The new KRI regulation 2027 is the result of two parallel changes: an amendment to the Polish Computerisation Act that gives art. 18 a new wording from 23 February 2027, and the amended Act on the National Cybersecurity System (KSC), which has regulated information security management systems since 3 April 2026. Under the draft new regulation, ISMS requirements will be removed from KRI, and a public body’s ISMS and audit obligations will come from the KSC and depend on its classification.
KRI (Krajowe Ramy Interoperacyjności — the National Interoperability Framework) is the regulation that sets interoperability, registry and IT security requirements for Polish public bodies. Since 2024 it has also required an SZBI (system zarządzania bezpieczeństwem informacji — information security management system, ISMS) with an annual internal audit. This article is written for foreign IT vendors and service providers working with Polish public bodies, and for international organisations with Polish public-sector units. It explains what applies today, what changes after 22 February 2027 and what to do in the coming months. The position is described as of November 2026; this article is for information only and is not legal advice.
What applies today: KRI 2024 until 22 February 2027
The current text is the Council of Ministers regulation of 21 May 2024 on the National Interoperability Framework (Dz.U. 2024 item 773), in force since 23 May 2024. Its § 19 requires a public body to establish, implement, monitor and continually improve an ISMS, and § 19(2) lists 14 management duties: updating internal rules, keeping an inventory of hardware and software, periodic risk analysis, training, technical safeguards and, in point 14, a periodic internal information security audit at least once a year. § 20 covers accountability through system logs.
These provisions apply up to and including 22 February 2027. The 2026 audit must therefore be carried out under the existing rules, and inspections under art. 25 of the Computerisation Act (carried out by the voivode, the central government’s regional representative, in local government units) can verify compliance with § 19. The basics are explained in KRI audit: what it is and who must comply and the scope of checks in our KRI audit checklist. If the 2026 audit is still ahead of you, see our KRI audit service.
The 2025 amendment and the 2026 draft KRI regulation
The Act of 25 July 2025 amending the Act on the computerisation of entities performing public tasks (Dz.U. 2025 item 1158) gives a new wording to art. 18, the provision under which KRI is issued. The new wording takes effect on 23 February 2027, and KRI 2024, issued under the old delegation, will cease to apply at that point.
A new regulation is to be issued under the new delegation. The draft of 29 July 2026 is planned to enter into force on 23 February 2027. According to its official justification, the key change is the removal of the ISMS requirements, because this area is now comprehensively regulated by the amended KSC Act (Act of 23 January 2026, Dz.U. 2026 item 252), in force since 3 April 2026 and implementing NIS2 in Poland. It is still a draft: content and timing may change, and progress can be followed on the Government Legislation Centre website.
New KRI regulation 2027: what stays in KRI and what moves to the KSC
| Area | Until 22 February 2027 | From 23 February 2027 (per the draft) |
|---|---|---|
| Interoperability rules | KRI 2024 | New KRI |
| Public registers and electronic information exchange | KRI 2024 | New KRI |
| ISMS and annual internal audit (§ 19) | KRI 2024 | Removed from KRI; ISMS under the KSC for key and important entities |
| Security of personal data processing | GDPR art. 32 | GDPR art. 32, unchanged |
Two points matter here. First, KRI does not disappear: it will still govern interoperability, registers and electronic information exchange, so bodies that run registers or deploy systems such as EZD RP (the document management system used by Polish public offices) must keep applying it. Second, the GDPR applies regardless of KRI and the KSC. Schools and municipal offices process children’s and residents’ data, so art. 32 GDPR requires security measures appropriate to the risk, including in bodies outside the KSC.
KRI and the KSC: is a public body a key or an important entity?
The amended KSC defines a “public entity” (podmiot publiczny) as an entity listed in annex 1 or 2 to the Act under the sector “public entities”. Which annex the body falls into, and with what status, determines its ISMS obligations under the KSC.
| KSC status | Examples | ISMS | Audit or review |
|---|---|---|---|
| Key entity (annex 1) | Many public finance sector units; the Act provides exclusions, e.g. for local government education units | Full ISMS under art. 8 | Security audit at least every 3 years (art. 15); the first within 24 months of obtaining the status |
| Important entity that is a public entity (annex 2) | Local government budgetary units and budgetary establishments, cultural institutions, municipal companies | Instead of art. 8(1), an ISMS meeting annex 4 | ISMS review at least once a year (annex 4, part III) and documented actions (part IV) |
| Body outside the KSC | Depends on classification | No KSC obligation; after 23 February 2027, per the draft, none from KRI either | No KRI audit obligation per the draft; GDPR art. 32 still applies |
Do not assume in advance that a body is in or out of scope. The status of a school, kindergarten, social-welfare centre or cultural institution has to be determined individually from the annexes and exclusions in the Act. Our NIS2 / KSC audit starts with exactly this classification.
