Poland updates lawful interception interface rules

Publication date: November 10, 2026

10 November 2026

From 11 November 2026, telecommunications undertakings in Poland must meet new technical and operational requirements for the interfaces that give law enforcement and security agencies access to communications and related data. Interfaces already running under existing agreements may stay on the previous standard, but for no longer than 36 months. The new rules add 5G standards, real-time delivery and a dedicated interface for retained data.

Who is affected

The rules concern telecommunications undertakings that perform their statutory duties through an interface agreed with the authorised agencies. This covers mobile and fixed operators, internet access providers and VoIP providers.

The duty itself comes from the Electronic Communications Law of 12 July 2024. Article 43 requires an undertaking to provide, at its own cost, the technical and organisational conditions for access to and recording of communications and related data. Article 45 adds a duty to prepare the conditions for making processed data available.

An interface is one permitted way of meeting those duties, not the only one. Where it is used, its operation is governed by an agreement between the undertaking and the agencies. That agreement must at least allocate interface costs and set a procedure for failures. Micro and small undertakings perform the duty in proportion to their scale.

The regulation lists nine authorised agencies: the Internal Security Agency (ABW), the Police, the Military Counterintelligence Service (SKW), the Military Gendarmerie, the Border Guard, the National Revenue Administration (KAS), the Central Anticorruption Bureau (CBA), the State Protection Service (SOP) and the Internal Supervision Bureau (BNW).

Two interfaces, two purposes

The Council of Ministers regulation of 29 October 2026 sets requirements for two IP-based interfaces between the operator’s system and the agencies’ monitoring systems.

Interface	Purpose	Components
LI HI (lawful interception)	Access to communications and related data under Article 43	HI1: orders and status messages. HI2: intercept related information and SMS content. HI3: content of communications
HI A-B (retained data)	Delivery of data under Article 45	HI A: requests and their handling. HI B: results of requests

Annex 1 contains the new requirements. Annex 2 preserves the previous standard for interfaces covered by the transition period.

What changes for lawful interception

The new standard moves from file transfer to streamed, real-time delivery and brings 5G into scope.

Area	Previous standard (Annex 2)	New standard (Annex 1)
Intercept related information	Files sent over FTP	TCP streams under ETSI TS 102 232-1
Content of communications in mobile networks	Offline files over FTP, or online mode over SIP	Real-time delivery over TCP, no separate online mode
5G	No 5G standard listed	ETSI TS 133 128 added
Buffering	No fixed period	72 hours
Versions of standards	Fixed versions	Newer versions allowed, and other versions if they perform the duties to no lesser degree
Codecs	Supplied to agencies free of charge	Agency may request them, no reference to cost
Physical layer	Ethernet	Ethernet, or fibre if both sides agree

Several core rules carry over unchanged:

• Intercept related information must reach the agency no later than 10 minutes after the communication ends.
• Orders are executed automatically, without the operator’s staff.
• A semi-automatic mode needs the agency’s consent and gives authorised staff up to 24 hours to prepare the network.
• Activation, modification and deactivation orders carry an electronic signature.
• Data is deleted from the operator’s resources once delivered.

A 36-month transition, with limits

Existing lawful interception interfaces may keep to the previous standard until November 2029 at the latest. The relief has three conditions:

1. It covers LI HI interfaces only.
2. The interface must operate under an agreement concluded before 11 November 2026.
3. It applies only to the telecommunications services covered by that agreement.

A new agreement, or a new service added outside an existing one, falls under the new standard from the start. Operators planning 5G standalone launches or new VoIP products should check which side of the line each service sits on.

Retained data: no transition period

The transitional rule does not mention the HI A-B interface, so the new requirements apply to it from day one. The interface must follow ETSI TS 102 657, use TCP with ASN.1/BER encoding and require an electronic signature. It must be available at a single location for all agencies, with a separate Ethernet port for each.

Some optional features of the ETSI standard are switched off: request priorities, multi-part delivery and the mode in which the agency initiates delivery.

In practice, operators should confirm with the agencies whether and when they expect this interface to be used. During public consultation, an industry chamber stated that neither side had deployed HI A-B under the earlier rules.

Privacy points worth noting

The regulation is technical, but several provisions limit what the operator keeps and discloses:

• Deletion after delivery. The operator removes intercepted communications and related data once they are successfully handed over.
• Limited buffer. Undelivered data is held for 72 hours.
• Excluded data fields. The retained data interface does not carry date of birth, gender, identification number, authentication data, profession or telephony billing details.
• No identifying data in status replies. A reply to a status query contains only the interception identifier.
• Signed orders. Interception orders must carry an electronic signature based on certificates issued within a public key infrastructure.

These points belong in the operator’s records of processing and security documentation.

What operators should do now

1. Map existing agreements. List every agreement with an authorised agency, its date and the services it covers. This decides which interfaces qualify for the transition.
2. Plan the migration. Set a schedule to move legacy interfaces to the new standard before November 2029, with time for testing with each agency.
3. Review vendor contracts. Check whether suppliers of interception and mediation systems are bound to deliver compliance with the new ETSI versions, and who pays.
4. Revisit cost and failure clauses. Agreements with agencies must allocate interface costs and set a failure procedure. The 72-hour buffer and the codec rule are natural points to renegotiate.
5. Clarify the retained data interface. Ask the agencies about their plans for HI A-B, since no transition period applies.
6. Include the topic in transactions. Buyers of Polish telecommunications businesses should treat interface compliance and migration cost as a due diligence item.

KG Legal KIELTYKA GLADKOWSKI advises telecommunications and technology companies on Polish and EU regulatory requirements. Contact: office@kg-legal.pl.