# Calendar of obligations: KSeF, KSC, e-Doręczenia, EZD, AI Act | Krogis

Źródło: https://krogis.pl/en/kalendarz-obowiazkow
Język: en
Opis: Digital deadlines for local government units (JST), municipal companies and businesses in one place: legal status, sources and what they mean for the board. Checked every month.

---

# Calendar of obligations. *See what's coming. Plan what needs to be done.*

The calendar of obligations is a list of digital deadlines (EZD, KSC, KSeF, e-Doręczenia, CRU, AI Act, eIDAS 2.0, Cyber Resilience Act, interoperability, accessibility) that apply to local government units (JST), municipal companies and businesses, together with their legal status, sources and what they mean for the board. Entries marked “for orientation” do not apply directly to the authority (an obligation on the state, on businesses, or a funding window), but show what is happening around digitalisation. A deadline is only the beginning: each one needs a person responsible and a next step. Status as at November 10, 2026; we check it every month ([history of changes](https://krogis.pl/en/kalendarz-obowiazkow#historia-zmian)). Before making a decision, it is worth confirming the deadline at the source.

**From deadline to action** obligation, person responsible, next step **illustrative figure** illustrative data

## Upcoming deadlines

1. November 30, 2026 **[European Funds for Digital Development 2021–2027 (FERC)](https://krogis.pl/en/kalendarz-obowiazkow#ferc)** End of the FERC.04.01-IP.01-003/26 call (CPPC) for creating Local Cybersecurity Centres: applications may only be submitted by partnerships of at least two JST, via the LSI system. (for orientation · JST)
2. December 24, 2026 **[eIDAS 2.0 (European Digital Identity Wallet)](https://krogis.pl/en/kalendarz-obowiazkow#eidas)** EU member states make the European Digital Identity Wallet (EUDI Wallet) available. (JST · business)
3. January 1, 2027 **[KSeF (Polish National e-Invoicing System)](https://krogis.pl/en/kalendarz-obowiazkow#ksef)** End of the transitional period: KSeF becomes the only permitted form of VAT invoice, with no monthly threshold for invoices issued outside the system. This also applies to organisational units of JST, schools and cultural centres. (JST · municipal companies · business)
4. March 31, 2027 **[Digital accessibility and the accessibility status report](https://krogis.pl/en/kalendarz-obowiazkow#dostepnosc)** Annual review and update of the accessibility declaration for the website and mobile application (Article 11 of the Digital Accessibility Act); also immediately after changes that may affect accessibility. (JST · municipal companies)
5. April 3, 2027 **[KSC / NIS 2 (National Cybersecurity System)](https://krogis.pl/en/kalendarz-obowiazkow#ksc)** End of the adjustment period for entities meeting the criteria on 3 April 2026 (a later entry in the register does not shift this deadline): an implemented information security management system, incident handling and reporting (early warning within 24 hours, notification within 72 hours, final report within 30 days), designated KSC contact persons, and connection to the S46 system. (JST · municipal companies · business)
6. August 2, 2027 **[National AI regulatory sandboxes](https://krogis.pl/en/kalendarz-obowiazkow#piaskownice-ai)** EU member states launch national AI regulatory sandboxes (AI Act). (for orientation · state)
7. December 2, 2027 **[AI Act (EU regulation on artificial intelligence)](https://krogis.pl/en/kalendarz-obowiazkow#ai-act)** Obligations for high-risk AI systems listed in Annex III (including employment, and access to services and benefits); the deadline has been postponed under the Digital Omnibus package. (JST · municipal companies · business)
8. December 11, 2027 **[Cyber Resilience Act (security requirements for digital products)](https://krogis.pl/en/kalendarz-obowiazkow#cra)** Full application of the regulation: products with digital elements placed on the EU market must meet the security requirements and bear CE marking, and the manufacturer must provide security updates for a declared period. (business)
9. December 24, 2027 **[eIDAS 2.0 (European Digital Identity Wallet)](https://krogis.pl/en/kalendarz-obowiazkow#eidas)** Entities subject to strong customer authentication (including banks and payment institutions) must accept the wallet. The sources do not indicate a separate obligation for JST as of this date. (JST · business)
10. January 1, 2028 **[KSeF (Polish National e-Invoicing System)](https://krogis.pl/en/kalendarz-obowiazkow#ksef)** Penalties for invoices issued outside KSeF. On 6 November 2026 the Sejm passed an act postponing them from 1 January 2027 to 1 January 2028; the act is awaiting the Senate, the President's signature and publication. (JST · municipal companies · business)
11. January 1, 2028 **[Polish e-Delivery (e-Doręczenia)](https://krogis.pl/en/kalendarz-obowiazkow#e-doreczenia)** Draft bill (version of 8 July 2026): end of correspondence via ePUAP between public entities, mandatory Public Hybrid Service, and integration of office systems with e-Delivery. The deadline for phasing out ePUAP has already been postponed before and may change again. (JST · municipal companies · business)
12. April 3, 2028 **[KSC / NIS 2 (National Cybersecurity System)](https://krogis.pl/en/kalendarz-obowiazkow#ksc)** First mandatory audit of key entities that were not previously key-service operators; subsequent audits at least once every three years. From this date, financial penalties become possible. (JST · municipal companies · business)
13. August 2, 2028 **[AI Act (EU regulation on artificial intelligence)](https://krogis.pl/en/kalendarz-obowiazkow#ai-act)** Obligations for high-risk AI systems embedded in regulated products (Annex I). (JST · municipal companies · business)
14. 2029 at the earliest **[EZD-class system (electronic document and case management)](https://krogis.pl/en/kalendarz-obowiazkow#ezd)** Announced obligation to conduct case handling in an EZD-class system. The deadline has been pushed back from 1 January 2028 to 2029 at the earliest; the Ministry of Digital Affairs has announced regulations, but the draft act introducing this obligation has not yet been published. (JST)
15. March 31, 2029 **[Digital accessibility and the accessibility status report](https://krogis.pl/en/kalendarz-obowiazkow#dostepnosc)** Next report on the state of accessibility provision (four-year cycle). (JST · municipal companies)
16. by the end of 2029 **[European Funds for Digital Development 2021–2027 (FERC)](https://krogis.pl/en/kalendarz-obowiazkow#ferc)** End of the 2021–2027 perspective: expenditure under projects must be incurred by the end of 2029 at the latest, and calls close earlier. The programme supports e-services, digitalisation of office processes and, following the mid-term review, cybersecurity for JST (measure 4.1, Local Cybersecurity Centres). (for orientation · JST)
17. August 2, 2030 **[AI Act (EU regulation on artificial intelligence)](https://krogis.pl/en/kalendarz-obowiazkow#ai-act)** Compliance deadline for high-risk systems used by public authorities that were put into service before the date of application. (JST · municipal companies · business)

