CRA Compliance in Poland

CERT Polska/NASK serves as Poland's national competent authority for the CRA under the supervision of the Minister Cyfryzacji (Ministry of Digitalization). Market surveillance for CE-marked products is coordinated with UOKiK (Office of Competition and Consumer Protection) and sector-specific regulators including URE (energy) and UKE (telecoms). Poland has implemented a national cybersecurity framework under the KSC Act that created structured oversight of critical infrastructure operators, and the CRA extends similar obligations to product manufacturers. CERT Polska participates in ENISA's CRA working groups and publishes Polish-language implementation guidance.

Polish manufacturers submit Article 14 notifications through the CERT Polska incident reporting portal at incydent.cert.pl. CERT Polska operates 24/7 incident response capability. The CRA Article 14 obligation requires an early warning within 24 hours of detecting active exploitation and a full notification within 72 hours. Poland's KSC Act already mandates incident reporting for operators of essential services through CERT Polska, and manufacturers subject to both frameworks should coordinate their notification procedures. CERT Polska maintains active coordination with ENISA and the EU CSIRTs network, relaying cross-border product incident notifications as required.

Market surveillance in Poland for CRA products is coordinated between CERT Polska, UOKiK (consumer protection), and sector regulators. The full CRA penalty regime applies: up to €15 million or 2.5% of global annual turnover for violations of essential cybersecurity requirements. Poland has been strengthening its market surveillance capabilities under EU product safety regulations, and UOKiK has demonstrated active enforcement in consumer product markets. Polish manufacturers should maintain comprehensive technical documentation as UOKiK may initiate documentation requests as part of routine market surveillance.

CERT Polska publishes cybersecurity guidance in Polish, including reports on current threats and vulnerability handling recommendations. The Polska Agencja Rozwoju Przedsiębiorczości (PARP) provides SME support programmes including subsidised cybersecurity advisory services. Przemysł 4.0 (Industry 4.0) digital transformation programmes coordinated by the Ministry of Development include cybersecurity components aligned with CRA requirements. Poland has a growing ecosystem of cybersecurity consultancies and laboratories — several accredited by the Polish Centre for Accreditation (PCA) — capable of supporting CRA conformity activities. Związek Cyfrowa Polska engages the technology industry on regulatory implementation.