Regulatory calendar
Regulatory calendar 2025–2028: KSeF, NIS2 and AI Act
The dates that shape your company's year in Poland and the EU, each with its current status and official source.
14 October 2026
We have gathered the KSeF, NIS2, AI Act and residence deadlines that affect businesses in Poland in one place. Every date is checked against the official source we link to, and we flag any deadline that has been postponed or is still under review.
-
Already in force
AI Act: prohibitions and AI literacy
Prohibited AI practices apply, along with the duty to ensure that staff who use or deploy AI systems have sufficient AI literacy.
-
Already in force
AI Act: general-purpose AI models
Obligations for providers of general-purpose AI models apply, together with the Act's governance rules.
-
Already in force
KSeF 2.0: largest issuers and receiving invoices
Issuing invoices in KSeF becomes mandatory for taxpayers whose 2024 sales (including VAT) exceeded PLN 200 million. From the same day, subject to statutory exceptions, Polish businesses receive their invoices through KSeF.
-
Already in force
KSeF for all other businesses
The obligation to issue invoices in KSeF extends to all other taxpayers. Businesses invoicing up to PLN 10,000 gross a month may stay outside KSeF until 31 December 2026.
-
Already in force
The amended KSC (NIS2) enters into force
The amendment to Poland's cybersecurity act (Dz.U. 2026 poz. 252) transposes NIS2 and defines essential and important entities. The adjustment deadlines run from this date.
-
Already in force
Polish residence applications go online-only via MOS
Applications for temporary residence, permanent residence and EU long-term resident status are filed only electronically on the MOS portal, with some exceptions. They are signed with Profil Zaufany, a qualified electronic signature or a personal signature (podpis osobisty).
-
Already in force
AI Act: general application and transparency
The Act applies in general, including the Article 50 transparency duties (telling people they are dealing with AI, marking generated content). The high-risk rules were postponed to 2027 and 2028.
-
Already in force
NIS2 register deadline has passed
The window that opened on 7 May for entities already meeting the criteria to apply for entry in the register (wykaz) has closed. If this applied to you and you did not apply, put it right as soon as possible.
-
Coming up
AI Act: content marking and a new prohibition
Deadline for synthetic-content systems placed on the market before 2 August 2026 to mark that content. AI that generates non-consensual intimate images or child sexual abuse material is also banned from this date.
-
Coming up
KSeF mandatory for every business
The exemption for sales up to PLN 10,000 a month ends, and so does invoicing from cash registers. From here on, every business issues its invoices in KSeF.
-
Coming up
KSeF penalties: postponement in progress
Current law provides for penalties from this date. On 16 September 2026 the Ministry of Finance announced a bill to defer them until the end of 2027; until it is published, the current date stands and the duty to use KSeF is unchanged.
-
Coming up
KSeF number in bank transfers
Payments between active VAT taxpayers for KSeF invoices must quote the KSeF number or the collective identifier, including split payments (MPP).
-
Coming up
Main NIS2 deadline and the S46 system
Essential and important entities that met the criteria when the amendment took effect must have their obligations in place (ISMS/SZBI, incident handling and reporting) and be using the S46 system.
-
Coming up
AI Act: Annex III high-risk systems
New date for the Annex III high-risk systems (e.g. employment, education, biometrics), postponed from 2 August 2026 by Regulation (EU) 2026/1744, the Digital Omnibus on AI.
-
Coming up
First NIS2 audit and fines
Deadline for the first cybersecurity audit of essential entities that met the criteria in 2026. Most KSC fines can be imposed for the first time from this date.
-
Coming up
AI Act: high-risk AI in products (Annex I)
High-risk AI systems built into regulated products, such as machinery, toys or lifts, move to this date from 2 August 2027, also under the Digital Omnibus on AI.
Which deadline hits you first?
In a free 30-minute assessment we check which dates apply to your business and what to do before each one.