The year 2026 is a moment when regulatory training requirements for IT industries reach a new level of complexity. If you’re an L&D Manager, responsible for compliance, or managing IT teams in a regulated organisation, you need to know exactly: which training is mandatory, whom it affects, when it must be completed, and what penalties apply for non-compliance. This article is a complete checklist of mandatory IT training in 2026 – a practical guide to help you plan your budget, schedule, and avoid costly penalties.
Quick links
- Which regulations require IT training in 2026?
- NIS2 — training requirements and implementation deadlines
- DORA — training obligations for the financial sector
- AI Act — new AI literacy requirement in organisations
- GDPR — continuous training obligation for IT teams
- Summary table — checklist of mandatory training per regulation
- Industry requirements — finance, healthcare, energy, administration
- How to plan compliance training budget in 2026?
- Training grants — KFS and other sources
- How EITT supports organisations in meeting training requirements
- FAQ — most frequently asked questions about mandatory IT training
Which regulations require IT training in 2026?
The year 2026 is the time of full implementation of key EU regulations that impose direct training obligations on organisations. Here are the most important ones:
NIS2 (Directive on Security of Network and Information Systems) – Member States had to transpose it by 17 October 2024; in Poland it is implemented by the amended National Cybersecurity System Act, in force since 3 April 2026. Requires cybersecurity training for management and IT teams in essential and important entities.
DORA (Digital Operational Resilience Act) – in force from 17 January 2025. Imposes detailed training requirements for the financial sector in digital resilience, ICT risk management, and security testing.
AI Act (Artificial Intelligence Regulation) – applies in stages from 2025; high-risk system requirements apply from 2 December 2027 and 2 August 2028. Article 4 (AI literacy) covers all providers and deployers of AI systems, not only high-risk systems.
GDPR (General Data Protection Regulation) – in force since 2018; in 2026 the Polish Personal Data Protection Office (UODO) runs inspections under its sectoral plan and, after medical data leaks, extended it with additional healthcare inspections (UODO announcement of 16 September 2026). The GDPR does not expressly require training for every employee, but training is a typical organisational measure (Articles 24 and 32 GDPR), and monitoring it is a task of the data protection officer (Article 39(1)(b)).
NCA (National Cybersecurity Act) – Polish implementation of NIS2 (since 3 April 2026); covers essential and important entities and requires the head of the entity to complete training once per calendar year (Article 8e).
Additionally, the financial sector is supervised by the Polish Financial Supervision Authority (KNF), while healthcare and energy are sectors covered by NIS2 and the Polish National Cybersecurity System Act.
NIS2 — training requirements for organisations
The NIS2 Directive is the broadest cybersecurity regulation in the EU, covering approximately 160,000 entities in Europe, including approximately 10,000 Polish companies. Training requirements are a key element of compliance here.
Whom does NIS2 affect?
- Essential entities: energy, transport, banking, healthcare, digital infrastructure, public administration, space
- Important entities: postal services, waste management, manufacturing, digital platforms, food sector
Medium and large enterprises (50+ employees, €10+ million turnover) in these sectors are subject to NIS2.
What training does NIS2 require?
Management (C-level, board):
- Cybersecurity and risk management training
- Legal responsibility and board obligations in the context of NIS2
- Incident management and business continuity
- Frequency: once per calendar year, with documented attendance (Article 8e of the Polish National Cybersecurity System Act — applies to the head of an essential or important entity and to the person entrusted with the head’s cybersecurity duties)
IT and cybersecurity teams:
- Cyber risk management
- Incident detection and response (CSIRT)
- Supply chain security
- Vulnerability management and patching
- Frequency: regular training, tailored to role
All employees:
- Cyberhygiene basics (phishing, passwords, social engineering)
- Secure remote working principles
- Incident reporting procedures
- Frequency: not set by law; we recommend at least once a year plus awareness campaigns
Deadlines and penalties
- Implementation in Poland: Act of 23 January 2026 amending the National Cybersecurity System Act (Journal of Laws 2026 item 252), in force since 3 April 2026
- Penalties: up to €10 million or 2% of annual turnover for essential entities and up to €7 million or 1.4% for important entities (Article 34 NIS2), for breaches of risk-management and incident-reporting obligations. A head of entity who does not complete the annual training can be fined up to 300% of their remuneration (Article 73a of the Polish act; up to 100% in public entities)
- Documentation: Organisations must maintain training registers and prove that management has completed required courses
DORA — training requirements for the financial sector
The DORA Regulation has been in force since 17 January 2025 and is directly applicable throughout the EU, without the need for national implementation. It covers all financial sector entities: banks, insurers, investment firms, payment institutions, pension funds, credit intermediaries, and ICT service providers to this sector.