### Deadlines that have already passed (14)

1. October 3, 2026 **[KSC / NIS 2 (National Cybersecurity System)](https://krogis.pl/en/kalendarz-obowiazkow#ksc)** End of self-registration in the register of key and important entities (for entities not registered ex officio). (JST · municipal companies · business)
2. October 1, 2026 **[Polish e-Delivery (e-Doręczenia)](https://krogis.pl/en/kalendarz-obowiazkow#e-doreczenia)** Obligation extends to the next group of entrepreneurs from CEIDG (e-Delivery address in the Electronic Address Database by 30 September 2026). (JST · municipal companies · business)
3. September 11, 2026 **[Cyber Resilience Act (security requirements for digital products)](https://krogis.pl/en/kalendarz-obowiazkow#cra)** Manufacturers of products with digital elements (software, network-connected devices) must report actively exploited vulnerabilities and serious incidents via the ENISA platform: early warning within 24 hours. (business)
4. August 11, 2026 **[AI Act (EU regulation on artificial intelligence)](https://krogis.pl/en/kalendarz-obowiazkow#ai-act)** The Polish Act on Artificial Intelligence Systems (Dz.U. 2026 item 1003) enters into force; it establishes the Commission for the Development and Security of Artificial Intelligence (KRiBSI) as the supervisory authority. Some provisions, including those on complaints and KRiBSI opinions, apply from 28 October 2026. (JST · municipal companies · business)
5. August 2, 2026 **[AI Act (EU regulation on artificial intelligence)](https://krogis.pl/en/kalendarz-obowiazkow#ai-act)** General date of application of the regulation, including transparency obligations: informing users that they are interacting with a chatbot, and labelling AI-generated content. (JST · municipal companies · business)
6. July 1, 2026 **[Central Register of Contracts (CRU JSFP)](https://krogis.pl/en/kalendarz-obowiazkow#cru)** Obligation to register contracts concluded from this date by public finance sector units, with no value threshold, within 30 days of concluding or amending a contract. (JST)
7. April 3, 2026 **[KSC / NIS 2 (National Cybersecurity System)](https://krogis.pl/en/kalendarz-obowiazkow#ksc)** The amendment to the Polish National Cybersecurity System Act (Dz.U. 2026 item 252) enters into force. (JST · municipal companies · business)
8. April 1, 2026 **[KSeF (Polish National e-Invoicing System)](https://krogis.pl/en/kalendarz-obowiazkow#ksef)** Issuing invoices via KSeF for the remaining taxpayers, including local government units (JST) and municipal companies. (JST · municipal companies · business)
9. February 1, 2026 **[KSeF (Polish National e-Invoicing System)](https://krogis.pl/en/kalendarz-obowiazkow#ksef)** Obligation to receive invoices via KSeF for everyone; issuing via KSeF for the largest taxpayers. (JST · municipal companies · business)
10. January 1, 2026 **[Polish e-Delivery (e-Doręczenia)](https://krogis.pl/en/kalendarz-obowiazkow#e-doreczenia)** End of the transitional period in public entities: e-Delivery becomes the primary channel of correspondence with citizens and businesses, with ePUAP used only in specific cases. (JST · municipal companies · business)
11. June 28, 2025 **[Polish Act on Accessibility (products and services of companies)](https://krogis.pl/en/kalendarz-obowiazkow#akt-o-dostepnosci)** Businesses must supply products and provide services that meet accessibility requirements (Act of 26 April 2024, Dz.U. 2024 item 731), with transitional periods for some products and services. (for orientation · business)
12. March 31, 2025 **[Digital accessibility and the accessibility status report](https://krogis.pl/en/kalendarz-obowiazkow#dostepnosc)** Report on the state of accessibility provision by the public entity (architectural, digital, and information-and-communication) submitted via the GUS system and published in the BIP; the report is submitted every four years. (JST · municipal companies)
13. January 12, 2025 **[Interoperability (Interoperable Europe Act and National Interoperability Framework)](https://krogis.pl/en/kalendarz-obowiazkow#interoperacyjnosc)** Obligation to carry out a cross-border interoperability assessment before changing requirements for digital systems and services that exchange data with other EU countries; the result is published in the BIP. (JST · municipal companies)
14. April 11, 2024 **[Interoperability (Interoperable Europe Act and National Interoperability Framework)](https://krogis.pl/en/kalendarz-obowiazkow#interoperacyjnosc)** Entry into force of the EU Interoperable Europe Act (Regulation (EU) 2024/903). (JST · municipal companies)