ISMS under the KSC: what annex 4 contains
For important entities that are public entities, annex 4 sets the minimum ISMS content. It includes, among other things:
- an inventory of ICT assets,
- access control and the principle of least privilege,
- secure remote work and control of e-mail,
- backups that are logically and physically separated, with restore testing,
- incident handling procedures and anti-malware protection,
- cyber-hygiene training, including for the head of the body,
- software patching and use of stable versions,
- an ISMS review at least once a year and documentation of actions taken.
Some of these requirements are more specific than KRI 2024. Backups are a good example: it is not enough that they exist; they must be separated and restores must be tested.
Mapping: § 19 KRI 2024 areas to KSC annex 4
This table helps you prepare for the new KRI regulation 2027 by reusing existing ISMS documentation when moving to the KSC requirements for an important entity that is a public entity. It is indicative: compare it with the current text of annex 4 before implementation.
| § 19 KRI 2024 area | Counterpart in KSC annex 4 | Notes |
|---|---|---|
| ISMS based on PN-ISO/IEC 27001 (§ 19(1) and (3)) | ISMS meeting annex 4 (instead of art. 8(1)) | An ISO/IEC 27001-based ISMS remains a good foundation |
| Updating internal rules | ISMS review (part III) and documentation of actions (part IV) | Review results should feed document updates |
| Hardware and software inventory | Inventory of ICT products, services and processes (part I point 1) | The existing register is the starting point |
| Periodic risk analysis | Annex 4 does not list risk assessment explicitly; for key entities art. 8(1)(1) requires it | GDPR art. 32 also requires a risk-based approach; worth keeping |
| Managing staff authorisations | Access only for authorised users, least privilege, revoking and adjusting permissions (part I points 4–7) | Add a regular review of accounts and permissions |
| Training | Cyber-hygiene, including the head of the body, and training on threats and incident response (part I points 14 and 17) | The head’s participation is explicitly required |
| Mobile work, protection against unauthorised access | Remote-work rules (part I point 8), e-mail controls (point 9), anti-virus software (point 13) | E-mail control is more specific than anything in KRI |
| Technical safeguards and vulnerability handling | Stable, supported software versions (part I points 15–16); separated backups and restore testing (points 10–11) | General in KRI 2024, specific in annex 4 |
| Security clauses in supplier contracts, media disposal | Security clauses in service contracts – part II point 7 (optional element); media disposal is not listed explicitly | Keep as good practice and as part of GDPR compliance |
| Incident reporting | Tested procedures for failures and incidents (part I points 12 and 18) | The KSC also imposes separate incident reporting obligations |
| Annual internal audit (point 14) | ISMS review at least once a year (part III), documentation (part IV) | Key entity: art. 15 audit at least every 3 years instead |
What to do now: a 2026–2027 timeline
| Period | Actions |
|---|---|
| By the end of 2026 | Carry out the 2026 KRI audit under § 19 of KRI 2024. Establish the body’s KSC status (key, important, out of scope); if it is covered, KSC obligations may already apply now, in parallel with KRI. Plan the 2027 budget. |
| By 22 February 2027 | Run a gap analysis between the current ISMS and annex 4 (important entity) or art. 8 (key entity). Close the gaps that are easy to miss: separated backups with restore tests, training for the head of the body, e-mail controls. Follow the progress of the draft KRI. |
| From 23 February 2027 | Apply the new KRI (if adopted) for interoperability and registers. Important entity: ISMS review at least once a year, with documentation. Key entity: art. 15 audit within 24 months of obtaining the status, then at least every 3 years. Body outside the KSC: GDPR art. 32 measures, and a decision on keeping the ISMS and an annual review as good practice. |
If you buy audits under a multi-year contract, reflect this change in the scope and in the contract-change terms; see KRI audit cost and how to write a request for proposal. Where in-house security expertise is limited, a vCISO can provide ongoing support.
FAQ: frequently asked questions
When does the new KRI regulation take effect?
The draft of 29 July 2026 is planned to enter into force on 23 February 2027, the day the new wording of art. 18 of the Computerisation Act takes effect. KRI 2024 applies until 22 February 2027. The draft may still change.
Is a KRI audit still required in 2026?
Yes. KRI 2024, with its obligation of an internal audit at least once a year, applies until 22 February 2027.
Is the ISMS being removed from KRI?
According to the draft’s justification, yes, because the ISMS is regulated by the amended KSC. For public bodies covered by the KSC, the ISMS obligation will then come from that Act.
Is every Polish school an important entity under the KSC?
You cannot assume so. Status depends on the annexes to the Act and the exclusions it provides, so each body must be classified individually.
What is the difference between a key entity audit and an important entity ISMS review?
A key entity must undergo a security audit at least every 3 years (art. 15 KSC). An important entity that is a public entity reviews its annex 4 ISMS at least once a year and documents its actions.
Want to complete a final audit under KRI 2024 and check readiness for the KSC at the same time? See our KRI audit service and get in touch. We will help establish the body’s KSC status and prepare a quote for an audit with a gap analysis.