What training does DORA require?
Management and senior staff:
- ICT risk management
- Third-party risk management
- Digital resilience testing (TLPT – Threat-Led Penetration Testing)
- Business continuity management and disaster recovery planning
- Frequency: regular participation in training (Article 5(4) DORA), no set number
IT and cybersecurity teams:
- ICT-related incident management
- Incident classification and reporting (according to EBA, ESMA, EIOPA)
- ICT supply chain management
- Resilience testing (penetration testing, red teaming)
- Frequency: continuous training, including advanced practical tests
Risk management teams:
- ICT risk management framework
- Cooperation with ICT service providers
- Threat intelligence sharing
- Frequency: DORA does not set a number — members of the management body regularly follow training (Article 5(4)) and staff training is part of the training programme (Article 13(6)); internal policy sets the rhythm
Deadlines and penalties
- In force from: 17 January 2025
- Sanctions: DORA does not set penalty amounts for financial entities — administrative penalties are laid down by Member States (Article 50(3))
- Reporting: ICT incidents must be reported within 4 hours (initial notification), 72 hours (report), 1 month (final report)
AI Act — AI literacy obligation in organisations
The Artificial Intelligence Regulation (AI Act) introduces in Article 4 a new type of competence obligation: AI literacy, i.e., the ability to understand and safely use AI systems. Since 27 July 2026, as amended by Regulation (EU) 2026/1744, providers and deployers of AI systems take measures to support the development of AI literacy of their staff and other persons dealing with AI systems on their behalf. The provision states expressly that this does not require guaranteeing any specific level of AI literacy of any individual.
Whom does AI Act affect?
- Organisations deploying high-risk AI systems (e.g., in recruitment, credit scoring, access control, healthcare)
- Providers of large-scale foundation models
- Organisations using general-purpose AI systems (GPAI)
What training does AI Act require?
Teams deploying high-risk AI systems:
- AI risk management
- Technical documentation and transparency
- Ethical AI principles and bias mitigation
- AI model audit and verification
- Frequency: The regulation does not set a frequency; we recommend a refresher every 12–24 months and whenever systems or roles change
Employees using AI at work:
- AI literacy – basics of how AI systems work
- Safe use of AI tools (ChatGPT, Copilot, etc.)
- Recognising AI errors and hallucinations
- Training data management
- Frequency: the AI Act does not set one; we recommend at least once a year plus awareness campaigns
Management:
- Strategic AI management in the organisation
- Legal responsibility for AI systems
- AI governance and compliance
- Frequency: the AI Act does not set one; we recommend every 12 months and with regulatory changes
Deadlines
- Ban on unacceptable-risk AI practices and Article 4 (AI literacy): 2 February 2025
- Requirements for GPAI models: August 2025
- New wording of Article 4 (Regulation (EU) 2026/1744): 27 July 2026
- Requirements for high-risk AI systems: 2 December 2027 (Annex III) and 2 August 2028 (Annex I)
GDPR — continuous training obligation for IT teams
GDPR has been in force since 2018; in 2026 the Polish Personal Data Protection Office (UODO) runs inspections under its sectoral plan and, after medical data leaks, extended it with additional healthcare inspections (UODO announcement of 16 September 2026). The GDPR does not expressly require training for every employee, but training is a typical organisational measure (Articles 24 and 32 GDPR), and monitoring it is a task of the data protection officer (Article 39(1)(b)).
What training does GDPR require?