## Obligations in order

### EZD-class system (electronic document and case management)

announced, legislation in draft applies to: JST checked: November 10, 2026

**Last change:** November 6, 2026, the Sejm passed the amendment to the archival act. [See in the history of changes](https://krogis.pl/en/kalendarz-obowiazkow#zmiana-ezd-2026-11-06)

1. 2029 at the earliest Announced obligation to conduct case handling in an EZD-class system. The deadline has been pushed back from 1 January 2028 to 2029 at the earliest; the Ministry of Digital Affairs has announced regulations, but the draft act introducing this obligation has not yet been published.

**What this means for the board.** The obligation means actually conducting case handling in an electronic environment, not merely installing a system. Choosing a system and migrating (e.g. from EZD PUW) is a decision with consequences for years, affecting document flow, integration with domain-specific systems and the work of every department. Separately, on 6 November 2026 the Sejm passed an amendment to the Act on the National Archival Resource and Archives: it does not introduce an EZD obligation, but it sets requirements for EZD-class systems, allows paper to be replaced by a digital reproduction bearing a qualified signature, and gives 24 months to adapt systems from the act's entry into force (12 months after publication). Exact dates will be added once the act is published.

**First step.** Draw up an inventory of systems, document flow and integrations before the office chooses its path (EZD RP or another EZD-class system). [More](https://krogis.pl/en/jst).

Sources: [Prawo.pl, 12.10.2026: EZD obowiązkowe dopiero od 2029 r.?](https://www.prawo.pl/samorzad/ezd-obowiazkowe-dopiero-od-2029-r-samorzady-ostrzegaja-ze-czasu-wciaz-za-malo,1554515.html); [Ministerstwo Cyfryzacji: EZD RP](https://www.gov.pl/web/cyfryzacja/ezd-rp--nadchodzi-era-bez-papieru-w-administracji-publicznej); [Sejm: nowelizacja ustawy o narodowym zasobie archiwalnym i archiwach, druk 3000 (uchwalona 6.11.2026)](https://www.sejm.gov.pl/Sejm10.nsf/PrzebiegProc.xsp?nr=3000)

### KSC / NIS 2 (National Cybersecurity System)

in force applies to: JST, municipal companies, business checked: November 10, 2026

1. April 3, 2026 The amendment to the Polish National Cybersecurity System Act (Dz.U. 2026 item 252) enters into force.
2. October 3, 2026 End of self-registration in the register of key and important entities (for entities not registered ex officio).
3. April 3, 2027 End of the adjustment period for entities meeting the criteria on 3 April 2026 (a later entry in the register does not shift this deadline): an implemented information security management system, incident handling and reporting (early warning within 24 hours, notification within 72 hours, final report within 30 days), designated KSC contact persons, and connection to the S46 system.
4. April 3, 2028 First mandatory audit of key entities that were not previously key-service operators; subsequent audits at least once every three years. From this date, financial penalties become possible.

**What this means for the board.** County offices (starostwa powiatowe) and budgetary units and establishments of voivodeship self-government are key entities regardless of size; a municipal office (urząd gminy) becomes one once it exceeds 50 employees on employment contracts. Subordinate units, cultural institutions and municipal companies may be important entities. The obligations rest with management, and they are based on knowledge of systems, suppliers and risks. The same inventory serves KSC compliance, system selection and audits.

**First step.** Document the status of the whole group (office, subordinate units, municipal companies), check the register entry, and plan the implementation of an information security management system before 3 April 2027. [More](https://krogis.pl/en/uslugi/koordynacja#ksc).

