A Camera in Ohio, a Licence in Warsaw: Remote Video Monitoring from Poland and the MSWiA Concession

Picture a night shift. At a quarter past three in the morning, Ohio time, a man walks along the fence of a distribution centre outside Columbus, and a camera notices him before anyone else does. The analytics flag the movement, the clip lands on a screen in Kraków, where it is a quarter past nine and the operator is on her second coffee, and she decides, in the few seconds the software gives her, whether she is looking at a burglar or a man who has lost his dog. She is, according to a Polish statute passed in 1997, performing “direct physical protection” of property. She has not left her chair, and she will not leave it until the shift ends.

This is the quiet premise behind a growing line of business: the monitoring centre that watches one country from another. It is also where an American, British or Scandinavian security company planning a Polish subsidiary meets a law written when “signal supervision” meant a radio receiver in the basement of an alarm receiving station. The law has survived the technology remarkably well. What follows is an account of what it demands, where it is open to argument, and which of its conditions investors tend to discover last.

The night shift that the statute calls “direct physical protection”

The statute is the Act of 22 August 1997 on the Protection of Persons and Property, amended many times and most recently by an Act of 29 May 2026, in force since 4 July 2026. Its architecture has not changed in three decades. Protection of persons and property is a closed list of forms, and carrying on any of them as a business needs a concession, which is what Polish law calls a licence granted by a minister, here the Minister of the Interior and Administration, known by its Polish initials as MSWiA. There is one exception, for technical security work on sites that are not subject to mandatory protection (Article 15(2)).

Article 3 of the Act sorts the forms into two families. The first is direct physical protection, which includes guarding, escorting valuables and, in the words of Article 3(1)(b), protection consisting in the continuous supervision of signals transmitted, collected and processed in electronic alarm devices and systems (in the Polish original, “stałym dozorze sygnałów przesyłanych, gromadzonych i przetwarzanych w elektronicznych urządzeniach i systemach alarmowych”). The second is technical security: installing and maintaining alarm systems, locks and safes. The adjective “physical” misleads newcomers. It does not mean a guard on the premises. It means that the protection is performed by people, who watch, decide and react. Installing cameras is technical security and needs no concession unless the site is one the state has declared subject to mandatory protection. Watching the cameras and reacting to threats falls within physical protection, and for physical protection the Act provides no exception from the concession (Article 15(1)).

In the Polish market this is an established category. In a dispute over a tender for the monitoring of intruder alarm signals, the National Appeals Chamber treated the service as direct physical protection under Article 3(1)(b) (judgment of 2 June 2008, KIO/UZP 476/08), and public buyers require an MSWiA concession in tenders for video monitoring and alarm signal monitoring (TED notice 530495-2021, TED notice 85374-2026). The doubts begin only when the building and the client are both abroad.

What the law says, and what it costs to ignore it

Article 49 is a single sentence: whoever carries on a business in the field of security services without the required concession is liable to a fine, restriction of liberty or imprisonment for up to two years. This is criminal law, so the liability is personal. It can fall on the natural persons who conduct the unlicensed activity, in practice those who decide to switch the monitoring centre on and who run it, depending on their role and the circumstances (Criminal Charges: When Your Life Is at Stake). There is a civil shadow as well: a security services contract performed by an unlicensed provider is the first argument an insurer or a dissatisfied client will reach for in a dispute.

On the other side of the ledger sits an administrative procedure. The stamp duty is PLN 616. The application is a form. Before deciding, the minister obtains the opinion of the regional police commander (Article 16(2)), and, by the ministry’s own account, the proceedings take about two months from a complete application, with the caveat that they may take longer. The concession itself is issued only on paper, which in 2026 has a certain charm, and the licensed activity may not begin before the concession is issued and before the start date it specifies. Nobody sensible chooses criminal exposure to save two months (Administrative Law Poland: Proceedings, Appeals, Courts).