IT teams and system administrators:
- Principles of personal data protection in IT
- Processing security (encryption, pseudonymisation)
- Data breach incident management
- Cloud data protection and secure backups
- Frequency: The regulation does not set a frequency; we recommend a refresher every 12–24 months and whenever systems or roles change
Management:
- Data controller obligations
- Civil and criminal liability for GDPR violations
- Privacy by design and privacy by default
- Frequency: the GDPR does not set one; we recommend every 24 months and with organisational changes
All employees:
- GDPR basics for employees
- Recognising phishing and social engineering attempts
- Secure data processing principles
- Frequency: the GDPR does not set one; we recommend at least once a year
DPO (Data Protection Officer):
- Advanced GDPR training
- EXIN PDPF, PDPE, CIPP/E certification
- Frequency: continuous development, according to role requirements
Penalties
- Maximum penalties: up to €20 million or 4% of annual turnover (for the most serious violations)
- Lack of training: may be assessed as an insufficient organisational measure under Article 32 GDPR (security of processing)
Summary table — checklist of mandatory training per regulation
| Regulation | Whom it affects | Required training | Frequency | Implementation deadline | Penalties for non-compliance |
|---|---|---|---|---|---|
| NIS2 | Essential and important entities (energy, transport, banking, healthcare, digital infrastructure, manufacturing, postal services) | Management: cybersecurity, risk management IT teams: CSIRT, supply chain security All: cyberhygiene | Head of entity: once per calendar year (Article 8e, Polish act); others: not set by law | 3 April 2026 (Polish National Cybersecurity System Act, Journal of Laws 2026 item 252) | €10 million or 2% of turnover (essential entities) €7 million or 1.4% of turnover (important entities) |
| DORA | Financial sector (banks, insurers, investment firms, payments, ICT providers) | Management: ICT risk management IT teams: resilience testing (TLPT), incident management Risk teams: third-party risk | Regular, according to internal policy | 17 January 2025 | Set by Member States (Article 50(3) DORA) |
| AI Act | Organisations deploying high-risk AI, GPAI model providers | AI teams: AI risk management, documentation, model audit Employees: AI literacy Management: AI governance | Not set by the regulation (we recommend every 12–24 months) | In stages: Article 4 from 2 February 2025; high-risk systems from 2 December 2027 and 2 August 2028 | €35 million or 7% of turnover (for prohibited practices); Article 4 is not covered by the Article 99 penalty provisions |
| GDPR | All organisations processing personal data | IT teams: processing security, incident management Management: controller obligations All: GDPR basics | Not set by the regulation (we recommend every 12–24 months) | In force since 2018 | €20 million or 4% of turnover |
| NCA | Since 3 April 2026 the Polish National Cybersecurity System Act implements NIS2: essential and important entities (the former OES and DSP categories were replaced) | As in the NIS2 row Teams: incident reporting to the competent CSIRT | Head of entity: once per calendar year (Article 8e); others: not set by law | 3 April 2026 (Journal of Laws 2026 item 252) | As in the NIS2 row; in cases under Article 73(5) up to PLN 100 million; head of entity up to 300% of remuneration (Article 73a) |
Industry requirements — finance, healthcare, energy, administration
In addition to general regulations (NIS2, DORA, GDPR, AI Act), individual industries are subject to additional training requirements.
Financial sector
- DORA (from 2025): mandatory for all financial entities
- Financial supervisory authority recommendations: operational risk management, cybersecurity, application security training
- AML (Anti-Money Laundering): money laundering and terrorist financing detection training
- Frequency: the law does not set a single interval (e.g. Article 52 of the Polish AML Act requires participation in training programmes without a number); in practice we recommend at least once a year
Healthcare
- NIS2: healthcare entities as essential sector
- GDPR + medical data protection: specific requirements for sensitive data (Article 9 GDPR)
- Required training: medical system security management (HIS, PACS), patient data protection, incident management
- Frequency: the head of an essential or important entity once per calendar year (Article 8e of the Polish act); for staff the law does not set one, we recommend at least once a year
Energy
- NIS2: essential sector
- IEC 62443 standards: industrial control system security standard
- Required training: OT (operational technology) security, SCADA protection, critical infrastructure risk management
- Frequency: the head of an essential or important entity once per calendar year (Article 8e of the Polish act); for others the law does not set one, we recommend at least once a year
Public administration
- NIS2: essential sector
- Informatisation legislation: cybersecurity obligations for public offices
- GDPR: specific requirements for public sector entities
- Required training: cybersecurity in administration, citizen data protection, incident management
- Frequency: the National Interoperability Framework (§ 20(2)(6), Journal of Laws 2024 item 773) requires training for people processing information, without a set frequency; we recommend at least once a year
How to plan compliance training budget in 2026?
