A KRI audit is the annual internal information security audit that Polish law requires from public bodies under the National Interoperability Framework regulation. The regulation in force today dates from 2024, not 2012, although many guides still describe the old version. This article explains who must comply, what the audit covers and who checks that it was done.
If you supply IT services to Polish municipalities, schools or government offices, or you run a Polish public-sector unit inside an international organisation, you will sooner or later be asked for a KRI audit report. KRI stands for Krajowe Ramy Interoperacyjności, the National Interoperability Framework. Below we set out the legal basis, scope and practical side of the audit as of November 2026. Our own service is described on the KRI audit page. This article is for information only and is not legal advice.
What KRI is and where the audit obligation comes from
KRI is the common name of a Council of Ministers regulation issued under Article 18 of the Act of 17 February 2005 on the computerisation of entities performing public tasks (the “computerisation act”). The regulation sets three groups of requirements:
- interoperability rules (§ 3–9): how public-sector systems must work together;
- minimum requirements for public registers and electronic information exchange (§ 10–14);
- minimum requirements for IT systems (§ 15–20), including data formats (§ 18), the information security management system (§ 19) and accountability recorded in system logs (§ 20).
Section 19 is the one that matters for the audit. Paragraph 1 requires the entity to establish, implement, operate, monitor, review, maintain and improve an SZBI (system zarządzania bezpieczeństwem informacji, i.e. an information security management system, ISMS). Paragraph 2 lists 14 activities that management must ensure. The last of them, point 14, requires the entity to ensure a periodic internal information security audit “not less than once a year”. That is the KRI audit.
KRI 2024 versus the 2012 regulation
Since 23 May 2024 the applicable text has been the Council of Ministers regulation of 21 May 2024 (Journal of Laws 2024, item 773). It replaced the 2012 regulation (Journal of Laws 2012, item 526; consolidated text 2017, item 2247). In practice:
- The numbering changed. The ISMS requirements that older documents cite as § 20 are now in § 19, and system logs are in § 20. Policies that still reference the old sections should be corrected at the next review.
- The audit obligation stayed. KRI 2024 keeps the requirement of an internal audit at least once a year.
- The standards remain the benchmark. Under § 19(3), the requirements are deemed met if the ISMS is built on PN-ISO/IEC 27001, safeguards follow PN-ISO/IEC 27002 and risk management follows PN-ISO/IEC 27005 (the Polish adoptions of the ISO/IEC standards).
If the last audit report you received cites only the 2012 regulation, the audit criteria were out of date.
Who must comply with KRI
The scope follows from Article 2 of the computerisation act. Full obligations apply to the public entities listed in Article 2(1), including public finance sector units: gminy (municipalities), powiaty (counties), województwa (regions) and their offices, budgetary units such as public schools, kindergartens and social welfare centres, and government administration offices. The act also covers other state organisational units, certain public-law legal persons, associations of these bodies, research institutes, the Łukasiewicz Research Network and non-public universities.
Article 2(1a) extends selected provisions, including Article 13, to non-public entities that perform public tasks under separate laws or on behalf of a public entity. For a private contractor in that position, the exact scope needs case-by-case analysis. Excluded from the act are, among others, the special services, the Chancelleries of the Sejm, Senate and President, and, with some exceptions, the National Bank of Poland.
| Who | Obligation | Legal basis |
|---|---|---|
| Municipal, county and regional offices | ISMS and an internal information security audit at least once a year | Art. 2(1) computerisation act; § 19(1) and § 19(2) point 14 KRI 2024 |
| Organisational units of JST (local government units): schools, kindergartens, social welfare centres, shared services centres | As above; the head of the unit is responsible | Art. 2(1) computerisation act; § 19 KRI 2024 |
| Government administration offices | As above | Art. 2(1) computerisation act; § 19 KRI 2024 |
| Non-public entities performing public tasks | Selected provisions, including Art. 13; scope to be determined | Art. 2(1a) computerisation act |
| Any organisation processing personal data | Appropriate security measures and regular testing of their effectiveness | Art. 32 GDPR (independently of KRI) |
Is the KRI audit mandatory, and who checks?
For public entities, yes. Section 19(2) point 14 leaves no discretion over frequency: at least once a year. In practice it is best scheduled on a fixed annual cycle so that the gap between two reports never exceeds 12 months.
