- Regulations and implementation timelines
CSRD (Corporate Sustainability Reporting Directive) 鈥� EU: reporting from 2025 (for the 2024 financial year); additional groups covered progressively until 2029 - NIS2 (Network and Information Systems 2 Directive) 鈥� EU: in force since 2023; Poland: early 2026
- DORA (Digital Operational Resilience Act) 鈥� EU: full application from 17 January 2025
- AI Act (Artificial Intelligence Act) 鈥� EU: in force since 2024; key obligations applicable between 2025 and 2027
Compliance with EU requirements is not only an obligation but also an opportunity to strengthen a company's market position. ESG reporting under the CSRD, along with compliance with NIS2 and DORA requirements. It helps build trust among customers and investors, who increasingly expect responsibility and security from their business partners. Companies operating in accordance with regulatory requirements are perceived as less risky, which facilitates access to financing and may provide a competitive advantage. At the same time, implementing standards ahead of mandatory deadlines minimises the risk of penalties and reputational damage.
Failure to comply with EU regulations carries both financial and reputational risks. Enterprises that ignore obligations resulting from the CSRD, NIS2, DORA or the AI Act may face administrative penalties. A lack of transparency in ESG reporting reduces credibility in the eyes of investors, making access to financing more difficult and potentially leading to customer losses. Non-compliance with cybersecurity regulations increases the risk of incidents that may disrupt operations and result in data loss. In the longer term, a lack of compliance entails not only the risk of penalties but also the loss of competitive advantage and reputation, the rebuilding of which can be both costly and time-consuming.
The question is whether Polish enterprises will be able to develop and implement measures enabling them to comply with these standards without harming their business operations. From an operational management perspective, following several principles familiar to the vast majority of managers may prove helpful.
The first is the allocation of responsibility for processes. If it is not clear who owns a particular risk, no one is actually managing it. Assigning ownership of risks enables, among other things, process mapping using BPMN (Business Process Model and Notation) diagrams and the development of Standard Operating Procedures (SOPs). This makes it possible to determine who is responsible for each stage of a process.
The second principle is the implementation of appropriate process measurement systems. If we cannot monitor our activities, we are unable to measure progress in implementing improvement measures. Developing and introducing metrics and Key Performance Indicators (KPIs) makes it possible to assess the effectiveness of actions, identify areas requiring improvement and respond quickly to deviations from established objectives.
The third principle is repeatability. If management reviews are not conducted regularly, the system loses its effectiveness. Ensuring compliance with regulatory requirements can be treated either as an implementation project or as BAU (Business As Usual) 鈥� an element of everyday operational activity that does not disappear once implementation is complete and to which organisations must continuously adapt.
EU regulations such as the CSRD, NIS2, DORA and the AI Act are becoming an integral part of doing business in Poland and across the European Union. Their implementation requires not only process adjustments but also a change in the approach to risk management and reporting. Compliance with these requirements creates opportunities to build customer and investor trust, improve operational efficiency and achieve a competitive advantage. Conversely, non-compliance is associated with the risk of penalties, reputational damage and restricted access to financing. It is therefore essential that companies treat regulatory compliance as a component of their day-to-day operations, one that supports stable growth and the security of business activities in the long term.
Source: Dr Piotr C. Sosnowski, Department of Logistics, Faculty of Management, Faculty of Management
Edit: