IT, cybersecurity and AI for local government units
Polish municipalities, counties and their organisational units have more IT obligations than ever: the new KSC act, the annual KRI audit, digital accessibility, e-Delivery and a growing number of attacks. We help meet the requirements and relieve civil servants through automation and secure AI.
- Implementing the amended KSC act by 3 April 2027
- Annual information security audit under KRI
- AI in the office on the unit's own server, without sharing citizens' data
What changed for local government in 2026
The amended National Cybersecurity System Act (KSC), which implements NIS2, has applied since 3 April 2026 and explicitly covers public entities, including local government units, their associations and local budgetary units and establishments. The deadline for registering in the list of entities passed on 3 October 2026.
By 3 April 2027 units must implement an information security management system, incident handling and business continuity procedures, and report significant incidents within 24 and 72 hours. The act provides for personal liability of the head of the unit, with a fine of up to 100% of remuneration in public entities. These obligations come on top of the existing National Interoperability Framework (KRI) requirements, including an annual information security audit.
How we help local government
KSC (NIS2) compliance
Gap analysis, ISMS, risk assessment, incident handling and reporting procedures, contact persons and a business continuity plan.
KRI and information security audit
The annual audit required by the KRI regulation, with a report for the head of the unit and a remediation plan, aligned with KSC so the work is not done twice.
Protecting office infrastructure
Firewall, network segmentation, EDR, MFA, account and permission management, e-mail protection, immutable backups and restore tests.
Training for civil servants
Cyber hygiene and phishing awareness for all staff, a separate session on management obligations and practical training on safe AI use.
AI in the office
A local language model on the unit's server: searching resolutions, orders and procedures, drafting replies to applications and letters, summarising documents. Citizens' data stays in the office.
Automating citizen services
Routing correspondence to the right department, deadline reminders and reports from registers and line-of-business systems without manual collation.
Ongoing IT support
Helpdesk for the office, schools and organisational units, server and network administration, KRI documentation.
Projects and tenders
Specifications, documentation for funding applications, support during acceptance and settlement of digital projects.
How we work with local government units
Meeting with the secretary and IT staff
Current state, deadlines and resources of the unit.
Audit and report for the head of the unit
KSC and KRI compliance assessment and an action plan with costs.
Implementation
Documentation, technical controls and training, in line with public procurement rules.
Maintenance and annual audit
Monitoring, documentation updates, tests and the KRI audit every year.
Frequently asked questions: Local government
Are Polish municipalities covered by the KSC act?
Yes. The amended KSC act lists public entities, including local government units, their associations and local budgetary units and establishments. The exact scope depends on the entity's classification, so we start by analysing which requirements apply to the specific unit.
What are the KSC deadlines for local government?
The act has applied since 3 April 2026. Registration was due by 3 October 2026. Risk management, procedures and security controls must be in place by 3 April 2027. Units that missed the registration deadline should register without delay.
How does the KRI audit differ from KSC requirements?
The KRI audit comes from the National Interoperability Framework regulation and concerns information security in entities performing public tasks, at least once a year. The KSC act adds risk management, incident handling and reporting and management accountability. We combine both into one documentation system.
Can a public office use AI lawfully?
Yes, provided GDPR, statutory secrecy rules and the AI Act are respected. The safest approach is to run the model on the unit's server, adopt an AI usage policy and train staff. AI prepares a draft, and the decision and signature always stay with the civil servant.
Do you take part in public tenders?
Yes. We submit offers in tenders and requests for quotation from local government units, and can help describe needs and estimate the contract value before a procedure is announced.
Related services
- Cybersecurity and NIS2Ransomware protection, NIS2 compliance in Poland and Germany, staff awareness training.
- AI trainingAI training for management, office staff, IT teams and public servants, on site and online.
- Private local AIPrivate AI on your own server: hardware selection, models and search across company documents.
Free KSC consultation for your unit
In 45 minutes we establish where your unit stands, what must be done by 3 April 2027 and in what order.
- Phone
+48 501 035 571 - E-mail
kontaktaritmasoft.eu