Oversight is governed by Article 25 of the computerisation act. Inspections of IT systems used for public tasks in local government units and their organisational units are carried out by the voivode (wojewoda, the government’s representative in each region). In entities subordinate to or supervised by government administration bodies, the inspection is carried out by the supervising authority; in other public entities, by the minister responsible for digital affairs. KRI itself does not set fines. The consequences of a missing audit are inspection findings and post-inspection recommendations, managerial or disciplinary liability of the head of the unit, and a weaker position after a personal data breach, when the data protection authority asks about Article 32 GDPR measures.
KRI requires an internal audit but does not say who must carry it out. It can be done by an employee or outsourced to an external auditor acting as the internal audit function. What matters is competence, for example ISO/IEC 27001 Lead Auditor knowledge, and independence: the person who configures the systems should not be the one auditing them.
What a KRI audit covers
The audit checks whether the ISMS works in practice, not merely whether a security policy exists on paper. A typical scope has three layers.
Documentation
Information security policy and procedures, risk analysis, hardware and software inventory, access rights register, training records, contracts with IT suppliers (do they contain security clauses?), incident reporting procedure, the previous audit report and the status of its recommendations.
Interviews
Conversations with the head of the unit, the person responsible for IT, the data protection officer and selected staff, to check whether procedures are known and followed.
Technical verification
Review of system configuration and patching, accounts and access rights (including leavers’ accounts), backups and restore tests, the system logs required by § 20, network and endpoint protection. Vulnerability scanning is often part of the audit, as it reveals outdated software and services exposed to the internet.
The output is a report to the head of the unit with findings, their severity and recommendations. The detailed auditor questions and typical gaps for each area of § 19 and § 20 are in our KRI audit checklist. For the education sector, see KRI audits for schools and kindergartens.
How to prepare for the audit
- Collect the ISMS documents and check that they reference KRI 2024, not the 2012 regulation.
- Update the inventory of hardware, software and cloud services, including systems provided by the municipality or external suppliers.
- Retrieve the previous audit report and record which recommendations have been implemented.
- Agree scope and criteria: locations, systems, type of technical testing, report deadline.
- Name the interviewees and give the auditor read-only access to the relevant admin consoles.
If you are comparing offers or drafting a tender, our article on KRI audit cost and how to write a request for proposal lists the factors that drive the quote.
What changes on 23 February 2027: new KRI and KSC
The Act of 25 July 2025 (Journal of Laws 2025, item 1158) gives Article 18 of the computerisation act a new wording from 23 February 2027. KRI 2024 remains in force until 22 February 2027. According to its official justification, the draft new regulation of 29 July 2026 drops the ISMS requirements, because they are now comprehensively regulated by the amended KSC act (the Polish act on the national cybersecurity system, which transposes NIS2; Journal of Laws 2026, item 252, in force since 3 April 2026). The draft may still change.
Until 22 February 2027 the audit duty under § 19(2) point 14 still applies, so an audit planned for 2026 must be carried out. What happens to the ISMS afterwards, when a public body is a key or important entity under KSC, and how the audit changes is covered in new KRI from 2027 and KSC. If your organisation may fall under KSC, see also our NIS2 audit.
FAQ: frequently asked questions
What is a KRI audit in Poland?
It is the internal information security audit required by § 19(2) point 14 of the KRI 2024 regulation. It checks whether a public entity has a working information security management system and meets requirements on risk, access rights, training, backups, incidents and more.
Is a KRI audit mandatory for Polish municipalities?
Yes. A municipality and its office are public entities under Article 2(1) of the computerisation act and must carry out the audit at least once a year. The same applies to the municipality’s organisational units, such as schools and social welfare centres.
Who inspects KRI compliance in local government?
Under Article 25 of the computerisation act, inspections in local government units and their organisational units are carried out by the voivode.
Can an external company perform the KRI audit?
Yes. The regulation requires an internal audit but does not specify who performs it, so it can be outsourced. The report goes to the head of the unit, who is responsible for implementing the recommendations.
Which KRI regulation applies in 2026?
The Council of Ministers regulation of 21 May 2024 (Journal of Laws 2024, item 773), in force from 23 May 2024 until 22 February 2027. The ISMS requirements are in § 19, not § 20 as in the 2012 version.
Need a KRI audit for 2026, or a check of whether your ISMS documentation is current? See the scope of our KRI audit service and contact us. We prepare a custom quote based on the number of locations, users and systems.