The KRI audit in 2026: § 19, scope and what changes in 2027

The legal position: the audit is in § 19, not § 20

The Council of Ministers regulation of 21 May 2024 sets out the Polish National Interoperability Framework, the minimum requirements for public registers and the electronic exchange of information, and the minimum requirements for ICT systems. It entered into force on 23 May 2024. ^[1]

Under § 19(1) the management of the entity is to establish, implement, operate, monitor, review, maintain and improve an information security management system. The system is to protect the confidentiality, availability and integrity of information, taking account of authenticity, accountability, non-repudiation and reliability.

The audit requirement reads: ensure a periodic internal audit in the area of information security, no less often than once a year. The old designation "§ 20(2)(14)" should therefore not be repeated. In the current regulation § 20 concerns the recording of user and administrator actions, access to configuration and to protected data, and the retention of logs - as a rule for two years, unless separate provisions state otherwise. Those mechanisms may well be examined during an audit, but they are not its legal basis. ^[1]

Who the obligation binds

The range of entities has to be established from article 2 of the Informatisation Act, not from the organisation's name. The act covers, among others, public finance sector units, other state organisational units without legal personality, certain legal persons under dominant public funding or supervision, their associations and unions, research institutes, units of the Lukasiewicz Network, non-public higher education institutions and federations of entities in the higher education and science system. The act also contains exclusions and provisions applying only to selected entities. ^[2]

• A municipality, county or voivodeship: size and population create no exemption. The sample may be smaller, but the annual criterion stands.
• A budgetary unit or local government budgetary establishment: as a rule it falls within the public finance sector; the systems and processes covered still have to be identified correctly.
• A municipal company or other legal person: assume neither inclusion nor exclusion. Examine the conditions in article 2(1)(3), including the purpose of establishment, funding, control and the composition of governing bodies.
• A healthcare provider: legal form and ownership status matter. Merely providing health services does not settle whether the whole of KRI applies.
• A university: public universities fall within the public finance sector, and non-public ones are named in article 2(1) of the Informatisation Act.

Before the audit, prepare a short scoping note: the basis on which the entity is covered, the organisational units, the public tasks, the systems supporting those tasks, the sites, the cloud services and the suppliers. This reduces the risk both of missing a system and of examining an area for which there is no proper legal criterion.

What § 19 actually requires

Paragraph 2 contains fourteen points. The groupings below are a working order for the audit, not a new legal catalogue:

1. Governance and risk. Current internal regulations, periodic risk analyses, the selection of safeguards and additional measures where the risk justifies them.
2. Assets and entitlements. A current inventory of hardware and software with type and configuration, appropriate entitlements and their prompt amendment when duties change.
3. People and ways of working. Training covering threats, the consequences of breaches, responsibility and measures that reduce human error, together with rules for mobile and remote working.
4. Protection of information and systems. Monitoring of access, detection of unauthorised activity, protection against disclosure, modification, deletion and destruction, updates, resilience to failure, protection of system files, cryptography proportionate to risk, and reduction of the threats arising from vulnerabilities.
5. Suppliers and media. Security clauses in third-party contracts, and rules limiting the risk of theft of information and of the means of processing it, including mobile devices.
6. Incidents, checks and audit. Rules for prompt incident reporting, checks on system conformity, and the annual internal information security audit.

The regulation does not impose an identical technical configuration on every organisation. MFA, EDR, network segmentation, disk encryption, immutable backups or a patching deadline may all be appropriate safeguards, but their use and their parameters should follow from risk, from specific legal provisions, from contracts and from the architecture. KRI on its own establishes no universal "30 days to patch", no annual review of all entitlements, no CIS Level 1 profile and no obligation to buy a particular class of product.

KRI and PN-ISO/IEC 27001 - a facility, not a duty to certify

§ 19(3) refers expressly to the Polish Standards. The requirements of paragraphs 1 and 2 are treated as met where the information security management system was developed on the basis of PN-ISO/IEC 27001 and where the establishment of safeguards, risk management and auditing are carried out on the basis of the related Polish Standards, including PN-ISO/IEC 27002 and PN-ISO/IEC 27005. ^{[1] [10] [11] [12]}

This is a significant presumption of conformity, but it is not an obligation to obtain an ISO/IEC 27001 certificate. Certification and internal audit play different roles. A certificate on its own does not substitute for evidence that an audit covering the right entity, the right systems and the current legal requirements was performed in the year in question.

When designing the audit programme, ISO 19011:2026 - the current guidance on auditing management systems - and ISO/IEC 27007:2020 on auditing information security management systems are both useful. ISO 19011:2026 replaced the 2018 edition. ^{[8] [9]}

How to run an audit that produces a usable result

1. Establish the mandate, the criteria and independence

The regulation creates no list of licensed KRI auditors and no compulsory set of certificates. Nor does it say whether the work should be done by an employee or a firm. The head of the entity should nevertheless assure competence, impartiality and a division of roles such that the auditor is not assessing their own implementation or their own day-to-day administration. In its most recent inspections the Polish Supreme Audit Office treated a breach of independence and objectivity as a defect in the audit. ^[3]

2. Build the scope from processes and systems

Connect the public tasks to information, applications, infrastructure, sites, personnel and suppliers. A scope of "the IT department" is usually too narrow: entitlements, contracts, training, business continuity and risk acceptance are also decided by management, HR, procurement, process owners and business administrators.

