The calendar of obligations is a list of digital deadlines (EZD, KSC, KSeF, e-Doręczenia, CRU, AI Act, eIDAS 2.0, Cyber Resilience Act, interoperability, accessibility) that apply to local government units (JST), municipal companies and businesses, together with their legal status, sources and what they mean for the board. Entries marked “for orientation” do not apply directly to the authority (an obligation on the state, on businesses, or a funding window), but show what is happening around digitalisation. A deadline is only the beginning: each one needs a person responsible and a next step. Status as at ; we check it every month (history of changes). Before making a decision, it is worth confirming the deadline at the source.
From deadline to actionobligation, person responsible, next stepillustrative figureillustrative data
Upcoming deadlines
European Funds for Digital Development 2021–2027 (FERC)End of the FERC.04.01-IP.01-003/26 call (CPPC) for creating Local Cybersecurity Centres: applications may only be submitted by partnerships of at least two JST, via the LSI system.for orientation · JST
KSeF (Polish National e-Invoicing System)End of the transitional period: KSeF becomes the only permitted form of VAT invoice, with no monthly threshold for invoices issued outside the system. This also applies to organisational units of JST, schools and cultural centres.JST · municipal companies · business
Digital accessibility and the accessibility status reportAnnual review and update of the accessibility declaration for the website and mobile application (Article 11 of the Digital Accessibility Act); also immediately after changes that may affect accessibility.JST · municipal companies
KSC / NIS 2 (National Cybersecurity System)End of the adjustment period for entities meeting the criteria on 3 April 2026 (a later entry in the register does not shift this deadline): an implemented information security management system, incident handling and reporting (early warning within 24 hours, notification within 72 hours, final report within 30 days), designated KSC contact persons, and connection to the S46 system.JST · municipal companies · business
AI Act (EU regulation on artificial intelligence)Obligations for high-risk AI systems listed in Annex III (including employment, and access to services and benefits); the deadline has been postponed under the Digital Omnibus package.JST · municipal companies · business
Cyber Resilience Act (security requirements for digital products)Full application of the regulation: products with digital elements placed on the EU market must meet the security requirements and bear CE marking, and the manufacturer must provide security updates for a declared period.business
eIDAS 2.0 (European Digital Identity Wallet)Entities subject to strong customer authentication (including banks and payment institutions) must accept the wallet. The sources do not indicate a separate obligation for JST as of this date.JST · business
KSeF (Polish National e-Invoicing System)Penalties for invoices issued outside KSeF. On 6 November 2026 the Sejm passed an act postponing them from 1 January 2027 to 1 January 2028; the act is awaiting the Senate, the President's signature and publication.JST · municipal companies · business
Polish e-Delivery (e-Doręczenia)Draft bill (version of 8 July 2026): end of correspondence via ePUAP between public entities, mandatory Public Hybrid Service, and integration of office systems with e-Delivery. The deadline for phasing out ePUAP has already been postponed before and may change again.JST · municipal companies · business
KSC / NIS 2 (National Cybersecurity System)First mandatory audit of key entities that were not previously key-service operators; subsequent audits at least once every three years. From this date, financial penalties become possible.JST · municipal companies · business
EZD-class system (electronic document and case management)Announced obligation to conduct case handling in an EZD-class system. The deadline has been pushed back from 1 January 2028 to 2029 at the earliest; the Ministry of Digital Affairs has announced regulations, but the draft act introducing this obligation has not yet been published.JST
European Funds for Digital Development 2021–2027 (FERC)End of the 2021–2027 perspective: expenditure under projects must be incurred by the end of 2029 at the latest, and calls close earlier. The programme supports e-services, digitalisation of office processes and, following the mid-term review, cybersecurity for JST (measure 4.1, Local Cybersecurity Centres).for orientation · JST
AI Act (EU regulation on artificial intelligence)Compliance deadline for high-risk systems used by public authorities that were put into service before the date of application.JST · municipal companies · business
Deadlines that have already passed (14)
KSC / NIS 2 (National Cybersecurity System)End of self-registration in the register of key and important entities (for entities not registered ex officio).JST · municipal companies · business
Polish e-Delivery (e-Doręczenia)Obligation extends to the next group of entrepreneurs from CEIDG (e-Delivery address in the Electronic Address Database by 30 September 2026).JST · municipal companies · business
Cyber Resilience Act (security requirements for digital products)Manufacturers of products with digital elements (software, network-connected devices) must report actively exploited vulnerabilities and serious incidents via the ENISA platform: early warning within 24 hours.business
AI Act (EU regulation on artificial intelligence)The Polish Act on Artificial Intelligence Systems (Dz.U. 2026 item 1003) enters into force; it establishes the Commission for the Development and Security of Artificial Intelligence (KRiBSI) as the supervisory authority. Some provisions, including those on complaints and KRiBSI opinions, apply from 28 October 2026.JST · municipal companies · business
AI Act (EU regulation on artificial intelligence)General date of application of the regulation, including transparency obligations: informing users that they are interacting with a chatbot, and labelling AI-generated content.JST · municipal companies · business
Central Register of Contracts (CRU JSFP)Obligation to register contracts concluded from this date by public finance sector units, with no value threshold, within 30 days of concluding or amending a contract.JST
KSC / NIS 2 (National Cybersecurity System)The amendment to the Polish National Cybersecurity System Act (Dz.U. 2026 item 252) enters into force.JST · municipal companies · business
KSeF (Polish National e-Invoicing System)Issuing invoices via KSeF for the remaining taxpayers, including local government units (JST) and municipal companies.JST · municipal companies · business
KSeF (Polish National e-Invoicing System)Obligation to receive invoices via KSeF for everyone; issuing via KSeF for the largest taxpayers.JST · municipal companies · business
Polish e-Delivery (e-Doręczenia)End of the transitional period in public entities: e-Delivery becomes the primary channel of correspondence with citizens and businesses, with ePUAP used only in specific cases.JST · municipal companies · business
Polish Act on Accessibility (products and services of companies)Businesses must supply products and provide services that meet accessibility requirements (Act of 26 April 2024, Dz.U. 2024 item 731), with transitional periods for some products and services.for orientation · business
Digital accessibility and the accessibility status reportReport on the state of accessibility provision by the public entity (architectural, digital, and information-and-communication) submitted via the GUS system and published in the BIP; the report is submitted every four years.JST · municipal companies
Announced obligation to conduct case handling in an EZD-class system. The deadline has been pushed back from 1 January 2028 to 2029 at the earliest; the Ministry of Digital Affairs has announced regulations, but the draft act introducing this obligation has not yet been published.
What this means for the board. The obligation means actually conducting case handling in an electronic environment, not merely installing a system. Choosing a system and migrating (e.g. from EZD PUW) is a decision with consequences for years, affecting document flow, integration with domain-specific systems and the work of every department. Separately, on 6 November 2026 the Sejm passed an amendment to the Act on the National Archival Resource and Archives: it does not introduce an EZD obligation, but it sets requirements for EZD-class systems, allows paper to be replaced by a digital reproduction bearing a qualified signature, and gives 24 months to adapt systems from the act's entry into force (12 months after publication). Exact dates will be added once the act is published.
First step. Draw up an inventory of systems, document flow and integrations before the office chooses its path (EZD RP or another EZD-class system). More.
in forceapplies to: JST, municipal companies, businesschecked:
The amendment to the Polish National Cybersecurity System Act (Dz.U. 2026 item 252) enters into force.
End of self-registration in the register of key and important entities (for entities not registered ex officio).
End of the adjustment period for entities meeting the criteria on 3 April 2026 (a later entry in the register does not shift this deadline): an implemented information security management system, incident handling and reporting (early warning within 24 hours, notification within 72 hours, final report within 30 days), designated KSC contact persons, and connection to the S46 system.
First mandatory audit of key entities that were not previously key-service operators; subsequent audits at least once every three years. From this date, financial penalties become possible.
What this means for the board. County offices (starostwa powiatowe) and budgetary units and establishments of voivodeship self-government are key entities regardless of size; a municipal office (urząd gminy) becomes one once it exceeds 50 employees on employment contracts. Subordinate units, cultural institutions and municipal companies may be important entities. The obligations rest with management, and they are based on knowledge of systems, suppliers and risks. The same inventory serves KSC compliance, system selection and audits.
First step. Document the status of the whole group (office, subordinate units, municipal companies), check the register entry, and plan the implementation of an information security management system before 3 April 2027. More.
Obligation to receive invoices via KSeF for everyone; issuing via KSeF for the largest taxpayers.
Issuing invoices via KSeF for the remaining taxpayers, including local government units (JST) and municipal companies.
End of the transitional period: KSeF becomes the only permitted form of VAT invoice, with no monthly threshold for invoices issued outside the system. This also applies to organisational units of JST, schools and cultural centres.
Penalties for invoices issued outside KSeF. On 6 November 2026 the Sejm passed an act postponing them from 1 January 2027 to 1 January 2028; the act is awaiting the Senate, the President's signature and publication.
What this means for the board. KSeF changes the cost-invoice flow from receipt to posting: integration with the finance and accounting system, invoice description and approval, and linking invoices to the relevant case in the document management system. In JST, this includes correctly identifying subordinate units on the invoice (FA(3) structure), which the Ministry of Finance recommends supporting in software linked to KSeF.
First step. Map the invoice flow from receipt in KSeF to posting, and check which systems need to be connected to each other. More.
in forceapplies to: JST, municipal companies, businesschecked:
End of the transitional period in public entities: e-Delivery becomes the primary channel of correspondence with citizens and businesses, with ePUAP used only in specific cases.
Obligation extends to the next group of entrepreneurs from CEIDG (e-Delivery address in the Electronic Address Database by 30 September 2026).
Draft bill (version of 8 July 2026): end of correspondence via ePUAP between public entities, mandatory Public Hybrid Service, and integration of office systems with e-Delivery. The deadline for phasing out ePUAP has already been postponed before and may change again.
What this means for the board. The e-Delivery mailbox must be linked to the registry office and document flow: rules for routing correspondence, staff access rights, and downloading attachments into the EZD-class system. The planned phasing-out of ePUAP for correspondence between offices means that this integration will stop being a convenience and become a condition for day-to-day work.
First step. Check the organisation of the mailbox (folders, rules, access rights) and its connection with the document management system. More.
Obligation to register contracts concluded from this date by public finance sector units, with no value threshold, within 30 days of concluding or amending a contract.
What this means for the board. The register requires organised knowledge of contracts and clear accountability for entries in every department. The IT contract register produced by the inventory is its natural foundation.
First step. Designate people responsible for entries and organise the contract records, starting with IT contracts. More.
General date of application of the regulation, including transparency obligations: informing users that they are interacting with a chatbot, and labelling AI-generated content.
The Polish Act on Artificial Intelligence Systems (Dz.U. 2026 item 1003) enters into force; it establishes the Commission for the Development and Security of Artificial Intelligence (KRiBSI) as the supervisory authority. Some provisions, including those on complaints and KRiBSI opinions, apply from 28 October 2026.
Obligations for high-risk AI systems listed in Annex III (including employment, and access to services and benefits); the deadline has been postponed under the Digital Omnibus package.
Obligations for high-risk AI systems embedded in regulated products (Annex I).
Compliance deadline for high-risk systems used by public authorities that were put into service before the date of application.
What this means for the board. A chatbot on a website, an assistant handling resident enquiries, or a tool helping to assess benefit applications already qualify as AI under the regulation. Before deciding on the next tool, the board should know what the organisation already uses and which risk category it falls into.
First step. List the AI tools used in the organisation (including those embedded in domain-specific systems and cloud services) and classify them before 2 December 2027. More.
being implementedapplies to: JST, businesschecked:
EU member states make the European Digital Identity Wallet (EUDI Wallet) available.
Entities subject to strong customer authentication (including banks and payment institutions) must accept the wallet. The sources do not indicate a separate obligation for JST as of this date.
What this means for the board. For the office, this is primarily a question about e-services and login methods: whether the systems through which residents and businesses handle their affairs can be connected to the wallet and mObywatel. For companies subject to strong authentication, it is an obligation with a specific date.
First step. Check which systems and login methods customers or residents use for e-services, and ask suppliers about their plans for integration with the wallet. More.
Manufacturers of products with digital elements (software, network-connected devices) must report actively exploited vulnerabilities and serious incidents via the ENISA platform: early warning within 24 hours.
Full application of the regulation: products with digital elements placed on the EU market must meet the security requirements and bear CE marking, and the manufacturer must provide security updates for a declared period.
What this means for the board. The obligations apply to manufacturers and distributors of software and network-connected devices, including companies that create their own digital products for sale. For offices and municipal companies, this is knowledge relevant to procurement: from December 2027, purchased hardware and software should bear CE marking compliant with CRA and have a declared security-update period, which is worth including in procurement requirements.