Where the Act ends: the sea, the border, and the Atlantic

The Act regulates “the rules of carrying on business in the field of security services” (Article 1(3)) and ties the concession to taking up such a business (Article 15(1)). The connecting factor is therefore the business carried on in Poland, not the location of what is protected, and the Act contains no exemption for premises located abroad. The application must list the addresses where the activity is conducted (Article 17(3)(5)), and the concession itself states the place and the area in which it is exercised (Article 18(1)(4) and (6)). A monitoring room in Kraków is such a place regardless of where the fibre goes.

The 2026 amendment shows, almost in passing, how the legislator thinks about the reach of this law. It added Article 5a, which allows protective measures to extend beyond the boundary of a protected site “from the water side” (ports, artificial islands, subsea cables and pipelines, offshore wind farms), and Article 5b, under which an offshore wind farm may be protected under the Act “also outside the borders of the Republic of Poland”, in the Polish search and rescue zone and the exclusive economic zone. These provisions concern where protective measures may be applied, not the concession, and they decide nothing about a monitoring centre. They do show that when the legislator wanted to carry the Act past the frontier, it did so expressly. About a building across an ocean the Act says nothing. Silence in a statute is not a loophole. It is an invitation to argue (International Private Law).

Three arguments that fail

Investors usually arrive with three reasons why the concession should not apply to them. The first is that the Polish company serves only its parent. The Act knows no exemption for services within a group; the obligation follows the nature of the activity, not the number or the identity of the customers. If the ultimate beneficiaries of the protection are the parent’s clients, the Polish company is a subcontractor in a security chain, not an internal department guarding its own warehouse. The second is that the operators dispatch no patrol and call no police; they merely pass the alert to a team overseas. Article 3(1)(b) speaks of supervising signals, not of intervening; passing on a verified alarm is exactly what every alarm receiving centre does. The third is that the client is foreign, so the Polish state has no interest in the matter. But the Act’s interest was never confined to Polish property. It also controls who runs a security business on Polish soil and who the people doing the work are. Hence the police opinion, the criminal record checks, and the register of qualified workers.

None of the three creates an exemption on its own. Where a Polish centre continuously supervises signals and verifies alerts concerning the safety of persons or property, there are strong grounds for treating it as needing a concession; what decides the matter is what the operators actually do, not where the camera hangs or who pays the invoice.

Two questions that remain open

An honest analysis leaves two questions standing. The first concerns the object. The Act speaks of electronic alarm devices and systems. Is a camera system with no intrusion sensors and no alarm function an alarm system at all? Where video analytics generate alerts and an operator verifies them, it is hard to argue that the system is not an alarm system. Where the cameras merely record and an operator reviews footage after the fact, the argument against the concession gains weight, although that too is a factor in the classification, not a ready exemption.

The second concerns purpose. Protection of property, under Article 2(5), means action to prevent offences against property, to avert the resulting damage, and to keep unauthorised persons off the protected site. An operator who checks that the cameras are working, that the image is sharp and that the recordings are being saved is not protecting property in that sense; she is delivering a technical service (and maintenance of the systems is technical security in its own right, with its own assessment under Article 15(2)). The line between the two functions is thin, and it runs through the job description, the client contract and the response protocol, not through the name of the service on the invoice.

I know of no published court ruling and no ministry position on a Polish centre that monitors premises located exclusively abroad. The two questions therefore have to be argued in a memorandum before the operation goes live, and, where real doubt remains, put to the ministry in writing. The answer will not bind the ministry. It will show how the ministry reads the model, which is worth knowing before the first operator is hired.

The person with the entry

Here is the condition investors learn about last. A limited liability company is granted a concession only if at least one member of its management board, a commercial proxy, or a plenipotentiary appointed to run the licensed activity is entered on the Polish register of qualified security workers, physical or technical (Article 17(1)(2)). Entry on the physical register requires, among other things, citizenship of Poland, another EU member state, Switzerland or an EFTA state belonging to the European Economic Area, an age of at least 21, no conviction for an intentional offence, an untarnished opinion from the local police commander, medical and psychological certificates, and documented training in marksmanship, self defence, intervention techniques and the relevant law (Article 26(3)). A person holding only the citizenship of the United States, Britain or Ukraine cannot be entered on that register by the ordinary route, however many continents of security operations he has run; dual nationality and the recognition of foreign qualifications under Article 26(4) call for an individual assessment.

