Poland:
What customers expect from suppliers

Poland as a market for South America

Poland has a large food and meat processing industry and many suppliers to the automotive and furniture industries. From South America it mainly buys animal feed such as soybean meal, plus coffee, fruit, juices and wine. IT service providers from Latin America find customers among Polish software companies and corporate head offices that themselves work for clients in Western Europe.

The main port is Gdańsk. It describes itself as the largest container port on the Baltic Sea, and its container terminal is called Baltic Hub. Gdynia and Szczecin-Świnoujście are the other options. Whether your goods go straight to Gdańsk or via a North Sea port depends on the shipping line; ask your freight forwarder.

What is the same across the EU and what applies nationally

Customs and product law are the same throughout the EU. Since May 1, 2026, the trade part of the EU-Mercosur Agreement has been provisionally applied, and that includes shipments to Poland. The details are in the guide to exporting to the EU.

Language, VAT and packaging are national matters. Under the Polish language act, consumer information, labels and instructions must be available in Polish. The standard VAT rate is 23%.

Anyone who places packaged goods on the Polish market must be entered in the BDO register (Baza danych o produktach i opakowaniach oraz o gospodarce odpadami). The register is kept by the regional marshals of the voivodeships, and registration is done online. The obligation usually falls on your importer. Still, check who is responsible under your contract. Since August 12, 2026, the EU Packaging Regulation (EU) 2025/40 applies as well.

NIS2 in Poland

Poland transposed the NIS2 Directive by amending its existing act on the national cybersecurity system (ustawa o krajowym systemie cyberbezpieczeństwa, KSC for short). The amendment of January 23, 2026, was published in the Journal of Laws on March 2, 2026 (Dz.U. 2026 poz. 252) and has applied since April 3, 2026.

Supervision lies with the relevant ministries: the Ministry of Digital Affairs for digital services, the agriculture minister for food and the economy minister for manufacturing, for example. Incidents go to one of three national CSIRTs; for most companies that is CSIRT NASK. The window for applying to be entered in the list of essential and important entities ran until October 3, 2026.

The deadlines: an early warning within 24 hours of detection, a notification within 72 hours and a final report after one month. Existing entities have until April 3, 2027, to set up their security management. Fines can only be imposed from April 3, 2028, but then they can also hit management personally, up to 300% of their pay.

For you as a supplier, Art. 8 of the act is the one to watch. It requires an information security management system that explicitly covers the supply chain. Polish customers are building this until April 2027, and that is when the questionnaires arrive. You can use the time to set up your own ISMS; Sightadel guides you through ISO 27001 step by step and is available in Spanish and Portuguese.

Data protection and supply chain

The data protection authority is the President of the Personal Data Protection Office (Prezes UODO), who oversees the GDPR in Poland. If you process personal data for a Polish customer, you need a data processing agreement, and for data flows to a country without an adequacy decision you also need standard contractual clauses. The EU has adopted adequacy decisions for Argentina, Brazil and Uruguay, so data can flow there without standard contractual clauses. Chile, Colombia, Peru, Ecuador, Paraguay and Bolivia have no such decision.

Poland has no national supply chain law. Many Polish companies, however, supply German customers who apply the German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz) and pass its requirements on to their own suppliers. At EU level, the CSDDD will apply in the future, and for soy, coffee, beef and wood the EUDR applies.

What Polish customers typically ask for

In the food industry, a certificate under IFS or BRCGS is common, because many Polish manufacturers produce for German and French retail chains. For animal feed such as soybean meal, buyers ask for GMP+ or a comparable feed certificate and, since the EUDR, for geolocation data of the fields.

Automotive suppliers often work for German carmakers and must pass their requirements down the chain. If you deliver software, data or prototype parts in that sector, expect to be asked about TISAX. IT service providers receive questionnaires based on NIS2 and ISO 27001. For the part on exposed systems and vulnerabilities, a veyrisk check of your external attack surface provides current evidence.

How to go about it:

1. Ask your Polish customer whether it is entered in the list under the KSC act and by when it will have its security management in place.
2. Clarify who is entered in the BDO register before the first shipment arrives.
3. Check whether your goods end up with a German group, and ask for that group's supplier code of conduct.
4. Provide Polish labels and instructions, or agree on who will produce them.

Where to get help

The trade section of your country's embassy in Warsaw knows importers, trade fairs and tenders. Ask there before you pay for consultants.

FAQ