First step. List the digital products the company manufactures or sells under its own brand, and check whether it has a vulnerability-reporting process; in the office and the company, add CRA requirements to procurement specifications for systems and devices. More.
Entry into force of the EU Interoperable Europe Act (Regulation (EU) 2024/903).
Obligation to carry out a cross-border interoperability assessment before changing requirements for digital systems and services that exchange data with other EU countries; the result is published in the BIP.
What this means for the board. In practice, the cross-border assessment applies to only a few of the office's systems, but the National Interoperability Framework (Council of Ministers regulation of 21 May 2024) applies continuously: the minimum requirements for IT systems and registers are a criterion in every purchase and every system change.
First step. At the next system change or purchase, include the KRI requirements in the subject-matter description of the procurement, and check whether the system exchanges data with other EU countries. More.
Report on the state of accessibility provision by the public entity (architectural, digital, and information-and-communication) submitted via the GUS system and published in the BIP; the report is submitted every four years.
Annual review and update of the accessibility declaration for the website and mobile application (Article 11 of the Digital Accessibility Act); also immediately after changes that may affect accessibility.
Next report on the state of accessibility provision (four-year cycle).
What this means for the board. Digital accessibility is an ongoing obligation: the website, the BIP, applications, and the accessibility declaration with a list of non-conformities (e.g. videos without subtitles, forms without labels). Apart from the annual update of the declaration by 31 March, there are no new deadlines for 2027–2028, but accessibility requirements must be included in every procurement of an e-service or system.
First step. Review the accessibility declaration and include accessibility requirements in the next procurement of a system or e-service. More.
Polish Act on Accessibility (products and services of companies)
in forceapplies to: businesschecked:
For orientation. An obligation for businesses, not for the office. It covers, among others, banking, e-commerce, tickets and e-books; for JST this is knowledge relevant to working with suppliers of such services.
Businesses must supply products and provide services that meet accessibility requirements (Act of 26 April 2024, Dz.U. 2024 item 731), with transitional periods for some products and services.
What this means for the board. For companies covered by the act, accessibility is a product and service requirement, subject to market surveillance and customer complaints.
First step. Check whether the company's products and services are covered by the act and which transitional periods apply to them. More.
For orientation. An obligation on the state, not on the office or the company. In the sandbox, suppliers can test AI solutions under supervision, including those intended for public administration.
EU member states launch national AI regulatory sandboxes (AI Act).
What this means for the board. For an office or company, this is a signal that some AI tools for public administration will go through supervised testing before reaching the market.
First step. When talking to AI tool suppliers, ask whether the solution has been tested in a sandbox and in which risk category they classify it. More.
For orientation. This is not an obligation, but a funding window that closes just as the obligations are increasing.
End of the FERC.04.01-IP.01-003/26 call (CPPC) for creating Local Cybersecurity Centres: applications may only be submitted by partnerships of at least two JST, via the LSI system.
End of the 2021–2027 perspective: expenditure under projects must be incurred by the end of 2029 at the latest, and calls close earlier. The programme supports e-services, digitalisation of office processes and, following the mid-term review, cybersecurity for JST (measure 4.1, Local Cybersecurity Centres).
What this means for the board. Funding must be planned in advance: an application requires a description of the current state, needs and objectives — the same knowledge that an inventory provides.
First step. Check current FERC calls and match them against the office's list of needs (e-services, document flow, domain-specific systems). For Local Cybersecurity Centres, the application must be submitted by a partnership of at least two JST, so a partner must be in place before submitting. More.
Changes in regulations and deadlines: when the decision was made, what changed, on what basis and who it affects. I check the calendar every month, and every such change is added here.