A company owned from abroad can therefore hold the concession, but before it applies it must have a qualified person inside its structure, which means a citizen of Poland, another EU member state, Switzerland or an EEA state who holds the entry. If the group has no such person, recruiting someone who already holds the entry becomes the critical path of the project. Obtaining the entry from scratch, with the course, the examinations and the police opinion, usually takes longer than the concession proceedings themselves.

The Act accepts an entry from either register, so a director with the technical entry, which is easier to obtain (an age of at least 18, a technical education or a course, a medical certificate, Article 27(2)), formally satisfies the condition. A monitoring centre still needs someone from the physical register, because supervising and inspecting the work of physical security workers who hold no entry is reserved for qualified physical security workers (Article 26(1)(4)), as is organising and leading their teams (Article 26(2)(2)). The operators on the night shift are physical security workers without an entry; whoever supervises and inspects their work must hold one, and that is precisely what a shift supervisor does. A company that designs its structure around the annex to the application rather than around the actual work will satisfy the condition for the concession and break the Act on its first day of business.

Renting a qualification

The market knows the practice of the rented entry: a qualified person appears on paper as the plenipotentiary for the licensed activity and in reality runs nothing. The Act answers with three provisions. The condition of Article 17(1)(2) must be met without interruption (Article 19(1)(5)), the business must supervise the performance of security tasks (Article 19(1)(6)), and allowing a person without an entry to perform reserved tasks is a ground for revoking the concession (Article 22(3)(4)). The ministry may inspect, demand explanations and order irregularities to be removed (Articles 23c, 23d and 24b). For an investor still building a reputation in Poland, losing the concession after a year costs more than the salary of a supervisor with a real entry.

Operators, directors, and a policy worth twenty thousand euro

Operators performing ordinary signal supervision need no entry on the register (reserved tasks under Article 26(1), such as the direct protection of persons or work on sites subject to mandatory protection, are a different matter), but the Act sets conditions for them too: they must be adults with no final conviction for an intentional offence (Article 31). The employer verifies their criminal records (Article 19(1)(7)) and issues each of them a security worker identity card before they start (Article 20(1)(3)). The citizenship restriction applies to the register, not to ordinary operators; a non EU national may work as an operator if he has the right to work in Poland.

Citizenship matters, by contrast, for the board. All other persons entitled to represent the company must be free of convictions for intentional offences and intentional fiscal offences (Article 17(1)(2)). Citizens of the EU, the European Economic Area and states whose nationals enjoy freedom of establishment under agreements with the Union submit declarations under criminal liability; the rest attach certified translations of criminal record certificates (Article 17(5)). An American director of the Polish company therefore needs a certificate from the relevant US authority and a sworn translator, and the time it takes to obtain the document belongs in the project schedule.

Then there is the compulsory liability insurance for damage caused in connection with security services (Article 21a). The absence of a policy is a ground for revoking the concession or narrowing its scope (Article 22(2)(3)). The obligation arises no later than the day before operations begin, and the minimum sum insured for a business starting out is, under a regulation of the Minister of Finance of 9 December 2013, the equivalent of 20,000 euro; the compulsory cover also excludes, among other things, contractual penalties. That is a long way from the exposure under contracts to guard warehouses on the other side of the Atlantic. A policy that meets the statutory requirements closes the subject with the ministry, not with the client.

GDPR: the footage goes home as an export

A Polish company processing video from premises abroad is subject to the General Data Protection Regulation under its Article 3(1), because the processing takes place in the context of the activities of an establishment in the European Union. Where the people on the footage happen to be is irrelevant; a man in Columbus filmed by a camera watched from Kraków is protected by Brussels whether he knows it or not (General Data Protection Regulation | GDPR). Poland has no dedicated statute on video surveillance: the ministry promised one to the Commissioner for Human Rights for years and withdrew the draft assumptions in 2016; since then, cameras have been governed by scattered provisions, chiefly the GDPR. Before a single document is drafted, the chain of roles has to be mapped: the owner of the site is often the controller, the foreign parent a processor, the Polish company a subprocessor, though other arrangements exist. The processing agreement, the security measures and the question of who is responsible for a data protection impact assessment all follow from that map. The formal impact assessment under Article 35 is the controller’s duty; a Polish processor serving a controller outside the Union does not inherit the controller’s obligations, but it has its own, beginning with Articles 28, 30, 32 and 37, including the duty to assist the controller with the impact assessment (Article 28(3)(f)).