Sources: [Ministerstwo Cyfryzacji: nowelizacja KSC, najważniejsze terminy](https://www.gov.pl/web/cyfryzacja/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa-ksc--najwazniejsze-terminy); [Dz.U. 2026 poz. 252](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20260000252); [Ministerstwo Cyfryzacji: obowiązki podmiotów kluczowych i ważnych](https://www.gov.pl/web/cyfryzacja/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa-ksc---obowiazki-podmiotow-kluczowych-i-waznych); [Krogis: ustawa o KSC w starostwie, od czego zacząć](https://krogis.pl/blog/ustawa-o-ksc-w-starostwie-od-czego-zaczac)

### KSeF (Polish National e-Invoicing System)

in force applies to: JST, municipal companies, business checked: November 10, 2026

**Last change:** November 6, 2026, the Sejm passed the act. [See in the history of changes](https://krogis.pl/en/kalendarz-obowiazkow#zmiana-ksef-2026-11-06)

1. February 1, 2026 Obligation to receive invoices via KSeF for everyone; issuing via KSeF for the largest taxpayers.
2. April 1, 2026 Issuing invoices via KSeF for the remaining taxpayers, including local government units (JST) and municipal companies.
3. January 1, 2027 End of the transitional period: KSeF becomes the only permitted form of VAT invoice, with no monthly threshold for invoices issued outside the system. This also applies to organisational units of JST, schools and cultural centres.
4. January 1, 2028 Penalties for invoices issued outside KSeF. On 6 November 2026 the Sejm passed an act postponing them from 1 January 2027 to 1 January 2028; the act is awaiting the Senate, the President's signature and publication.

**What this means for the board.** KSeF changes the cost-invoice flow from receipt to posting: integration with the finance and accounting system, invoice description and approval, and linking invoices to the relevant case in the document management system. In JST, this includes correctly identifying subordinate units on the invoice (FA(3) structure), which the Ministry of Finance recommends supporting in software linked to KSeF.

**First step.** Map the invoice flow from receipt in KSeF to posting, and check which systems need to be connected to each other. [More](https://krogis.pl/en/spolki-uzytecznosci-publicznej).

Sources: [Ministerstwo Finansów: KSeF](https://ksef.podatki.gov.pl/); [Ministerstwo Finansów: KSeF w jednostkach samorządu terytorialnego](https://ksef.podatki.gov.pl/jednostki-samorzadu-terytorialnego-jst/); [KSeF.pl: zmiany w KSeF od 1 stycznia 2027 r.](https://ksef.pl/blog/zmiany-w-ksef-od-2027); [Sejm: przebieg procesu legislacyjnego, druk 3245 (nowelizacja ustawy o VAT, uchwalona 6.11.2026)](https://www.sejm.gov.pl/Sejm10.nsf/PrzebiegProc.xsp?nr=3245)

### Polish e-Delivery (e-Doręczenia)

in force applies to: JST, municipal companies, business checked: November 10, 2026

1. January 1, 2026 End of the transitional period in public entities: e-Delivery becomes the primary channel of correspondence with citizens and businesses, with ePUAP used only in specific cases.
2. October 1, 2026 Obligation extends to the next group of entrepreneurs from CEIDG (e-Delivery address in the Electronic Address Database by 30 September 2026).
3. January 1, 2028 Draft bill (version of 8 July 2026): end of correspondence via ePUAP between public entities, mandatory Public Hybrid Service, and integration of office systems with e-Delivery. The deadline for phasing out ePUAP has already been postponed before and may change again.

**What this means for the board.** The e-Delivery mailbox must be linked to the registry office and document flow: rules for routing correspondence, staff access rights, and downloading attachments into the EZD-class system. The planned phasing-out of ePUAP for correspondence between offices means that this integration will stop being a convenience and become a condition for day-to-day work.

**First step.** Check the organisation of the mailbox (folders, rules, access rights) and its connection with the document management system. [More](https://krogis.pl/en/jst).

Sources: [gov.pl: e-Doręczenia](https://www.gov.pl/web/e-doreczenia); [Prawo.pl, 23.12.2025: e-Doręczenia w podmiotach publicznych w 2026 r.](https://www.prawo.pl/samorzad/e-doreczenia-w-podmiotach-publicznych-w-2026-r,536511.html); [Portal Samorządowy: koniec ePUAP w urzędach od 2028 r.](https://www.portalsamorzadowy.pl/zmiany-w-prawie/koniec-epuap-w-urzedach-od-2028-r-obowiazkowe-przejscie-na-e-doreczenia,669430.html)

### Central Register of Contracts (CRU JSFP)

in force applies to: JST checked: November 10, 2026

1. July 1, 2026 Obligation to register contracts concluded from this date by public finance sector units, with no value threshold, within 30 days of concluding or amending a contract.

**What this means for the board.** The register requires organised knowledge of contracts and clear accountability for entries in every department. The IT contract register produced by the inventory is its natural foundation.

**First step.** Designate people responsible for entries and organise the contract records, starting with IT contracts. [More](https://krogis.pl/blog/centralny-rejestr-umow-krok-po-kroku).

Sources: [Ministerstwo Finansów: Centralny Rejestr Umów JSFP](https://www.gov.pl/web/finanse/centralny-rejestr-umow-jsfp--kluczowy-etap-1-lipca-2026-r)

### AI Act (EU regulation on artificial intelligence)

in force applies to: JST, municipal companies, business checked: November 10, 2026

**Last change:** July 8, 2026, adoption of the Digital Omnibus on AI. [See in the history of changes](https://krogis.pl/en/kalendarz-obowiazkow#zmiana-ai-act-2026-07-08)

1. August 2, 2026 General date of application of the regulation, including transparency obligations: informing users that they are interacting with a chatbot, and labelling AI-generated content.
2. August 11, 2026 The Polish Act on Artificial Intelligence Systems (Dz.U. 2026 item 1003) enters into force; it establishes the Commission for the Development and Security of Artificial Intelligence (KRiBSI) as the supervisory authority. Some provisions, including those on complaints and KRiBSI opinions, apply from 28 October 2026.
3. December 2, 2027 Obligations for high-risk AI systems listed in Annex III (including employment, and access to services and benefits); the deadline has been postponed under the Digital Omnibus package.
4. August 2, 2028 Obligations for high-risk AI systems embedded in regulated products (Annex I).
5. August 2, 2030 Compliance deadline for high-risk systems used by public authorities that were put into service before the date of application.