Penalties for invoices issued outside KSeF: the Sejm has passed an act postponing them from 1 January 2027 to 1 January 2028. The obligation to issue invoices in KSeF from 1 January 2027 remains unchanged.On what basis. Act amending the Act on Tax on Goods and Services, passed by the Sejm on 6 November 2026 (print no. 3245); awaiting the Senate, the President's signature and publication in the Journal of Laws (Dz.U.). Sources: Sejm: przebieg procesu legislacyjnego, druk 3245 (nowelizacja ustawy o VAT, uchwalona 6.11.2026).Who it concerns: JST · municipal companies · business · in the calendar since
Clarification: the bill introducing the EZD obligation has not yet been published (the deadline remains at the earliest 2029, unchanged). Added: an amendment to the archival act passed by the Sejm, setting requirements for EZD-class systems, a scan with a qualified signature replacing paper, and 24 months to adapt systems.On what basis. Sejm, print no. 3000 (passed on 6 November 2026); no bill introducing the EZD obligation appears in the list of legislative work or before the Sejm. Sources: Sejm: nowelizacja ustawy o narodowym zasobie archiwalnym i archiwach, druk 3000 (uchwalona 6.11.2026).Who it concerns: JST · in the calendar since
The deadline for the announced EZD-class system obligation has been postponed from 1 January 2028 to the earliest 2029. The obligation still has no basis in an enacted act.On what basis. Announcement by the Ministry of Digital Affairs of October 2026, reported to PAP Samorząd and Prawo.pl (12 October 2026). Sources: Prawo.pl, 12.10.2026: EZD obowiązkowe dopiero od 2029 r.?.Who it concerns: JST · in the calendar since
The "Digital Education in JST" competition has been removed (this is an FERS programme; the call closed on 30 September 2026). Added deadline of 30 November 2026: end of the call for Local Cybersecurity Centres, open only to partnerships of at least two JSTs.On what basis. CPPC announcement for call FERC.04.01-IP.01-003/26 (extended by notice of 8 October 2026); European Funds Portal. Sources: CPPC: nabór FERC.04.01-IP.01-003/26 (Lokalne Centra Cyberbezpieczeństwa).Who it concerns: JST · in the calendar since
New entries: the AI Act (deadlines following the Digital Omnibus on AI: 2 December 2027, 2 August 2028, 2 August 2030) and eIDAS 2.0 (digital identity wallet: 24 December 2026 and 24 December 2027). Added deadlines for 2027–2030 for KSeF, KSC and e-Doręczenia, including the announced phasing out of ePUAP.On what basis. Regulation (EU) 2026/1744 (EU Official Journal of 24 July 2026), Regulation (EU) 2024/1183, amendment to the KSC Act (Dz.U. 2026 item 252), and draft amendments to the VAT Act and the Act on Electronic Delivery. Sources: EUR-Lex: rozporządzenie (UE) 2026/1744; EUR-Lex: rozporządzenie (UE) 2024/1183 (eIDAS 2.0).Who it concerns: JST · municipal companies · business · in the calendar since
adoption of the Act on Artificial Intelligence Systems
Added: the Polish Act on Artificial Intelligence Systems, in force since 11 August 2026, establishing KRiBSI; some provisions apply from 28 October 2026. EU dates remain unchanged.On what basis. Act of 3 July 2026 on Artificial Intelligence Systems (Dz.U. 2026 item 1003). Sources: ISAP: ustawa z 3 lipca 2026 r. o systemach sztucznej inteligencji (Dz.U. 2026 poz. 1003).Who it concerns: JST · municipal companies · business · in the calendar since
New entry: Cyber Resilience Act. From 11 September 2026, manufacturers must report vulnerabilities and serious incidents, and from 11 December 2027, digital products must meet security requirements and carry CE marking. For public authorities and municipal companies, this means requirements at the procurement stage.On what basis. Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements. Sources: EUR-Lex: rozporządzenie (UE) 2024/2847 (Cyber Resilience Act).Who it concerns: business · in the calendar since
New entries: interoperability (Interoperable Europe Act and the National Interoperability Framework) and digital accessibility with an accessibility status report. For reference: the Polish Accessibility Act, national AI regulatory sandboxes and FERC calls.On what basis. Review of JST digital obligations of 30 October 2026: Regulation (EU) 2024/903, Council of Ministers' regulation on the KRI of 21 May 2024, the Act on Digital Accessibility, the Act of 26 April 2024 (Dz.U. 2024 item 731), Regulation (EU) 2026/1744. Sources: Komisja Europejska: Interoperable Europe Act; Dz.U. 2024 poz. 731.Who it concerns: JST · business · in the calendar since
All these obligations fall on the same people and the same document workflow.
That's why we start with a single inventory of systems, contracts and processes that each of them draws on. IT systems inventory: 2–6 weeks, below the public procurement threshold.