Recordings and alerts containing personal data sent from Poland to a parent outside the European Economic Area are a transfer of personal data to a third country; a parent in another EEA state is not a third country, and an alert that contains no personal data is not a transfer of personal data at all. The European Data Protection Board confirmed the classification in its Guidelines 05/2021, using the very example of a processor in the Union returning data to a controller outside it. The first question is whether the transfer is covered by a Commission adequacy decision: the United Kingdom and Switzerland have one, and for the United States the decision covers organisations certified under the EU-US Data Privacy Framework. Otherwise a transfer instrument is needed, usually the standard contractual clauses in the module that matches the parties’ roles. Where the company’s core activity consists of regular and systematic monitoring of people on a large scale, appointing a data protection officer is mandatory (Article 37(1)(b)). None of this stops the project. All of it is cheaper built in at the start than retrofitted after an inspection.

VAT follows the building; the price follows the market

Intuition says that a service rendered to a foreign parent falls under the general business to business rule of Article 28b of the Polish VAT Act and is taxed where the recipient sits. Security services have a rule of their own. Council Implementing Regulation (EU) No 282/2011 lists supervision and security services among services connected with immovable property (Article 31a(2)(b)), and paragraph 158 of the European Commission’s explanatory notes says that security services supplied remotely, without human presence on site, receive the same treatment as services supplied on site, provided that the immovable property is an essential element of the service. The place of supply is then the location of the building (Article 28e). For a centre watching only American premises the result is the same as under Article 28b: no Polish VAT. The difference surfaces the day a Polish or other European site enters the portfolio, when an invoice to the American parent may carry Polish VAT or require registration in another member state. And if what the Polish company supplies to its parent is something other than the protection of identified premises, technical support, say, or the provision of personnel, the general rule returns and the analysis starts again. Polish VAT registration is worth having in any event, because it allows the company to recover input tax on local costs, provided the link between the purchases and the foreign supplies is documented (Article 86(8)(1)) (How to claim a VAT refund in Poland).

The fee charged to the parent must be at arm’s length (Related Parties: A Comprehensive Analysis of Affiliated Entities in International Tax Law). For a service centre the usual model is cost plus a margin, set after an analysis of functions, assets and risks. Formal transfer pricing documentation for a homogeneous service transaction is required, as a rule, once it exceeds PLN 2 million a year, but the arm’s length principle applies from the first invoice. A separate question is whether the way the parent runs the centre from abroad creates a permanent establishment or a fixed establishment of the parent itself in Poland. The mere existence of a subsidiary does not, as the Court of Justice confirmed for VAT in Berlin Chemie (C-333/20), but the practice of management can be a warning sign (Does a Subsidiary Constitute a Fixed Establishment for VAT Purposes?).

The trap at the notary’s desk

Forming a Polish limited liability company, the spółka z ograniczoną odpowiedzialnością or sp. z o.o., is routine (Company Formation in Poland) (Limited Liability Company): share capital of at least PLN 5,000, a management board on which foreign nationals may sit, a registered address, a notarial deed signed by the foreign shareholder’s proxy under an apostilled power of attorney (Apostille) or, for a simple structure, articles concluded in the S24 online system, registration in the National Court Register, known as the KRS, and then the beneficial owners register, VAT registration and registration as an employer. A branch instead of a company does not simplify matters: an entrepreneur from outside the EU and the EEA may open one on the basis of reciprocity unless an international agreement provides otherwise (Act on the rules of participation of foreign entrepreneurs), and it would then be the foreign entrepreneur itself applying for the concession, on the same conditions (Branch of a Foreign Company in Poland).