**What this means for the board.** A chatbot on a website, an assistant handling resident enquiries, or a tool helping to assess benefit applications already qualify as AI under the regulation. Before deciding on the next tool, the board should know what the organisation already uses and which risk category it falls into.

**First step.** List the AI tools used in the organisation (including those embedded in domain-specific systems and cloud services) and classify them before 2 December 2027. [More](https://krogis.pl/en/transformacja-cyfrowa).

Sources: [Kancelaria Stasik: AI Act od 2 sierpnia 2026, co wchodzi, a co przesunięto](https://www.stasik-kancelaria.pl/ai-act-dla-firm/); [EUR-Lex: rozporządzenie (UE) 2026/1744 (Digital Omnibus on AI)](https://eur-lex.europa.eu/legal-content/PL/ALL/?uri=CELEX%3A32026R1744); [ISAP: ustawa z 3 lipca 2026 r. o systemach sztucznej inteligencji (Dz.U. 2026 poz. 1003)](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20260001003)

### eIDAS 2.0 (European Digital Identity Wallet)

being implemented applies to: JST, business checked: November 10, 2026

1. December 24, 2026 EU member states make the European Digital Identity Wallet (EUDI Wallet) available.
2. December 24, 2027 Entities subject to strong customer authentication (including banks and payment institutions) must accept the wallet. The sources do not indicate a separate obligation for JST as of this date.

**What this means for the board.** For the office, this is primarily a question about e-services and login methods: whether the systems through which residents and businesses handle their affairs can be connected to the wallet and mObywatel. For companies subject to strong authentication, it is an obligation with a specific date.

**First step.** Check which systems and login methods customers or residents use for e-services, and ask suppliers about their plans for integration with the wallet. [More](https://krogis.pl/en/transformacja-cyfrowa).

Sources: [Bank.pl: banki i instytucje płatnicze dostaną rok na wprowadzenie portfela](https://bank.pl/banki-i-instytucje-platnicze-dostana-rok-na-wprowadzenie-europejskiego-portfela-tozsamosci-cyfrowej/)

### Cyber Resilience Act (security requirements for digital products)

being implemented applies to: business checked: November 10, 2026

**Last change:** October 23, 2024, adoption of Regulation (EU) 2024/2847. [See in the history of changes](https://krogis.pl/en/kalendarz-obowiazkow#zmiana-cra-2024-10-23)

1. September 11, 2026 Manufacturers of products with digital elements (software, network-connected devices) must report actively exploited vulnerabilities and serious incidents via the ENISA platform: early warning within 24 hours.
2. December 11, 2027 Full application of the regulation: products with digital elements placed on the EU market must meet the security requirements and bear CE marking, and the manufacturer must provide security updates for a declared period.

**What this means for the board.** The obligations apply to manufacturers and distributors of software and network-connected devices, including companies that create their own digital products for sale. For offices and municipal companies, this is knowledge relevant to procurement: from December 2027, purchased hardware and software should bear CE marking compliant with CRA and have a declared security-update period, which is worth including in procurement requirements.

**First step.** List the digital products the company manufactures or sells under its own brand, and check whether it has a vulnerability-reporting process; in the office and the company, add CRA requirements to procurement specifications for systems and devices. [More](https://krogis.pl/en/biznes).

Sources: [EUR-Lex: rozporządzenie (UE) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj); [ENISA: platforma zgłaszania podatności i incydentów (CRA)](https://www.enisa.europa.eu/cra-srp/)

### Interoperability (Interoperable Europe Act and National Interoperability Framework)

in force applies to: JST, municipal companies checked: November 10, 2026

**Last change:** March 13, 2024, adoption of Regulation (EU) 2024/903. [See in the history of changes](https://krogis.pl/en/kalendarz-obowiazkow#zmiana-interoperacyjnosc-2024-03-13)

1. April 11, 2024 Entry into force of the EU Interoperable Europe Act (Regulation (EU) 2024/903).
2. January 12, 2025 Obligation to carry out a cross-border interoperability assessment before changing requirements for digital systems and services that exchange data with other EU countries; the result is published in the BIP.

**What this means for the board.** In practice, the cross-border assessment applies to only a few of the office's systems, but the National Interoperability Framework (Council of Ministers regulation of 21 May 2024) applies continuously: the minimum requirements for IT systems and registers are a criterion in every purchase and every system change.

**First step.** At the next system change or purchase, include the KRI requirements in the subject-matter description of the procurement, and check whether the system exchanges data with other EU countries. [More](https://krogis.pl/en/uslugi/wymagania).

