provisions

Legal basis

Three provisions you need to know

The Act of 23 January 2026 amending the Act on the National Cybersecurity System and certain other acts (Journal of Laws 2026, item 252) — the text as published in the Polish Journal of Laws, so you can check it at the source.

Art. 8(1)(2)

Education for personnel

Among the technical and organisational measures an essential or important entity must implement, the act lists in point (i) „cybersecurity education for the entity's personnel", and in point (j) „basic cyber hygiene practices" — what that covers.

Art. 8d(4)

Duty of the head of the entity

The head of the entity „ensures that the entity's personnel are aware of their cybersecurity obligations and know the entity's internal rules in that area".

Art. 8e

Annual management training

The head of the entity and any person entrusted with their cybersecurity duties complete training once every calendar year. Paragraph 3 adds a hard requirement: „Participation in the training shall be documented". „Head of the entity" is not one job title — Art. 2(8a) refers to the Accounting Act, which for a multi-member governing body points to the members of that body, i.e. the entire management board.

The fine is personal

The most frequently overlooked part of the amendment: the fine falls on the head of the entity, not only on the entity itself. Article 73a(1) explicitly lists failure to perform the duties under Art. 8d (point 3) and Art. 8e (point 4).


Type of entity	Maximum fine for the head of the entity
Commercial entity	300% of remuneration
Public entity	100% of remuneration

The amount is calculated under the rules used for holiday pay equivalent (Art. 73a(4) and (5)). The fine on the head of the entity is independent of any fine imposed on the entity.

Article 8c adds that where the head of the entity is a multi-member body and no responsible person has been designated, all members of that body bear the responsibility — and entrusting the duties to someone else does not release the head of the entity from liability.

How the platform covers these provisions

Education for personnel (Art. 8(1)(2)(i)) — 24 modules covering phishing, passwords, MFA, incidents, data and the supply chain.
Cyber hygiene (Art. 8(1)(2)(j)) — foundation modules plus spaced repetition.
Staff awareness (Art. 8d(4)) — the exam verifies that the employee actually knows the rules, rather than merely having received the material.
Management training (Art. 8e(1)) — a separate path for the management team, renewed each calendar year.
Documented participation (Art. 8e(3)) — a named certificate with the date and score, plus an aggregate report you can download at any time.

Deadlines worth telling apart


What	When	Basis
Amendment enters into force	3 April 2026	Art. 49 — one month after publication (2 March 2026)
Implementing the duties in Chapter 3 (including Art. 8, 8d and 8e)	3 April 2027	Art. 33(1) — 12 months for entities that already met the criteria on the day the act entered into force
First audit (essential entities)	3 April 2028	Art. 33(2) — 24 months
Application for entry in the register	per the schedule	Art. 33(3) — announcement by the minister, Art. 34(3)(1)

Beware of a myth. The date „3 October 2026" circulates as the deadline for implementing the duties. It does not appear in the act. For entities that met the criteria on 3 April 2026, the deadline for applying for entry in the register is set by a schedule announced by the minister (Art. 33(3) in conjunction with Art. 34(3)(1)), with separate dates for different categories of entity — and it may change. The six-month deadline in Art. 7c(1) runs from the day the criteria are met, so it applies to entities that become essential or important after the act entered into force.

How much time there really is. Article 33(1) gives entities that met the criteria on 3 April 2026 12 months to implement the duties in Chapter 3 — and training is part of them. That does not mean you can start in March 2027: Art. 8e(1) requires management training once every calendar year, and Art. 8e(3) requires participation to be documented. The evidence therefore has to be created within the year it concerns.

Sources

Check it in the official text

We would rather you did not take our word for it. Both acts are published in the Polish Journal of Laws (Government Legislation Centre).

The amendment — Journal of Laws 2026, item 252 — the act of 23 January 2026, published on 2 March, in force since 3 April 2026. This is where you will find Art. 8(1)(2)(i) and (j), Art. 8d, Art. 8e and Art. 73a — every provision quoted on this page.
Consolidated text — Journal of Laws 2026, item 20 — the announcement of the Marshal of the Sejm of 29 December 2025, useful for reading the act as a whole. Note that it predates the amendment, so it does not yet contain the new training duties — those are only in item 252.

Collect the evidence before the regulator asks for it

The trial lets you walk the whole path: training, exam, certificate, report.

Start for free