Budget planning for training is one of the biggest challenges for L&D Managers in 2026. Here’s a practical approach:
Step 1: Map training obligations
First, determine which regulations affect your organisation:
- Are you in a sector covered by NIS2? (check the list of essential and important entities)
- Do you operate in the financial sector? (DORA)
- Are you deploying AI systems? (AI Act)
- Do you process personal data? (GDPR)
Step 2: Count how many employees require training
Example for a 500-person company (financial sector, covered by NIS2 and DORA):
| Group | Number of people | Required training | Estimated cost |
|---|---|---|---|
| Management | 10 | NIS2 + DORA + GDPR | PLN 20,000 |
| IT teams (50 people) | 50 | NIS2 + DORA + GDPR + advanced cybersecurity | PLN 100,000 |
| Compliance teams (10 people) | 10 | DORA + GDPR + security audit | PLN 25,000 |
| All employees | 500 | GDPR + cyberhygiene | PLN 50,000 |
| TOTAL | 500 | PLN 195,000 |
Cost of training for management: PLN 2,000/person (closed training, consultations) Cost of training for IT teams: PLN 2,000/person (advanced, hands-on) Cost of training for compliance: PLN 2,500/person (certifications, audit) Cost of training for employees: PLN 100/person (e-learning, campaigns)
Step 3: Include additional costs
- Certifications: EXIN (PDPF, PDPE), PECB (ISO 27001 Lead Implementer), EC-Council (CEH)
- Compliance audit: gap analysis – PLN 20,000 - 50,000
- Phishing simulations: PLN 5,000 - 15,000/year
- Legal consultations: regulation interpretation – PLN 10,000 - 30,000
Step 4: Plan the schedule
- Q1 2026: Management training (NIS2, DORA), gap analysis
- Q2 2026: IT and compliance team training
- Q3 2026: Employee training (GDPR, cyberhygiene), phishing simulations
- Q4 2026: Advanced training, certifications, audit tests
Training grants — KFS and other sources
Good news: many compliance training programmes can be co-financed from public funds.
National Training Fund (KFS)
- Co-financing amount: up to 70% of costs (up to 90% for entities employing no more than 9 people), capped at 200% of the average wage per participant — under Article 126 of Poland’s Labour Market and Employment Services Act of 20 March 2025 (Journal of Laws 2025, item 620)
- For whom: entities that paid Labour Fund contributions for at least 6 months before applying (or are exempt by law); funding can cover employees, employers, self-employed persons and people on civil-law contracts (Article 125(8) and (10))
- Conditions: the district head (starosta) assesses alignment with the year’s KFS priorities, with local or regional labour market needs, and the training price against the market (Article 125(13))
- Important limitation: KFS does not fund training that the employer is obliged to provide under separate regulations (Article 125(12)(2)) — so the training for the head of an entity required by Article 8e of the Polish National Cybersecurity System Act will most likely not be funded (the assessment is up to the district head). KFS can fund training that goes beyond the statutory obligation, such as IT certifications or in-depth cybersecurity skills
- How to apply: the application is submitted electronically to the district employment office competent for your registered office or place of business (Article 126(4))
Polish Agency for Enterprise Development (PARP)
- Skills for Business Programme: grants for digital competence training
- Co-financing amount: up to 80% of costs
- For whom: SMEs (micro, small, medium enterprises)
Training vouchers (Provincial Employment Office)
- Amount: up to PLN 5,000 per employee
- For whom: companies in selected regions
- Covered training: IT certifications, cybersecurity, compliance
Tax relief for training
- Article 26d of Personal Income Tax Act: employer can deduct up to 50% of employee training expenses from tax base
- For whom: all companies
How EITT supports organisations in meeting training requirements
EITT is a partner that understands the regulatory complexity of 2026. We offer comprehensive support for L&D Managers and compliance departments:
Our compliance training
NIS2 — Cybersecurity for management
- Legal responsibility of the board in the context of NIS2
- Cyber risk management
- Incident management and business continuity
- Format: closed training, 1-2 days
- For whom: C-level, board, IT managers
DORA — Digital resilience for the financial sector
- ICT risk management
- Third-party risk management
- Resilience testing (TLPT)
- Format: closed training, 2 days
- For whom: banks, insurers, fintech
AI Act — AI literacy and AI governance
- Basics of how AI systems work
- High-risk AI risk management
- AI governance and compliance
- Format: open and closed training, 1 day
- For whom: AI teams, management, employees
GDPR — Personal data protection in practice
- GDPR principles for IT teams
- Data processing security
- Data breach incident management
- Format: e-learning + classroom training, 1 day
- For whom: IT teams, DPO, management
Cybersecurity — practical training
- Cyberhygiene for employees
- Advanced training for IT teams (CSIRT, pentesting)
- Phishing simulations and red team exercises
- Format: e-learning, workshops, closed training
- For whom: all employees, IT teams
Our approach
- Industry customisation: We don’t sell off-the-shelf training. We tailor every programme to your sector (finance, healthcare, energy).
- Hands-on: Zero theory. We teach what you can apply immediately.
- Experts: Trainers with experience at large banks, energy companies and healthcare institutions.
- Reporting: You receive complete training documentation – essential for compliance audits.
- Certificates: We issue certificates of participation (training documentation requirement in NIS2, DORA).
How do we start?
- Consultation: We discuss your needs and regulations that apply to you.
- Gap analysis: We check which training is mandatory for your company.
- Training plan: We design a training schedule for 2026.
- Implementation: We deliver training (closed, open, e-learning).
- Reporting: We provide compliance documentation.
