WSK, i.e. the internal system for the control and management of trade in arms, is a statutorily required and certified system of procedures of an entrepreneur trading in arms with foreign countries. The same abbreviation is also colloquially used for the voluntary procedures by which manufacturers and distributors of dual-use items control to whom and for what purpose the goods are supplied. In public procurement, WSK most often comes up in deliveries of network and cryptographic equipment (e.g. firewalls and VPN devices), drones or arms. The contracting authority then usually acts as the end user, and the distributor often makes the release of the goods conditional on the contracting authority signing an end-user statement. This requirement usually stems from suppliers’ contracts and procedures rather than directly from statute.

What are strategic goods?

Strategic goods are dual-use items or arms (Article 3(3) of the Act of 29 November 2000 on foreign trade in goods, technologies and services of strategic importance for state security and for the maintenance of international peace and security, hereinafter: the Act). Dual-use items are items, software and technologies which have civilian uses but may also serve military purposes.

The rules of trade are laid down in two acts. The first is Regulation (EU) 2021/821 of the European Parliament and of the Council, which sets up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items, and contains a list of controlled items in Annex I. The second is the Act (consolidated text: Journal of Laws of 2023, item 1582), amended by the Act of 13 March 2026 (Journal of Laws of 2026, item 471; government bill – print no. 2119).

The amendment has been in force since 22 April 2026. It aligned the references to Regulation 2021/821, introduced a legal basis for the electronic submission of applications and for a register of licences kept in an ICT system (this system is referred to as Tracker 2.0), and settled that individual and global licences for dual-use items are valid for no longer than 2 years (Article 14(5b)). From 8 October 2026, the trade records also include the number of the licence on the basis of which the trade was carried out (Article 25(2)(7)).

In tendering practice, the most frequently encountered group is equipment from Category 5 Part 2 (“Information Security”), i.e. equipment using cryptography. However, not every such device is a controlled item, because many mass-market firewalls and VPN devices are excluded from control by the so-called cryptography note (Note 3 to Category 5 Part 2 of Annex I to Regulation 2021/821). Whether a specific model is a controlled item is determined by its classification according to the control number. This information is provided by the manufacturer or distributor, and it is worth asking for the classification according to the EU control number and not only according to the US ECCN.

What is WSK and who must apply it?

The statutory obligation to establish and apply WSK rests on an entrepreneur who applies for a licence to trade in arms or uses a national general licence for such trade (Article 11(1) of the Act). The Act calls it the internal system for the control and management of trade in arms, so in the statutory sense WSK concerns arms only. The system defines, among other things, the tasks of the company’s bodies, the basic tasks at individual job positions, the rules for selecting employees, data archiving, internal control and order fulfilment, as well as training (Article 11(2)).

WSK is subject to certification of compliance with ISO 9000 standards, carried out by authorised accredited bodies specified in a ministerial regulation (Article 11(3), (4) and (8)). The certificate is valid for 3 years, and during this period the body carries out 3 inspections at the entrepreneur (Article 11(6) and (7)). From 22 April 2026, a copy of the certificate is also attached to the statement on commencing trade in arms on the basis of a national general licence, which is submitted at least 14 days before the trade begins (Article 8(3)).

Manufacturers and distributors of dual-use items often apply similar procedures voluntarily, as an internal compliance programme, and these are also colloquially called “WSK”. It is these procedures, and often also US export regulations (EAR) and contracts with the manufacturer, that give rise to the requirement of an end-user statement in domestic sales.

Irrespective of the above, every entity carrying out trade within the meaning of the Act (including export, import and intra-EU transfer) keeps records of it and retains the record documents for 5 years from the end of the calendar year in which the trade took place (Article 25(1) and (3) of the Act). A domestic sale is not trade within this meaning (Article 3(8)), so this obligation does not cover a contractor who buys the goods from a Polish distributor.

WSK in public procurement – what follows from it

The Public Procurement Law (PPL) does not regulate WSK directly, but the rules on trade in strategic goods affect the procedure and the performance of the contract at three points.

