What EU law requires of employees, article by article

Employee training is written into binding European law, and the instruments stack.

• NIS2 (Directive 2022/2555) lists basic cyber hygiene practices and cybersecurity training among the ten mandatory risk-management measures in Article 21(2)(g), requires policies and procedures to assess the effectiveness of those measures in Article 21(2)(f), covers supply-chain security in Article 21(2)(d), and requires members of management bodies to follow cybersecurity training in Article 20(2).
• GDPR (Regulation 2016/679) requires the controller to be able to demonstrate compliance (Article 24(1)) and, in Article 32(1)(d), a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures.
• DORA (Regulation 2022/2554), Article 13(6), requires financial entities to develop ICT security awareness programs and digital operational resilience training as compulsory modules in their staff training schemes, and to make them available to management.
• The EU AI Act (Regulation 2024/1689), Article 4, has required providers and deployers to ensure a sufficient level of AI literacy among their staff since February 2, 2025.
• ISO/IEC 27001:2022 is a standard, not law – but it is the certification many European buyers ask for. Control A.6.3 covers information security awareness, education and training; clauses 7.2 and 7.3 cover competence and awareness.

NIS2 is a directive, so the operational detail comes from national transposition. Poland's amended National Cybersecurity System Act (KSC 2.0; Journal of Laws 2026, item 252) entered into force on April 3, 2026 and states the frequency in the statute itself: annual, documented cybersecurity training for all employees and for the head of the entity. The Ministry of Digital Affairs estimates 38,000–42,000 entities in scope.

Poland's Timeline: Obligations Now, Penalties From 2028

The dates are fixed. The obligations took effect on April 3, 2026. Self-identification and entry into the KSC register close on October 3, 2026. The information security management system has to be operational by April 3, 2027. The first mandatory audit, and financial penalties for most administrative obligations, start on April 3, 2028. Penalties run up to €10 million or 2% of annual turnover for essential entities, and the head of the entity can be fined personally up to 100% of their remuneration.

Two years without penalties is not two years without exposure. Reporting duties and the incident itself do not wait for the sanction regime, and a supervisory authority examining an incident asks for documentation that has to exist already.

Train, Then Prove It Worked

Three of the instruments above ask for more than a completed course. NIS2 Article 21(2)(f) requires policies and procedures to assess the effectiveness of risk-management measures. GDPR Article 32(1)(d) requires a process for regularly testing, assessing and evaluating effectiveness, and Article 24(1) requires the controller to be able to demonstrate it. DORA Article 13 places awareness programs inside a cycle of incident analysis and lessons learned. ISO/IEC 27001 runs on Plan-Do-Check-Act. An attendance sheet answers none of them.

How Practical Anti-Phishing Training Helps Organizations Meet These Requirements

Each provision above turns into something an organization has to run, document and be able to show. The platform is built around those three verbs.

• Training that repeats (NIS2 Article 21(2)(g) and Article 20(2); DORA Article 13(6); ISO/IEC 27001 A.6.3). Realistic phishing, smishing, Microsoft Teams and AI vishing simulations run as a continuous program rather than an annual course, covering all employees and the management body. An employee who falls for a simulated attack gets a nano-lesson explaining the technique immediately, at the moment of failure.
• Scenarios matched to risk (GDPR Article 32(1); DORA Article 4, the proportionality principle). Campaigns are tailored to specific roles, departments and levels of exposure – finance, HR, sales – so an organization can show that its training reflects the risk it actually carries, rather than one generic campaign for everyone.
• A reporting path that works (GDPR Article 33; DORA Article 17; ISO/IEC 27001 A.6.3). A one-click report button in Outlook and Gmail makes flagging a suspicious message routine and gives the incident-handling process a signal it would otherwise never receive. The 72-hour notification clock under GDPR starts when a breach is detected, and detection usually starts with an employee.
• Evidence of effectiveness (NIS2 Article 21(2)(f); GDPR Article 24(1) and Article 32(1)(d)). The platform measures click rate by role and department, reporting rate, time-to-report – how long it takes before the first employee flags the attack – and the trend across successive campaigns. Clicks from proxies, sandboxes and mail filters are filtered out through a denylist, because an unfiltered report counts machines as employees. In one program, the click rate fell from 42% to 5% over eight months.
• Documentation an auditor can read (KSC 2.0 audit duty; DORA Articles 6, 13 and 17; ISO/IEC 27001 Plan-Do-Check-Act). Results export as a board-ready report for an auditor or a supervisory authority, which is what turns a training activity into a documented control.

Practical Anti-Phishing Training helps organizations meet the security awareness requirements of these regulations. It does not replace a legal assessment of which obligations apply to a given entity.

Boilerplate + CTA

SECAWA is a European cybersecurity company founded in Poland in 2019. For seven years we have built cyber-resilience for government institutions and enterprises in Poland and across the European Union, training more than 120,000 employees on three continents. Practical Anti-Phishing Training is our own platform: realistic phishing, smishing, Microsoft Teams and AI vishing simulations, a nano-lesson the moment someone fails, one-click email reporting in Outlook and Gmail, and board-ready reporting.

Meet us at Cyber Security World Asia, part of Tech Week Singapore, September 29–30, 2026, Sands Expo & Convention Centre. Ask us for a Free Phishing Test in your own organization.

Piotr Kaźmierczak, Founder & CEO · piotr.kazmierczak@secawa.com · +48 662 217 783