News · Poland · 11 November 2026

Poland's president must decide by 13 November on a closed register of blocked domains

President Karol Nawrocki has until Friday 13 November 2026 to decide on a law that lets Poland's telecom regulator UKE put whole domains into a register of sites used to spread illegal content. Under the text the Sejm passed in October, every internet provider would then have 48 hours to block a listed domain in its DNS (the "address book" that turns a domain name into a server address) and send visitors to a UKE notice page. Only UKE, the broadcasting council KRRiT and the providers may see the register. As of 11 November 2026 the president had not announced a decision, and the law had not been published.

Sources: wnp.pl, 10 November 2026 · PAP via Portal Samorządowy, 5 November 2026 · Act of 8 October 2026, text passed by the Sejm before Senate amendments, article 11n · Journal of Laws 2026, list of published acts, checked 11 November 2026

What the law does

• Orders first, register last. Police, prosecutors, the tax administration KAS, rights holders and users (and the Border Guard, for trafficking and illegal border crossing) can ask UKE (or KRRiT, for video platforms) to order specific illegal content blocked. The list of offences is closed. It includes fraud, child sexual abuse material, threats, copyright and trademark infringement, illegal gambling and some tax and excise offences. For hate speech and promoting totalitarian regimes, UKE does not decide itself but passes the case to a court.
• When a whole domain goes in. Only if there is no effective way to enforce the order, and then only if the site is used constantly or mainly to spread illegal content, blocking just the page is technically impossible or plainly useless, or the service provider the order was sent to ignores it after a final warning with at least 24 hours to comply. Even then, UKE may list the domain but does not have to.
• What providers must do. Every company that sells internet access must remove the listed name from its DNS within 48 hours, send visitors to a UKE notice page, and restore access within 48 hours after the entry is removed. They do this free of charge.
• What the register holds. Only the domain name and the date and time of entry or removal. Poland's freedom-of-information law does not apply to it.
• How to challenge it. In the text the Sejm passed, there is no appeal inside the administration. A party to the case (the applicant, the service provider the order was sent to, or the user who posted the content if they joined the case) can file an objection to the decision with an ordinary court within 14 days of receiving it. UKE removes the domain when that decision is overturned or changed.

Source: Act of 8 October 2026 amending the act on providing services electronically, text passed by the Sejm before Senate amendments, articles 11a, 11n and 11p (copy downloaded 8 November 2026; the Sejm API was unavailable on 11 November; press reports describe the other Senate amendments as technical, but article numbers may change in the final text)

The Sejm passed the law on 8 October 2026 with 242 votes for, 61 against and 136 abstentions. The Senate added 10 amendments on 13 October, and on 22 October the Sejm accepted 9 of them. According to PAP, they shorten the time before the law takes effect to three months after publication and make more decisions, such as those on content urging suicide or murder, enforceable immediately, even before any appeal. The law reached the president on 23 October.

Sources: PAP via farmer.pl, 9 October 2026 · Legalis via lex.media.pl, October 2026 · PAP via farmer.pl, 23 October 2026 · PAP via Portal Samorządowy, 5 November 2026

Who is for it and who is against

Nawrocki vetoed an earlier version on 9 January 2026, saying he could not sign a law that "in practice means administrative censorship". In a mid-October interview he said he had nothing against removing sites where children were harmed, but rejected a law that lets an official decide which content is good. On 8 October the head of his office, Zbigniew Bogucki, said the new text differs little from the vetoed one, and that the president would sign a good law. In July the Supreme Court warned of a high risk of excessive blocking of legal sites and speech. The digital rights foundation Panoptykon asks the president to sign: in its view, nobody gets a "red button" to block content. We found no Polish outlet that predicts the outcome.