1. The contracting authority as the end user.

The Act defines the end user as an entity declaring the use of strategic goods for its own activity (Article 3(8g)). In a delivery to a public entity, this is usually the contracting authority itself, not the contractor. Therefore, it is the contracting authority that signs the end-user statement, in which it indicates the intended use of the goods and usually undertakes not to transfer them further without consent. In a domestic purchase, the Act does not impose on the contracting authority an obligation to sign such a statement, but the entity bringing the goods into Poland needs this information, because its notification to the Internal Security Agency (ABW) must indicate the end user and the manner of use of the item (Article 21c(1)(3) and (5)).

2. Notification to the ABW for cryptographic equipment.

The import or intra-EU transfer into Poland of items from Category 5 Part 2 (“Information Security”) and from entries 5A001a and 5A001b4 of Part 1 (“Telecommunications”) is subject to monitoring by the Head of the ABW (Article 21a of the Act). The entity bringing in the goods must notify this intention in writing, and the notification must be delivered no later than 14 days before the planned date of import or transfer (Article 21b(1) and (4)). Units subordinate to the Minister of National Defence also notify the import to the Head of the Military Counterintelligence Service (SKW) (Article 21b(3)). The notification includes, among other things, the end user and the manner of use of the item (Article 21c(1)), and failure to notify is subject to a financial penalty of up to PLN 100,000 (Article 37a).

The ABW must be informed of any change in the data covered by the notification within 14 days of its occurrence, and failure to comply with this obligation is punishable by a fine (Article 21c(2) and Article 35a). This obligation applies accordingly to the acquirer to whom ownership of the item covered by the notification has been transferred, so it may also concern the contractor or the contracting authority (Article 21c(3)). The notification deadline must be taken into account in the delivery deadline where the goods are to be brought in for the purposes of the contract. If they are already in stock at a domestic distributor, the delivery to the contracting authority itself does not require a new notification.

3. Requirements for contractors.

Where the subject matter of the contract is trade in arms, the contracting authority may require a licence (koncesja) or a WSK certificate under the condition concerning the authorisation to conduct a specific activity, provided that they result from separate provisions (Article 112(2)(2) PPL). Such an authorisation is above all a licence to trade in arms (Article 7(1) of the Act of 13 June 2019 on conducting business activity in the manufacture of and trade in explosives, weapons, ammunition and products and technology for military or police use). The WSK certificate, on the other hand, is a requirement related to obtaining a licence for foreign trade in arms (Article 9(6)(3) and Article 11(1) of the Act), so requiring it calls for careful justification. In the case of a delivery of IT equipment available from domestic distributors, such a requirement could be considered disproportionate (Article 16 and Article 112(1) PPL); the situation may be different where the contract requires import by the contractor (see the questions at the end of the article). It is better to describe in the procurement documents the obligations of the parties relating to the end-user statement.

How to prepare in practice?

A contracting authority that buys equipment which may constitute strategic goods should take care of four issues:

1. Check whether you are buying controlled items – do so already at the stage of preparing the description of the subject matter of the contract, especially for firewalls, UTM devices, encryptors, drones or thermal imaging cameras;
2. Provide for the end-user statement in the contract – in the draft contractual provisions, set out the obligation to sign it within a specified time limit;
3. Agree with the contractor who notifies the ABW of changes – this concerns the situation in which, as a result of the delivery, you become the acquirer of an item whose import has been notified (Article 21c(3) of the Act);
4. Plan a realistic performance deadline – take into account the time needed for formalities on the distributor’s side and the 14-day deadline for notification to the ABW, if the goods are to be brought in for the purposes of the contract.

The contractor and the subcontractor, in turn, should remember the following steps:

1. Ask the distributor before submitting the bid – establish which items require an end-user statement and what its template is;
2. Request that the contract template be supplemented – the contract template imposed by the contracting authority cannot, as a rule, be negotiated (the exception being procedures with negotiations), but if it does not regulate the end-user statement, request before the bid submission deadline that it be supplemented with a time limit for signing the statement, an extension of the delivery deadline and an exclusion of penalties for the period of delay. A request for clarification of the terms of reference (SWZ) is submitted under Article 135 PPL in an open tender and under Article 284 PPL in the basic procedure. The contracting authority must respond to it if it was received, as a rule, no later than 14 days (in the basic procedure 4 days) before the bid submission deadline, but it is not obliged to amend the SWZ (Article 137(1) and Article 286(1) PPL);
3. Do not miss the appeal deadline – if the contract template shifts the risk of a missing statement onto the contractor, consider an appeal to KIO against the draft contractual provisions (Article 513(1) PPL). The argument is Article 433(3) PPL, according to which the contract may not provide for the contractor’s liability for circumstances for which the contracting authority bears exclusive responsibility, and, in a supporting role, Article 433(1) PPL, which as a rule excludes the contractor’s liability for mere delay. An appeal against the content of the procurement documents is lodged within 10 days (for contracts with a value equal to or exceeding the EU thresholds) or 5 days (below the thresholds) of their publication on the website (Article 515(2) PPL). A response in which the contracting authority maintains the existing wording is not an amendment of the SWZ and, as a rule, does not open a new time limit, so it is not worth waiting for the request for clarification to be resolved before lodging an appeal;
4. As a subcontractor, negotiate the contract with the contractor – in the subcontract, which is not imposed by the contracting authority, you can negotiate the contractor’s obligation to secure the end user’s signature, an extension of the deadline, an exclusion of penalties and a right of withdrawal with respect to the device if the end user refuses to sign;
5. Keep the documentation – it is worth keeping statements and documents relating to the delivery for at least 5 years; as a statutory obligation (Article 25 of the Act), however, this applies only to the entity that itself carries out the import, intra-EU transfer or export.

Summary

In the statutory sense, WSK concerns only foreign trade in arms. In typical deliveries of IT equipment in public procurement, in practice it is about distributors’ procedures and the end-user statement, and in the case of cryptographic equipment brought in for the purposes of the contract – also about notification to the ABW. The contracting authority should take these requirements into account in the procurement documents and in the performance deadline, and the contractor should verify them with the distributor before submitting the bid and, if necessary, ensure that the contract template is amended before the appeal deadline expires.

Frequently asked questions

Does the purchase of a firewall by a municipality require a licence?

No. A licence is, as a rule, required for export outside the EU, not for a domestic sale. The import or intra-EU transfer into Poland of dual-use items does not require a licence (Article 6c of the Act), but controlled cryptographic equipment is subject to notification to the ABW. However, many mass-market firewalls are not controlled items at all. The distributor may nevertheless require an end-user statement.

Who signs the end-user statement in a tender?

The entity that will actually use the goods – usually the contracting authority. The contractor and the subcontractor are suppliers in this chain, not end users.

Does the lack of a statement justify a delay in delivery?

It may, even where the contract does not regulate this issue expressly. A contractual penalty for delay is due only if the delay results from circumstances for which the contractor is responsible (Article 476 of the Civil Code (CC)). The contracting authority is also obliged to cooperate in the performance of the contract (Article 431 PPL), and the contract may not, as a rule, provide for the contractor’s liability for mere delay (Article 433(1) PPL). However, the burden of proving that the cause lies with the contracting authority rests with the contractor (Article 471 CC), which can be difficult in a dispute, so it is worth regulating this issue in the contract.

Can the contracting authority require a WSK certificate from every contractor?

No. A WSK certificate is statutorily required from an entrepreneur applying for a licence for foreign trade in arms or using a national general licence for such trade. In the case of a domestic delivery of IT equipment, the Act does not require it from the contractor, so a requirement to provide the certificate must be justified by the subject matter of the contract and proportionate (Article 16 and Article 112(1) PPL).

And what if the equipment is to be brought in from abroad?

The import and intra-EU transfer of dual-use items do not require a licence (Article 6c of the Act), and controlled cryptographic equipment is merely notified to the ABW. A WSK certificate is not a statutory condition here. The situation changes when the authorities of the state of the foreign exporter or foreign supplier, including from another EU Member State, require a Polish import certificate or a certified end-user statement. The trade control authority may refuse to issue them to an entity that does not apply WSK (Article 22(1) and (6) of the Act), and from 22 April 2026 the refusal is made by way of an administrative decision.

For the import of arms, a licence, and therefore also WSK, is mandatory (Article 6a(1) and Article 11(1) of the Act), and trade in arms as a rule also requires a licence (koncesja). Requiring a WSK certificate may therefore be justified where the contract by its nature requires such import by the contractor, but not where the goods are available from domestic distributors.

The above material is for information and educational purposes only – it does not constitute legal advice or an opinion on a specific case. Assessment of a specific factual situation requires individual analysis.

Dominik Styczyński – attorney-at-law (radca prawny), public procurement law expert representing contractors and contracting authorities before the National Appeals Chamber (KIO)