The new Czech Cybersecurity Act (NIS2): does it apply to you?

The new Czech Cybersecurity Act (No. 264/2025 Coll.) applies to you if you are a medium-sized or large company and provide a service in a sector listed in the act and in Decree No. 408/2025 Coll. Some digital services are regulated regardless of size. If the act applies to you, you should already have notified the National Cyber and Information Security Agency (NÚKIB, the Czech cybersecurity authority), and you must put security measures in place within one year of the decision on your registration.

Verified as of 30 October 2026: the facts in this article are based on the text of the act, its implementing decrees and the NÚKIB website.

What is the new Cybersecurity Act?

Act No. 264/2025 Coll., on Cybersecurity, is dated 11 June 2025 and has been in effect since 1 November 2025. It repealed the earlier Act No. 181/2014 Coll. and transposes into Czech law the EU Directive (EU) 2022/2555, known as NIS2.

The main change compared with the previous situation is scope. The old act covered mainly critical infrastructure and selected services. The new one covers many more sectors and includes medium-sized companies. NÚKIB estimated that it would apply to roughly 6,000 entities. By 8 February 2026, 4,825 of them had notified.

The act is supplemented by implementing decrees, also in effect since 1 November 2025:

Regulation	What it covers
Act No. 264/2025 Coll.	Who is regulated, notification, obligations, incident reporting, penalties
Decree No. 408/2025 Coll.	Regulated services and assignment to regimes
Decree No. 409/2025 Coll.	Security measures in the higher-obligations regime
Decree No. 410/2025 Coll.	Security measures in the lower-obligations regime

Does the act apply to your company?

Look for the answer in three steps.

1. Do you provide a regulated service?

Section 4 of the act lists the sectors. They include energy, water management, waste management, transport, digital infrastructure and services, financial markets, healthcare, science, research and education, postal and courier services, and the defence and space industries. According to Decree No. 408/2025 Coll., manufacturing, food production, chemicals and public administration are also covered, among others. You will find the specific services and their descriptions in the decree. Do not decide based on the sector name alone.

2. Are you a medium-sized or large enterprise?

Size is assessed according to European Commission Recommendation 2003/361/EC. Put simply: a medium-sized enterprise has at least 50 employees or an annual turnover and balance sheet total above EUR 10 million. A large enterprise has 250 or more employees, or turnover above EUR 50 million and a balance sheet total above EUR 43 million. Check the exact conditions, including how linked and partner enterprises are counted, directly in the recommendation. A group of companies is often assessed as a whole.

3. Is your service one where size does not matter?

Some services are regulated regardless of the provider’s size, for example cloud services, DNS services or trust services. If you operate something like that, the act may apply to you even as a small company.

Our NIS2 self-check gives you a quick first orientation. For a binding assessment, use the guide on the NÚKIB Portal.

What is the difference between the higher and lower obligations regimes?

The act distinguishes two regimes:

• The higher-obligations regime applies to providers that are of considerable economic, social or security importance. Security measures are set by Decree No. 409/2025 Coll.
• The lower-obligations regime applies to all other regulated providers. Measures are set by Decree No. 410/2025 Coll.

Which regime you fall into depends on the type of service and your size under Decree No. 408/2025 Coll. The regime does not necessarily match how important the company considers itself. Always check it against the decree and your registration decision.

Should you have notified NÚKIB already?

If you met the conditions on 1 November 2025, the deadline for notifying your regulated service passed on 31 December 2025. Section 6 of the act sets 60 days from the date the conditions are met.

The 60-day period applies on an ongoing basis, however. If you meet the conditions later, for example by passing 50 employees or starting a new service, you have 60 days from that change to notify. If you find out you should have notified and did not, do not postpone it and file the notification as soon as possible.

What must you put in place, and by when?

After notification, NÚKIB issues a decision on the registration of the regulated service. From delivery of this decision you have at most one year to start complying with security measures and reporting cybersecurity incidents. For companies registered around the turn of 2025 and 2026, the deadline typically falls during 2026 or in early 2027. You will find the exact date from when your decision was delivered.