Sources: PAP via Portal Samorządowy, 9 January 2026 · Dziennik.pl (PAP), 15 October 2026 · PAP via Bankier.pl, 9 October 2026 · Infor.pl, 17 October 2026 · wnp.pl, 10 November 2026

What happens next

• Signed by 13 November. The law is published in the Journal of Laws and takes effect three months later. If it is published in November 2026, that means around February 2027. Before the register can work, UKE has to build the system that sends entries to providers; the business group Lewiatan said in July that UKE and providers would need more time to prepare.
• Vetoed. The law goes back to the Sejm. It survives only if the Sejm passes it again by three fifths of the votes, with at least half of all members present. Otherwise the law falls, and the blocking orders and the register do not come into force.
• Sent to the Constitutional Tribunal. The 21-day deadline stops. The Constitution sets no deadline for the Tribunal's ruling. If the Tribunal finds the law constitutional, the president must sign it. When the president sent a fuel windfall tax to the Tribunal in July, Finance Minister Andrzej Domański wrote that the president had himself paralysed the Tribunal.

Sources: Constitution of Poland, article 122 · PAP via farmer.pl, 23 October 2026 · CyberDefence24, 16 July 2026 · Polsat News, 24 July 2026

A second closed register is waiting in the Sejm

A separate government bill (Sejm print 2697), filed on 9 June 2026, would make UKE keep a second closed register: pornographic sites that do not check visitors' age. Providers would block them the same way, within 48 hours. Unlike the content law, this bill warns the domain holder first, gives at most two working days to respond, and lets the holder object to UKE, which decides within 14 days. It would take effect 12 months after publication. Its first reading in committee was on 1 July 2026. Prawo.pl reported on 1 August that no date was set for the next step, and we found no later step.

Sources: Sejm print 2697, articles 5, 6, 14 to 17 and 37 · Prawo.pl, 1 August 2026

What it means for site owners: our forecast

This part is our assessment, based on the law's text and on how Polish providers handle blocking orders today.

• You will not see the list, but you may see the warning. Nobody outside UKE, KRRiT and the providers can check the register. Before a domain goes in because a host ignored an order, the final warning is published on the regulator's website, and decisions are published too. In the text the Sejm passed on 8 October, UKE has no duty to notify the domain's owner as such: the order and the final warning go to the service provider they were addressed to, which may or may not be the owner. The text sets out no separate way to challenge the entry itself; the route is the 14-day court objection against the decision, open only to the parties to the case. The final text with the Senate amendments was not yet available on 11 November.
• Expect a notice over http, an error over https. Under the telecom law, UKE can already order providers to block traffic on security grounds, without prescribing how, and blocked names already look different from one provider to the next. For the Russian state news site ria.ru, public measurements from November 2026 show Orange's DNS answering that the domain does not exist and a Plus mobile phone getting no address at all. The new law instead names one UKE notice page, like the Finance Ministry's gambling register does. For gambling domains, public measurements show Orange and Plus pointing listed names to the Ministry's server. Yet over https (the padlock in the browser), the connection to that server hangs, and the visitor sees an error, not the notice. We expect the UKE register to work the same way: a notice over plain http, an error over https. CERT Polska's phishing list works differently again: providers point listed names to CERT's warning page or their own, and an Orange customer on https sees a certificate warning.
• Every provider, not just four. CERT Polska's phishing list is voluntary; the agreement to apply it was signed by Orange, Play, Plus and T-Mobile. This law binds every access provider, small ones included. Each has 48 hours, so in the first two days your domain may work on one network and fail on another.
• Shared names, not shared servers. A DNS block hits a name, not an IP address, so sites that only share an address on a CDN (a shared network of servers that delivers many sites) with a blocked domain should not be caught. The risk is a shared name: if your shop lives under a platform's domain and that platform ignores an order, the platform's domain could be listed. The law does not say whether a listed name also covers the names under it.
• What to watch. UKE's and KRRiT's published orders and warnings, the Journal of Laws for the publication date, and how your domain answers through each provider's DNS, not only from a data center.

Sources: Act of 8 October 2026, Sejm text, articles 11m, 11n and 11p · Electronic Communications Law, article 53 · Globalping, 8 November 2026 · OONI, Plus, 5 November 2026 · Globalping, Orange, gambling domain, 8 November 2026 · OONI, Plus, gambling domain over https, 4 November 2026 · CERT Polska, warning list, updated 2 September 2026 · CERT Orange Polska, updated 3 July 2026

linkspect already opens a URL through Orange, Play, Netia and T-Mobile home connections and Play and Plus mobile connections, and tells you per provider whether the page opens and, if not, what stopped it.

How blocking works in Poland · Why datacenter monitors miss ISP blocks