Sources: [Komisja Europejska: Interoperable Europe Act](https://interoperable-europe.ec.europa.eu/interoperable-europe/interoperable-europe-act); [gov.pl: wytyczne dla oceny interoperacyjności transgranicznej](https://www.gov.pl/web/ia/wytyczne-dla-oceny-interoperacyjnosci-transgranicznej); [LEX: Krajowe Ramy Interoperacyjności](https://sip.lex.pl/akty-prawne/dzu-dziennik-ustaw/krajowe-ramy-interoperacyjnosci-minimalne-wymagania-dla-rejestrow-21979202)

### Digital accessibility and the accessibility status report

in force applies to: JST, municipal companies checked: November 10, 2026

**Last change:** April 4, 2019, Act on Digital Accessibility, Article 11. [See in the history of changes](https://krogis.pl/en/kalendarz-obowiazkow#zmiana-dostepnosc-2019-04-04)

1. March 31, 2025 Report on the state of accessibility provision by the public entity (architectural, digital, and information-and-communication) submitted via the GUS system and published in the BIP; the report is submitted every four years.
2. March 31, 2027 Annual review and update of the accessibility declaration for the website and mobile application (Article 11 of the Digital Accessibility Act); also immediately after changes that may affect accessibility.
3. March 31, 2029 Next report on the state of accessibility provision (four-year cycle).

**What this means for the board.** Digital accessibility is an ongoing obligation: the website, the BIP, applications, and the accessibility declaration with a list of non-conformities (e.g. videos without subtitles, forms without labels). Apart from the annual update of the declaration by 31 March, there are no new deadlines for 2027–2028, but accessibility requirements must be included in every procurement of an e-service or system.

**First step.** Review the accessibility declaration and include accessibility requirements in the next procurement of a system or e-service. [More](https://krogis.pl/en/uslugi/wymagania).

Sources: [gov.pl: deklaracja dostępności (przykład)](https://www.gov.pl/web/dostepnosc-cyfrowa/deklaracja-dostepnosci-przyklad); [GUS: raport o stanie zapewniania dostępności podmiotu publicznego](https://stat.gov.pl/aktualnosci/badanie-raport-o-stanie-zapewniania-dostepnosci-podmiotu-publicznego,602,1.html); [ISAP: ustawa o dostępności cyfrowej stron internetowych i aplikacji mobilnych podmiotów publicznych (t.j. Dz.U. 2023 poz. 1440)](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20230001440)

### Polish Act on Accessibility (products and services of companies)

in force applies to: business checked: November 10, 2026

**For orientation.** An obligation for businesses, not for the office. It covers, among others, banking, e-commerce, tickets and e-books; for JST this is knowledge relevant to working with suppliers of such services.

1. June 28, 2025 Businesses must supply products and provide services that meet accessibility requirements (Act of 26 April 2024, Dz.U. 2024 item 731), with transitional periods for some products and services.

**What this means for the board.** For companies covered by the act, accessibility is a product and service requirement, subject to market surveillance and customer complaints.

**First step.** Check whether the company's products and services are covered by the act and which transitional periods apply to them. [More](https://krogis.pl/en/biznes).

Sources: [Dz.U. 2024 poz. 731](https://eli.gov.pl/eli/DU/2024/731/ogl/pol/pdf); [Fundusze Europejskie: Polski Akt o Dostępności](https://funduszeeuropejskie.gov.pl/media/150003/Polski_Akt_o_Dostepnosci_www.pdf)

### National AI regulatory sandboxes

in force applies to: state checked: November 10, 2026

**For orientation.** An obligation on the state, not on the office or the company. In the sandbox, suppliers can test AI solutions under supervision, including those intended for public administration.

1. August 2, 2027 EU member states launch national AI regulatory sandboxes (AI Act).

**What this means for the board.** For an office or company, this is a signal that some AI tools for public administration will go through supervised testing before reaching the market.

**First step.** When talking to AI tool suppliers, ask whether the solution has been tested in a sandbox and in which risk category they classify it. [More](https://krogis.pl/en/kalendarz-obowiazkow#ai-act).

Sources: [Kancelaria Stasik: AI Act od 2 sierpnia 2026](https://www.stasik-kancelaria.pl/ai-act-dla-firm/); [KIRP: AI Act po negocjacjach (Digital Omnibus on AI)](https://kirp.pl/porozumienie-w-sprawie-zmian-do-ai-act-w-ramach-digital-omnibus-on-ai/)

### European Funds for Digital Development 2021–2027 (FERC)

not an obligation, informational applies to: JST checked: November 10, 2026

**Last change:** October 8, 2026, CPPC extended the call. [See in the history of changes](https://krogis.pl/en/kalendarz-obowiazkow#zmiana-ferc-2026-10-08)

**For orientation.** This is not an obligation, but a funding window that closes just as the obligations are increasing.

1. November 30, 2026 End of the FERC.04.01-IP.01-003/26 call (CPPC) for creating Local Cybersecurity Centres: applications may only be submitted by partnerships of at least two JST, via the LSI system.
2. by the end of 2029 End of the 2021–2027 perspective: expenditure under projects must be incurred by the end of 2029 at the latest, and calls close earlier. The programme supports e-services, digitalisation of office processes and, following the mid-term review, cybersecurity for JST (measure 4.1, Local Cybersecurity Centres).