Entities already regulated under the earlier Act No. 181/2014 Coll. continue to meet their existing obligations without interruption.

Incident reporting

Two deadlines apply to reporting significant cybersecurity incidents:

Deadline	What to file
within 24 hours of detection	Early warning
within 72 hours of detection	Notification – update, initial assessment, indicators of compromise

Reports are filed through the NÚKIB Portal. For the 24-hour deadline to be realistic, you need to know in advance who will detect an incident, who will decide whether it is significant and who will report it. That includes weekends and holiday periods.

Security measures in practice

The specific requirements are set by Decrees No. 409/2025 Coll. and 410/2025 Coll. Regardless of the regime, in practice you cannot do without a few basic building blocks:

• Asset register – a list of the systems, data, devices and suppliers the regulated service depends on.
• Risk analysis – what can go wrong, with what impact, and what you do about it.
• Security documentation – rules, responsibilities and procedures that actually reflect how the company works.
• Incident process – how you detect, assess, report and resolve an incident.
• Supplier management – who has access to your systems and how that is covered in contracts.
• Regular maintenance – the documentation and asset register must still match reality a year from now.

A hypothetical example: a manufacturing company with 120 employees runs its ERP in the cloud, has production lines with their own software and uses an external IT provider. Its asset register must therefore include suppliers and their access rights, not just the servers in the office. The incident process must take into account that the IT provider will be the first to detect an incident.

What are the most common misconceptions?

• “We are small, so it does not apply to us.” For most services size is decisive, but cloud, DNS and trust services are regulated regardless. And linked companies may count towards your size.
• “The notification deadline has passed, so it is too late.” You must notify even after the deadline. And the 60-day period runs anew for anyone who meets the conditions later.
• “We have a year, so we will start in eleven months.” The one-year period runs from delivery of the decision. An asset register, risk analysis and documentation cannot be done properly in a few weeks.
• “Buying documentation templates is enough.” Documentation that does not match how you actually operate will not help you during an inspection or an incident.
• “Security is an IT matter.” The obligations belong to the company as the provider of a regulated service, not just to its IT department. IT implements the measures, but management makes the decisions on risks, suppliers and budget.
• “An external company runs our IT, so they handle it.” A supplier can help you, but the obligations stay with your company. And the supplier itself is part of the risks you must manage.

What penalties does the act set?

Section 59 of the act sets the following maximum fines:

Regime	Maximum fine
Higher-obligations regime	CZK 250,000,000 or 2% of worldwide annual turnover (whichever is higher)
Lower-obligations regime	CZK 175,000,000 or 1.4% of worldwide annual turnover (whichever is higher)

The act also contains other rates, for example CZK 100 million and CZK 50 million, depending on the type of offence. Fines are only one side of the matter. The greater risk for a company is usually the incident itself: production downtime, a data leak or lost customers.

What if you do not have a security specialist?

That is the situation of most mid-sized companies covered by the act for the first time. You often do not need a full-time specialist. You do need someone who prepares the foundations and then keeps them up to date.

There are three options: your own person, an external provider with a documentation package and regular maintenance, or a combination with technology leadership. On the NIS2 and cybersecurity page we describe how we prepare and maintain the asset register, risk analysis, documentation and incident process. If you need broader technology leadership, including supplier selection and architecture, take a look at our Fractional CTO service.

What to do now

• Check against Decree No. 408/2025 Coll. whether you provide a regulated service.
• Calculate your enterprise size under Recommendation 2003/361/EC, including linked companies.
• If the act applies to you and you have not notified, file the notification with NÚKIB without delay.
• Find out when your registration decision was delivered and work out your one-year deadline.
• Appoint a responsible person and a procedure for reporting an incident within 24 hours.
• Build an asset register and a list of suppliers with access to your systems.
• Carry out a risk analysis and draw up a plan of measures based on it.
• Schedule regular reviews of your documentation.

Start with the NIS2 self-check, download the materials in Downloads, or write to us via the contact form and arrange a no-obligation consultation.