3. Draw up a criterion-evidence-test matrix

For each requirement, state the expected evidence and how it will be examined. An inventory, for example, is confirmed not only by spreadsheets but by comparing the register with the directory service, the management console and a sample of devices. The effectiveness of revoking entitlements is confirmed by a sample of terminated employments and changed roles. Contractual safeguards are examined on a sample of active suppliers.

4. Gather evidence from several sources

An interview shows the declared process, a document the designed process, and a configuration, a log entry, a ticket and a test result the process as executed. A sound conclusion should rest on evidence proportionate to the risk. A remote audit is possible for part of the scope, but inspecting the server room, physical safeguards or work on site may require a visit.

5. Separate a nonconformity from a recommendation

A nonconformity requires a specific criterion and evidence that it is not met. A recommendation may raise resilience even though it does not follow literally from KRI. Keeping the two apart protects the report from presenting the auditor's preferences as a legal obligation.

6. Close the loop with corrective action

For each finding, state the owner, the priority, the action, the deadline and how it will be verified. Risk accepted at the appropriate level of management does not disappear; it should remain on the register with its justification and a date for review.

The report: not named in the provision, but the key evidence

§ 19(2)(14) does not say that the audit must be "in writing", nor does it set a page count or a rating scale. Without recorded evidence, however, it is hard to demonstrate that the obligation was discharged or to oversee the follow-up. Good documentation therefore covers:

• the approved purpose, scope, criteria, period examined and the composition of the team;
• declarations of impartiality and a description of the audit's limitations;
• the programme of work, the sample and a register of the evidence obtained;
• findings recorded as: criterion, state of affairs, evidence, consequence or risk;
• a summary for management that does not conceal limitations and uncertainty;
• an action plan and the result of checking that it was carried out.

The number of pages and person-days depends on the number of systems, sites and suppliers, on complexity and on the quality of the earlier documentation. Universal ranges for a "small" or "medium" municipality, offered without establishing the scope, are false precision.

What the audit office inspections show

In a report published in July 2026 the Polish Supreme Audit Office described a sample of 17 authorities drawing the highest-value grants under the "Cyber-secure Local Government" programme. In eight of them (47 per cent) the audit for 2023 or 2024 had not been carried out, had been carried out unreliably, or independence and objectivity had been compromised. That is a result for a defined sample, not an estimate for all Polish local authorities. ^[3]

In a separate inspection of 24 authorities, reported in 2025, in nine cases the audit for 2023 had not been performed or was found unreliable or compromised as to independence and objectivity. In 17 authorities no business continuity policy had been established, in 12 information assets were identified and classified incompletely, and 11 IT purchase or service contracts lacked appropriate security provisions. ^[4]

Both results reinforce two conclusions: an audit cannot stop at checking whether documents exist, and its sample and conclusions should not be generalised beyond the population examined.

The KRI audit versus the KSC/NIS2 audit

The amendment to the act on the national cybersecurity system was promulgated on 2 March 2026 and entered into force on 3 April 2026. It is no longer a draft. The act uses the notions of an essential entity and an important entity. Classifying an entity requires a separate analysis under the act and its annexes; it does not follow automatically from being subject to KRI. ^[5]

• KRI: currently an internal information security audit no less often than once a year, for entities covered by the relevant provisions of the Informatisation Act and the regulation.
• KSC: an essential entity is subject to an audit at least once every three years; the competent authority may order an audit in the cases set out in the act, and the supervisory mechanism for an important entity is different.
• Transitional deadlines: for entities meeting the criteria on the day the act entered into force, it provides as a rule 12 months to discharge the chapter 3 obligations and 24 months for an essential entity's first audit.

One team can gather common evidence, but the report should have a matrix separating the KRI, KSC and - where the organisation applies it - ISO/IEC 27001 criteria. A KSC audit should not be presented as an automatic substitute for a KRI audit, or the other way round. NIS2 is the EU source, but in 2026 the current obligations of Polish entities have to be assessed primarily on the basis of the enacted KSC act. ^[6]

What may change in 2027

The ELI record for the 2024 regulation gives a repeal date of 23 February 2027. In July 2026 draft RD313 for a new regulation was published, with adoption by the Council of Ministers planned for the fourth quarter of 2026. The explanatory material for the draft announces the removal from the new KRI of the requirements concerning the information security management system, on the basis that the area is to be governed by the amended KSC act. ^{[1] [7]}

No audit: what can be said without overstating it

The KRI regulation contains no schedule of administrative fines of its own for a missing audit. Failure to discharge the obligation is nonetheless a nonconformity that an inspection may expose, and it weakens the ability to demonstrate proper oversight of information security.

The maximum sanctions under the GDPR, NIS2 or the KSC act should not be transferred automatically to every case. Liability under those regimes requires their own material and personal scope, a breach of a specific obligation and the conduct of the appropriate proceedings. A missing KRI audit may form part of a wider assessment, but on its own it does not determine a penalty under another statute.