CyberSec Update #39: Last Call for Registration – NIS2
Last Call for Registration in the Register of Essential and Important Entities
The approaching deadline for registration in the register of essential and important entities is attracting increasing attention from organizations subject to obligations under the Polish National Cybersecurity System Act.
It is important to remember that this deadline is established directly by law and constitutes a substantive legal deadline. As a result, the rules for calculating deadlines set out in the Code of Administrative Procedure do not apply, including the rule that extends a deadline to the next business day when its final day falls on a Saturday or public holiday.
In other words, if the statutory deadline falls on a Saturday, it expires on that Saturday. Failure to meet the deadline may result in the legal consequences provided for under the Act.
Do Not Leave Registration Until the Last Minute
Delaying registration until the final day involves genuine risks. During the last hours before the deadline, public administration ICT systems may become overloaded due to the large number of applications being submitted.
This increases the likelihood of technical errors, slower system performance or temporary unavailability of the registration platform.
At the same time, obtaining support from technical help desks may prove more difficult, as many organizations are likely to encounter and report similar issues simultaneously.
Organizational Risks and Additional Costs
Organizations should also consider the operational consequences of postponing registration. If the registration process must be completed during a weekend or late in the evening, additional costs related to overtime work may arise.
As the deadline will not be extended to the next business day, organizations should plan all actions necessary for submitting their application well in advance and ensure compliance with the statutory timeframe.
Registration Through an Authorized Representative
The legislator has provided a practical solution that may facilitate the process. An application for entry into the register may be submitted by an authorized representative.
The representative may be either an employee of the organization or an external professional, such as an advocate or legal counsel.
Entrusting the process to a representative can relieve the burden on internal teams responsible for registration and increase the likelihood of meeting the deadline, even in the absence of key personnel.
It Pays to Act Early
In practice, the best approach is to prepare the required documentation in advance, verify the organization’s obligations and plan the submission process with sufficient lead time.
Registration in the register of essential and important entities is not merely a formality. It forms part of a broader cybersecurity framework designed to protect critical processes and infrastructure.
Organizations should therefore approach the registration process with due diligence and avoid last-minute submissions, particularly because the deadline is substantive in nature and is not subject to extension.