Contact EITT: eitt.pl/contact | Call: +48 22 257 22 20 Check our training: eitt.pl/trainings
EITT – practitioner trainers, 2500+ training courses in our catalog. Practical knowledge you can apply immediately.
FAQ — most frequently asked questions about mandatory IT training
Is NIS2 training mandatory for the entire board?
Yes. The NIS2 Directive imposes direct responsibility on management for ensuring organisational cybersecurity. Board members must complete training in cyber risk management and ICT security. Lack of documented training can result in penalties for both the board and the organisation.
How to prove DORA compliance during a financial supervisory authority audit?
Financial supervisory authorities require documentation of all activities related to ICT risk management, including training. You must have:
- Training registers (who, when, what training completed)
- Certificates of participation
- Internal training policies
- Resilience test reports (TLPT)
EITT provides complete training documentation, compliant with financial supervisory authority requirements.
Do small companies (up to 50 employees) have to comply with NIS2?
As a rule, NIS2 applies to medium and large enterprises (50+ employees, €10+ million turnover). However, small companies may be subject to regulation if they are the sole provider of a service in an essential sector or are critical to the functioning of the supply chain. Check your company’s status in the context of NIS2.
What penalties apply for lack of GDPR training?
Lack of training may be assessed as an insufficient organisational measure under Article 32 GDPR (security of processing). Infringements of Article 32 carry fines of up to €10 million or 2% of annual turnover (Article 83(4) GDPR); the €20 million or 4% tier applies to, among others, infringements of the basic principles of processing (Article 83(5)).
Does the AI Act require training in 2026?
Article 4 of the AI Act (AI literacy) has applied since 2 February 2025. Since 27 July 2026, as amended by Regulation (EU) 2026/1744, providers and deployers of AI systems take measures to support the development of AI literacy of their staff — the provision does not require guaranteeing any specific level of AI literacy of any individual, and training is the simplest way to deliver and document those measures. Article 4 is not listed in the penalty provisions of Article 99(3)–(5). Requirements for high-risk systems apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
How often must cybersecurity training be renewed?
It depends on the regulation:
- NIS2 / Polish act: head of an essential or important entity — once per calendar year (Article 8e); for other staff the law does not set a frequency
- DORA: regularly, according to internal policy — the regulation does not set a frequency
- GDPR: the regulation does not set a frequency; we recommend every 12–24 months
Additionally, we recommend awareness campaigns every quarter (e.g., phishing simulations).
Can compliance training be co-financed from KFS?
Only partly. KFS funds cannot cover training that the employer is obliged to provide under separate regulations (Article 125(12)(2) of the Labour Market and Employment Services Act) — training required directly by law, such as the annual training for the head of an entity under Article 8e of the Polish National Cybersecurity System Act, will most likely not be funded from KFS (the final assessment of the application is made by the district head). Co-financing is available for training that goes beyond the statutory obligation, such as IT certifications or in-depth cybersecurity skills: up to 70% of costs (up to 90% for entities employing no more than 9 people), capped at 200% of the average wage per participant (Article 126). You submit the application electronically to the district employment office.
Summary: key conclusions for L&D Managers
The year 2026 is a compliance year for IT industries. The NIS2, DORA, AI Act, GDPR, and NCA regulations impose unprecedented training obligations, and penalties for non-compliance reach tens of millions of euros. For L&D Managers, this means the necessity of:
- Mapping training obligations – which regulations affect your organisation?
- Planning the budget – compliance training is an investment of PLN 100,000 - 500,000 per year (for companies with 500+ people)
- Implementing a training schedule – management, IT teams, all employees
- Documenting compliance – training registers, certificates, reports
EITT supports organisations throughout the entire process – from gap analysis, through training programme design, to implementation and reporting. Our experts know the specifics of your industry and understand how to translate regulatory requirements into practical training.
Don’t wait for an audit. Plan compliance training for 2026 today.
Contact EITT: eitt.pl/contact | Call: +48 22 257 22 20 Check our training: eitt.pl/trainings
EITT – practitioner trainers, 2500+ training courses in our catalog. Practical knowledge you can apply immediately.
Read Also
- DORA for the Financial Sector - Mandatory Competencies 2026
- IT Training for Banks - Financial Sector Specifics
- NIS2 Training - What Your IT Team Needs to Know
Read also
- DORA for the Financial Sector - Mandatory Competencies 2026
- AI Act and Team Competencies - How to Prepare Your Company
- Mandatory Salary Ranges – What Employers and Candidates Need to Know
Develop your skills
Want to deepen your knowledge in this area? Check out our training led by experienced EITT instructors.