**What this means for the board.** Funding must be planned in advance: an application requires a description of the current state, needs and objectives — the same knowledge that an inventory provides.

**First step.** Check current FERC calls and match them against the office's list of needs (e-services, document flow, domain-specific systems). For Local Cybersecurity Centres, the application must be submitted by a partnership of at least two JST, so a partner must be in place before submitting. [More](https://krogis.pl/en/jst).

Sources: [CPPC: wyniki oceny formalnej naboru na e-usługi](https://www.gov.pl/web/cppc/wyniki-oceny-formalnej-FERC0201IP0101026); [Portal Funduszy Europejskich: Wysoka jakość i dostępność e-usług publicznych (FERC.02.01, IX nabór)](https://www.funduszeunijne.gov.pl/nabory/wysoka-jakosc-i-dostepnosc-e-uslug-publicznych-ferc0201-ix-nabor/); [CPPC: nabór FERC.04.01-IP.01-003/26 (Lokalne Centra Cyberbezpieczeństwa)](https://www.gov.pl/web/cppc/FERC0401IP0100326); [samorzad.pap.pl: Wydłużono nabór wniosków o dofinansowanie tworzenia Lokalnych Centrów Cyberbezpieczeństwa (09.10.2026)](https://samorzad.pap.pl/kategoria/dofinansowanie/wydluzono-nabor-wnioskow-o-dofinansowanie-tworzenia-lokalnych-centrow); [Fundusze Europejskie dla Małopolski: nabór na cyberbezpieczeństwo samorządów](https://fundusze.malopolska.pl/aktualnosc/14740-ponad-269-mln-zl-na-cyberbezpieczenstwo-samorzadow-trwa-nabor-wnioskow)

## History of changes

Changes in regulations and deadlines: when the decision was made, what changed, on what basis and who it affects. I check the calendar every month, and every such change is added here.

