Compliance and Audits
The amendment to Poland’s National Cybersecurity System Act (KSC Act) is effective from April 3, 20261, DORA – from January 17, 20252. Additionally, there’s CRA for hardware and software manufacturers, and the AI Act. We help you determine which obligations apply to you, close gaps, and prove – including with manual penetration tests – that your security measures are effective.
2027
April 3 is the deadline for implementing obligations from the amendment to the KSC Act for essential and important entities that met the criteria on its effective date.1
October 3, 2026
deadline for submitting an application for inclusion in the list of essential and important entities passed.1
2028
by April 3, the first audit for essential entities, then at least every three years. From this date, penalties can also be imposed for most obligations.1
2%
of annual turnover or EUR 10 million – NIS2 requires penalties for essential entities to reach at least this threshold (for important entities: 1.4% or EUR 7 million).3
September 11, 2026
from this date, manufacturers report actively exploited vulnerabilities (CRA). The main CRA requirements apply from December 11, 2027.4
Conclusion: deadlines are closer than they seem. Identifying, analyzing gaps, planning, and implementing technical security measures typically takes many months of work, in our experience – especially when purchases and vendors are involved.
Areas from NIS2, DORA, CRA, and the AI Act where more than just a document is often missing. For each: what we do and which solution technically closes the gap.
NIS2 begins the list of mandatory measures with risk analysis and information system security policies (Article 21(2)(a)).3 An analysis from several years ago does not cover cloud, AI, or new vendors.
SafeWave: current risk assessment for systems and processes your services depend on, and the resulting policies.
An early warning must be sent within 24 hours of detecting a significant incident.3 Without monitoring and an established decision path, this deadline is unrealistic.
SafeWave: incident handling and reporting procedure, scenario-based exercises, and 24/7 monitoring – see SOC, XDR, and Threat Intelligence.
NIS2 requires supply chain security (Article 21(2)(d)).3 DORA goes further: financial entities must maintain a register of information on all contracts with ICT service providers (Article 28(3)).2
SafeWave: ICT vendor registry, risk assessment, and security requirements for contracts.
NIS2 requires policies and procedures for assessing the effectiveness of risk management measures (Article 21(2)(f)).3 DORA explicitly mentions penetration tests in the resilience testing program (Articles 24–25).2
SafeWave: manual penetration tests with a report and retest, and continuous validation – see CTEM and Resilience Validation.
If you place hardware or software on the EU market, CRA covers you as a manufacturer. From September 11, 2026, actively exploited vulnerabilities must be reported – an early warning within 24 hours.4
SafeWave: assessment of whether and which products are subject to CRA, vulnerability handling and reporting process, and product security tests.
From August 2, 2026, transparency obligations from the AI Act apply, and requirements for high-risk systems from Annex III – from December 2, 2027.5
SafeWave: AI governance – inventory of applications, policy, risk assessment, and classification according to the AI Act, in the spirit of ISO/IEC 42001.6 See Secure and Responsible AI.
Policies in a binder are a good start. However, an auditor will ask how they work in practice – and ask for proof.
A document is not a security measure. Compliance is a demonstrable state.
SafeWave
We connect legal requirements with technology we know inside out. This ensures that the compliance plan immediately translates into concrete security measures, not just documents.
Determining whether you are subject to NIS2/KSC, DORA, or CRA, comparing current status with requirements and ISO/IEC 27001, risk assessment.7
Schedule with owners, implementation of security measures from our areas, and documentation for the auditor.
Scope assessment, vulnerability handling and reporting process, product security documentation.
AI policy, inventory of applications, risk assessment, and classification according to the AI Act.
Tests conducted by pentesters – applications, APIs, and infrastructure – with a report, recommendations, and retest.
Training for the board on NIS2 obligations and a regular, understandable security status report.
It is advisable to confirm the interpretation of regulations in a specific case with a lawyer. We are responsible for ensuring that requirements are transformed into effective security measures.
NIS2 and the KSC Act
18 sectors in Annexes I and II of the NIS2 Directive.3
DORA
January 17, 2025 – from this date, DORA applies across the EU.2
CRA
December 11, 2027 – from this date, the main CRA requirements apply.4
Article 20 – board responsibility, Article 21 – ten areas of risk management measures, Article 23 – incident reporting, Article 34 – penalties.3
Effective from April 3, 2026. Entry into the register by October 3, 2026, implementation of obligations by April 3, 2027, first audit for essential entities by April 3, 2028.1
From January 17, 2025: ICT risk management, incident reporting, resilience testing – including penetration tests – ICT third-party risk, and information sharing on threats.2
Regulation (EU) 2024/2847 is effective from December 10, 2024. Reporting of actively exploited vulnerabilities from September 11, 2026, main requirements from December 11, 2027.4
Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744: obligations according to role and risk level, transparency from August 2, 2026, high-risk (Annex III) from December 2, 2027.5
This page organizes the most important obligations and deadlines but does not replace reading the regulations or seeking legal advice.
SafeWave has been operating since 1998 as a vendor-agnostic integrator. We treat compliance as a security plan, not a documentation project.
We determine which regulations you are subject to – NIS2/KSC, DORA, CRA, AI Act – and which systems, products, and services are in scope.
We compare the current state with requirements and assess risk. Result: a prioritized list of gaps.
Schedule with owners and implementation of security measures – organizational and technical.
Manual penetration tests, documentation for the auditor, incident exercises, and a report for the board. Support in English and Polish.
Let’s start with a brief analysis: which regulations apply to you – NIS2/KSC, DORA, CRA, AI Act – what obligations concern you, and where the biggest gaps are.