One thing can stop the project at the notary’s desk. Article 151 § 2 of the Commercial Companies Code provides that a limited liability company may not be formed solely by another single member limited liability company. The Supreme Court held as early as its decision of 28 April 1997, II CKN 133/97, that the prohibition also covers a single member company of foreign law with the features of a sp. z o.o., and that view still prevails, although scholars argue about which law should govern the comparison. The registry court will therefore examine the founder’s legal form, and the label “LLC” decides nothing by itself: a single member LLC whose member is not liable for the company’s debts has exactly the features in question. The ban concerns formation, not the later holding of all the shares, so the project does not fail; it changes sequence, with a genuine second founder holding a minority stake at incorporation or the purchase of an existing company, and the choice depends on the transaction. The legal form and the ownership of the parent are therefore the first questions to ask, before the first draft of the articles, not after.

The articles should also contain from the outset the activity codes the ministry expects for security services (80.01.Z and 80.09.Z under the 2025 Polish Classification of Activities), because only a company already entered in the KRS can apply for the concession.

In what order, and how long

The sequence that keeps risk and time under control runs like this. First, a memorandum settling whether the planned function of the centre falls within Article 3(1)(b), and describing how it might be shaped differently if it does. In parallel, the legal form of the parent and the candidate for the qualified person. Then the formation of the company, which on our estimate takes two to four weeks with complete documents. After entry in the KRS, the concession application: about two months, often more. In the same window, the processing agreement, the insurance policy, the shift work rules and the tax registrations. A realistic planning horizon for a licensed launch is three to four months from the moment the documents and the qualified person are available. If the memorandum concludes that no concession is needed, the centre can start once the company is registered and staffed and the data protection and employment groundwork is in place.

In either case the most expensive mistake is the same one: to switch on the operators first and ask afterwards whether what they do is protection within the meaning of the Act.

Kancelaria Prawna Skarbiec prepares memoranda on the concession requirement, forms Polish subsidiaries for foreign groups and conducts proceedings before the MSWiA. If you are planning a monitoring centre in Poland, the right place to start is the operators’ function, not the application form.

Legal status as at 21 October 2026.

Robert Nogacki

Robert Nogacki is a Polish attorney at law (radca prawny), the founder and managing partner of Kancelaria Prawna Skarbiec (Skarbiec Law Firm), which has operated continuously since 2006.

The law is equal for everyone, but the parties rarely are: on one side stands an organization with time, money, and lawyers, on the other a person with one business, one nest egg, and one life.

Clients rarely come to him with a legal problem. They come with a problem that also has a legal side: an audit that began with a single invoice, money entrusted to someone who has disappeared, a company that has to be passed on before it is too late. Most such matters are decided long before the first letter is written, in decisions made without asking and in deadlines nobody remembered. So he begins by asking how the client got here, not what the client should have done.

He advises entrepreneurs and families from more than a dozen countries, including those whose accounts the tax office has just seized and who do not know what to do tomorrow morning. He defends them in tax audits, customs and fiscal inspections, disputes with the tax authorities, and criminal tax proceedings. He represents victims of investment fraud and Ponzi schemes. He helps families set up family foundations and plan succession, so that a life’s work outlasts a single generation.

Not every case can be won. Every case can be run so that the client knows where they stand. Since 2006 he has represented the victims in the WGI case (Warszawska Grupa Inwestycyjna, the Warsaw Investment Group), one of the longest criminal cases in the history of the Polish financial market, because some things must not be left half finished, even when they take two decades. In the case of the collapsed cryptocurrency exchange Zonda (Zondacrypto, operated by BB Trade Estonia OÜ), he represents several hundred victims in the criminal investigation conducted by Poland’s National Prosecutor’s Office and in the Estonian bankruptcy proceedings.

Kancelaria Prawna Skarbiec is listed in the rankings of Poland’s largest tax advisory firms published by Dziennik Gazeta Prawna and Rzeczpospolita, and it is a four-time recipient (2015 to 2018) of the European Medal awarded by the Business Centre Club and the European Economic and Social Committee. Robert Nogacki publishes regularly, in the press and on the firm’s website, for people who have a problem rather than a law degree, because a legal opinion the client cannot understand protects only the lawyer.

He believes that the best legal advice is the kind that means the client never has to appear in court.