1. November 6, 2026 (the Sejm passed the act) **[KSeF (Polish National e-Invoicing System)](https://krogis.pl/en/kalendarz-obowiazkow#ksef)** *change of deadline or status* Penalties for invoices issued outside KSeF: the Sejm has passed an act postponing them from 1 January 2027 to 1 January 2028. The obligation to issue invoices in KSeF from 1 January 2027 remains unchanged. **On what basis.** Act amending the Act on Tax on Goods and Services, passed by the Sejm on 6 November 2026 (print no. 3245); awaiting the Senate, the President's signature and publication in the Journal of Laws (Dz.U.). Sources: [Sejm: przebieg procesu legislacyjnego, druk 3245 (nowelizacja ustawy o VAT, uchwalona 6.11.2026)](https://www.sejm.gov.pl/Sejm10.nsf/PrzebiegProc.xsp?nr=3245). (Who it concerns: JST · municipal companies · business · in the calendar since November 10, 2026)
2. November 6, 2026 (the Sejm passed the amendment to the archival act) **[EZD-class system (electronic document and case management)](https://krogis.pl/en/kalendarz-obowiazkow#ezd)** *clarification* Clarification: the bill introducing the EZD obligation has not yet been published (the deadline remains at the earliest 2029, unchanged). Added: an amendment to the archival act passed by the Sejm, setting requirements for EZD-class systems, a scan with a qualified signature replacing paper, and 24 months to adapt systems. **On what basis.** Sejm, print no. 3000 (passed on 6 November 2026); no bill introducing the EZD obligation appears in the list of legislative work or before the Sejm. Sources: [Sejm: nowelizacja ustawy o narodowym zasobie archiwalnym i archiwach, druk 3000 (uchwalona 6.11.2026)](https://www.sejm.gov.pl/Sejm10.nsf/PrzebiegProc.xsp?nr=3000). (Who it concerns: JST · in the calendar since November 10, 2026)
3. October 12, 2026 (announcement by the Ministry of Digital Affairs) **[EZD-class system (electronic document and case management)](https://krogis.pl/en/kalendarz-obowiazkow#ezd)** *change of deadline or status* The deadline for the announced EZD-class system obligation has been postponed from 1 January 2028 to the earliest 2029. The obligation still has no basis in an enacted act. **On what basis.** Announcement by the Ministry of Digital Affairs of October 2026, reported to PAP Samorząd and Prawo.pl (12 October 2026). Sources: [Prawo.pl, 12.10.2026: EZD obowiązkowe dopiero od 2029 r.?](https://www.prawo.pl/samorzad/ezd-obowiazkowe-dopiero-od-2029-r-samorzady-ostrzegaja-ze-czasu-wciaz-za-malo,1554515.html). (Who it concerns: JST · in the calendar since October 21, 2026)
4. October 8, 2026 (CPPC extended the call) **[European Funds for Digital Development 2021–2027 (FERC)](https://krogis.pl/en/kalendarz-obowiazkow#ferc)** *clarification* The "Digital Education in JST" competition has been removed (this is an FERS programme; the call closed on 30 September 2026). Added deadline of 30 November 2026: end of the call for Local Cybersecurity Centres, open only to partnerships of at least two JSTs. **On what basis.** CPPC announcement for call FERC.04.01-IP.01-003/26 (extended by notice of 8 October 2026); European Funds Portal. Sources: [CPPC: nabór FERC.04.01-IP.01-003/26 (Lokalne Centra Cyberbezpieczeństwa)](https://www.gov.pl/web/cppc/FERC0401IP0100326). (Who it concerns: JST · in the calendar since November 10, 2026)
5. July 8, 2026 (adoption of the Digital Omnibus on AI) **[AI Act (EU regulation on artificial intelligence)](https://krogis.pl/en/kalendarz-obowiazkow#ai-act)** *new entry* New entries: the AI Act (deadlines following the Digital Omnibus on AI: 2 December 2027, 2 August 2028, 2 August 2030) and eIDAS 2.0 (digital identity wallet: 24 December 2026 and 24 December 2027). Added deadlines for 2027–2030 for KSeF, KSC and e-Doręczenia, including the announced phasing out of ePUAP. **On what basis.** Regulation (EU) 2026/1744 (EU Official Journal of 24 July 2026), Regulation (EU) 2024/1183, amendment to the KSC Act (Dz.U. 2026 item 252), and draft amendments to the VAT Act and the Act on Electronic Delivery. Sources: [EUR-Lex: rozporządzenie (UE) 2026/1744](https://eur-lex.europa.eu/legal-content/PL/ALL/?uri=CELEX%3A32026R1744); [EUR-Lex: rozporządzenie (UE) 2024/1183 (eIDAS 2.0)](https://eur-lex.europa.eu/eli/reg/2024/1183/oj). (Who it concerns: JST · municipal companies · business · in the calendar since October 30, 2026)
6. July 3, 2026 (adoption of the Act on Artificial Intelligence Systems) **[AI Act (EU regulation on artificial intelligence)](https://krogis.pl/en/kalendarz-obowiazkow#ai-act)** *clarification* Added: the Polish Act on Artificial Intelligence Systems, in force since 11 August 2026, establishing KRiBSI; some provisions apply from 28 October 2026. EU dates remain unchanged. **On what basis.** Act of 3 July 2026 on Artificial Intelligence Systems (Dz.U. 2026 item 1003). Sources: [ISAP: ustawa z 3 lipca 2026 r. o systemach sztucznej inteligencji (Dz.U. 2026 poz. 1003)](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20260001003). (Who it concerns: JST · municipal companies · business · in the calendar since November 10, 2026)
7. October 23, 2024 (adoption of Regulation (EU) 2024/2847) **[Cyber Resilience Act (security requirements for digital products)](https://krogis.pl/en/kalendarz-obowiazkow#cra)** *new entry* New entry: Cyber Resilience Act. From 11 September 2026, manufacturers must report vulnerabilities and serious incidents, and from 11 December 2027, digital products must meet security requirements and carry CE marking. For public authorities and municipal companies, this means requirements at the procurement stage. **On what basis.** Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements. Sources: [EUR-Lex: rozporządzenie (UE) 2024/2847 (Cyber Resilience Act)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj). (Who it concerns: business · in the calendar since November 10, 2026)
8. March 13, 2024 (adoption of Regulation (EU) 2024/903) **[Interoperability (Interoperable Europe Act and National Interoperability Framework)](https://krogis.pl/en/kalendarz-obowiazkow#interoperacyjnosc)** *new entry* New entries: interoperability (Interoperable Europe Act and the National Interoperability Framework) and digital accessibility with an accessibility status report. For reference: the Polish Accessibility Act, national AI regulatory sandboxes and FERC calls. **On what basis.** Review of JST digital obligations of 30 October 2026: Regulation (EU) 2024/903, Council of Ministers' regulation on the KRI of 21 May 2024, the Act on Digital Accessibility, the Act of 26 April 2024 (Dz.U. 2024 item 731), Regulation (EU) 2026/1744. Sources: [Komisja Europejska: Interoperable Europe Act](https://interoperable-europe.ec.europa.eu/interoperable-europe/interoperable-europe-act); [Dz.U. 2024 poz. 731](https://eli.gov.pl/eli/DU/2024/731/ogl/pol/pdf). (Who it concerns: JST · business · in the calendar since October 30, 2026)
9. April 4, 2019 (Act on Digital Accessibility, Article 11) **[Digital accessibility and the accessibility status report](https://krogis.pl/en/kalendarz-obowiazkow#dostepnosc)** *change of deadline or status* New annual deadline: review and update of the accessibility statement by 31 March each year (next due 31 March 2027). **On what basis.** Article 11 of the Act on the Digital Accessibility of Websites and Mobile Applications of Public Entities (consolidated text, Dz.U. 2023 item 1440). Sources: [ISAP: ustawa o dostępności cyfrowej stron internetowych i aplikacji mobilnych podmiotów publicznych (t.j. Dz.U. 2023 poz. 1440)](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20230001440). (Who it concerns: JST · municipal companies · in the calendar since November 10, 2026)

## All these obligations fall on the same people and the same document workflow.

That's why we start with a single inventory of systems, contracts and processes that each of them draws on. [IT systems inventory](https://krogis.pl/en/inwentaryzacja): 2–6 weeks, below the public procurement threshold.

[Book a 30-minute call](https://krogis.pl/en/uslugi#kontakt)