Will a certificate free my company from a NIS2 audit?

Not yet, because this is only a legislative proposal from 20 January 2026. If it enters into force in its current shape, a valid cybersecurity-posture certificate confirming Article 21 compliance will remove the additional supervisory audit ordered by the authority. It will not remove other forms of supervision: on-site inspections, security scans or information requests.

Is this about the EUCC certificate?

No. EUCC is a certification scheme for ICT products. Organizational NIS2 compliance is meant to be confirmed by a new cybersecurity-posture scheme, still being designed under CSA2. They are two different tools.

When will the changes apply in Poland?

The proposal has gone to the European Parliament and the Council. Political agreement is targeted for early 2027. CSA2, as a regulation, will apply directly, while the NIS2 amendment, as a directive, gives states 12 months for transposition. In practice, expect this in Polish law no earlier than 2028.

Should I pause my NIS2 preparations and wait for certification?

No. To obtain a certificate you must implement the Article 21 measures anyway: an ISMS, risk management, incident handling, supply-chain security. That is the same work you are doing today as part of an audit and implementation. Waiting only shortens the time you have to adapt.

Certification Instead of a NIS2 Audit? What CSA2 Changes [2026]

The 20 January 2026 CSA2 package makes certification a route to proving NIS2 compliance. What exactly changes, what it does not cover, and when. Analysis for companies.