Your Polish suppliers, mapped for NIS2

What NIS2 Article 21 asks about your suppliers

Article 21(2)(d) of the NIS2 Directive (EU) 2022/2555 lists supply chain security among the minimum cybersecurity risk-management measures for essential and important entities — including the security aspects of the relationship with each direct supplier or service provider.

Article 21(3) adds that, when deciding which of those measures are appropriate, you take into account the vulnerabilities specific to each direct supplier and the overall quality of your suppliers' products and cybersecurity practices.

For a supplier based in Poland, the basic facts sit in Polish registries: KRS (National Court Register), REGON (the business register run by Statistics Poland), the VAT white list (the Ministry of Finance's register of VAT taxpayers) and the insolvency registers. They are kept in separate systems, so checking each Polish supplier by hand is slow.

What the map shows for each supplier

The input is a list of NIPs. If your systems hold Polish EU VAT numbers, the NIP is the 10 digits after the ‘PL’ prefix.

For each supplier, the map gives 4 findings. Every finding names its source, the date the data was retrieved, a confidence level and a short rationale, so your team can trace it back to the original record.

• Likely in scope of NIS2 — whether the supplier may itself be an essential or important entity under the KSC act, the Polish law implementing NIS2.
• ICT supplier — whether the supplier appears to provide ICT products or services.
• Ownership risk — the parent company chain from GLEIF (for companies that have an LEI) and EU sanctions lists.
• Financial risk — bankruptcy or restructuring on record in Polish registries.

Where the data comes from

Public sources only. Supplier systems are not scanned, tested or accessed.

• VAT white list — the Polish Ministry of Finance's register of VAT taxpayers
• KRS — the National Court Register, where Polish companies are registered
• REGON — the national business register maintained by Statistics Poland (GUS)
• GLEIF — the global Legal Entity Identifier (LEI) system, including parent company relationships
• EU sanctions lists
• Polish insolvency registers — bankruptcy and restructuring proceedings

NIS2 in Poland: the KSC act

Poland implements NIS2 through an amendment to its National Cybersecurity System Act — in Polish, ustawa o krajowym systemie cyberbezpieczeństwa, or KSC (Journal of Laws 2026, item 252) — in force from 3 April 2026.

Polish essential and important entities in scope from that date must meet its requirements by 3 April 2027, and essential entities must complete their first audit by 3 April 2028.

A Polish supplier that is in scope itself has cybersecurity obligations of its own under this act — useful context when you consider its practices under NIS2 Article 21(3). The map shows which of your suppliers are likely to be in that position.

What happens to your data

• Demo: nothing is needed from you. It is built from the published contract award notices of a single Polish public institution, with no NDA.
• Pilot on your own supplier list: a data processing agreement under Art. 28 GDPR is signed first.
• Supplier lists from a pilot are processed in the EU, with a local language model — no external AI APIs.
• To look suppliers up, identifiers such as their NIPs are sent to the public registries as search queries — just as when someone searches those registries by hand.
• Please do not send supplier lists through the demo form.

Who it is for

Organisations that are essential or important entities under NIS2 — for example in Germany, Austria, the Netherlands or the Nordic countries — and that buy from Polish suppliers or have subsidiaries in Poland. The input is a list of NIPs, so Polish group companies can go on it too.

• CISOs and security teams putting supply chain measures in place under Article 21(2)(d)
• Supplier-risk and third-party risk teams that need a sourced first picture of their Polish suppliers
• Compliance teams that need every finding traceable to a named source and date

What NIS2 Supplier Compass is not

• Not legal advice. The map does not decide whether you or any supplier falls under NIS2 or the KSC act; it gives you sourced facts to start from.
• Not an audit. It does not test, scan or access your suppliers' systems and does not evaluate their security controls.
• Not consulting or advisory work. You receive findings with their sources; decisions about measures stay with your organisation.
• Not a replacement for your own supplier risk assessment under Article 21 — only a documented input to it.

Free demo: a real supplier risk map from public data

To show what you would receive, we build a risk map of the suppliers of a single Polish public institution, using its published contract award notices. That is public data, so nothing is needed from you or from the institution, and there is no NDA. The demo is free and unconditional: no call, feedback, purchase or marketing consent is required. If you would rather not talk, we send it by e-mail.

1. Leave your work e-mail and your organisation's name in the form. Nothing else is required.
2. We reply within 1 business day. If you prefer, everything happens by e-mail.
3. You receive the demo map: 4 findings per supplier, each with its source, date, confidence level and rationale.
4. If you want the same for your own suppliers, a pilot starts once a data processing agreement (Art. 28 GDPR) is signed.

Please do not send supplier lists or other supplier data through this form. For a pilot on your own list, we first sign a data processing agreement (Art. 28 GDPR).