Services
Fractional CTO / AI lead
Part-time technology leadership for companies that need a CTO, but not a full-time one. Strategy, team, vendors and AI.
Products · NIS2 and cybersecurity
Meet your Cybersecurity Act obligations without an in-house security team
For mid-sized companies and municipalities that fall under the new Czech Cybersecurity Act but have no dedicated security specialist.
What you are dealing with
We are registered, now what
You notified NÚKIB of your service, received the registration decision and the one-year deadline started running. Nobody in the company knows exactly what has to be in place by then.
Your IT administrator has neither the time nor the mandate
Running the network and user accounts takes the whole week. Risk analysis, policies and reporting incidents within 24 hours are a different job that nobody has done before.
The documentation is out of date within six months
A one-off consultancy project ends up in a binder. Then systems, suppliers and people change, and the documents no longer match reality.
What the Act requires
Act No. 264/2025 Coll., on Cybersecurity, has been in effect since 1 November 2025 and transposes the EU NIS2 Directive into Czech law. Thousands of organisations are now regulated: according to NÚKIB (the National Cyber and Information Security Agency), 4,825 organisations had notified their services by 8 February 2026.
A regulated organisation must:
- notify NÚKIB of its regulated service within 60 days of meeting the conditions,
- implement security measures under the decree for its regime (No. 409/2025 Coll. or No. 410/2025 Coll.),
- report cyber incidents – an initial report within 24 hours of detection and a notification within 72 hours, through the NÚKIB Portal.
The Act distinguishes a higher obligations regime (Decree No. 409/2025 Coll.) and a lower obligations regime (Decree No. 410/2025 Coll.). Which one applies to you depends on the type of service and your size, as set out in Decree No. 408/2025 Coll., on Regulated Services.
Key dates
| Date | What happens |
|---|---|
| 1 November 2025 | Act No. 264/2025 Coll. and its implementing decrees take effect |
| 31 December 2025 | Notification deadline passed for organisations that met the conditions on 1 November 2025 |
| Ongoing | 60 days to notify for organisations that meet the conditions later |
| 1 year from delivery of the registration decision | Deadline for implementing security measures and incident reporting |
For most organisations registered around the turn of 2025 and 2026, the deadline for implementing the measures therefore falls in 2026 or early 2027. What counts is the date your decision was delivered.
Who the Act applies to
The Act mainly covers medium-sized and large enterprises (as defined in Commission Recommendation 2003/361/EC) in regulated sectors. These include energy, transport, water and waste management, healthcare, digital infrastructure, financial markets, manufacturing, food production, chemicals and public administration. Some services, such as cloud or DNS, are regulated regardless of the provider’s size. The exact criteria for each service are set out in Decree No. 408/2025 Coll. If you are unsure, start with the NIS2 self-check.
Penalties
Breaches can lead to a fine of up to CZK 250,000,000 or 2% of worldwide annual turnover in the higher obligations regime, and up to CZK 175,000,000 or 1.4% in the lower obligations regime, whichever amount is higher.
What you get
- Assessment of whether, and under which regime (lower or higher obligations), you fall under the Act
- Asset register – an overview of the systems, data, services and suppliers you protect
- Risk analysis with proposed measures and their priorities
- Security documentation under the relevant decree (Decree No. 410/2025 Coll., or No. 409/2025 Coll.)
- Incident process – who reports what to NÚKIB and when, including templates for the initial report and notification
- Implementation plan with deadlines tied to your one-year period
- Monthly maintenance – updates to the register, risks and documentation, checks on how measures are applied
How it works
Week 1
Initial consultation and classification
We go through your services, company size and registration decision. We confirm your regime and the deadline for implementing the measures.
Weeks 2–4
Asset register and risk analysis
Together with your IT and management we list assets, suppliers and threats. The output is a prioritised risk analysis.
Weeks 5–8
Documentation and incident process
We prepare the security documentation and the incident reporting procedure and walk through them with the people responsible.
Ongoing, monthly
Monthly maintenance
We update the register and documentation when things change, watch deadlines and prepare materials for management.
Who it is for
- Mid-sized companies that have notified NÚKIB of a regulated service or are still considering it
- Municipalities and public administration bodies without their own security specialist
- Companies that have grown into the scope of the regulation
- IT managers who need support with documentation and discussions with management
Who it is not for
- Large organisations with their own security team that only need a specialised penetration test
- Companies looking for legal representation in administrative proceedings with NÚKIB
- Anyone who only wants to buy document templates without adapting them
Why work with us
We see security from an operations perspective
We manage the whole SDLC from analysis to operation. We design measures that can actually be followed in day-to-day operation.
Experience leading teams and as CTO
We can explain risks to management and agree concrete tasks with your IT administrator and external suppliers.
Speed through AI-assisted work
Routine parts such as turning an inventory into an asset register or updating documentation go faster with AI tools. A person still reviews every output.
Self-check
Does it apply to you? Find out in 3 minutes
A short questionnaire with an instant result and recommended steps. No sign-up, no e-mail.
Free checklist
Download the free checklist
NIS2: does the new Czech Cybersecurity Act apply to us? + the first 10 steps. A quick test of whether your company falls under Act No. 264/2025 Coll., on Cybersecurity, and the first ten steps if it does. For owners, managing directors and IT managers.
Frequently asked questions
When did the new Cybersecurity Act take effect?
Act No. 264/2025 Coll. took effect on 1 November 2025. It replaced the previous Act No. 181/2014 Coll. and transposes the NIS2 Directive into Czech law.
By when did we have to notify NÚKIB of our service?
Organisations that met the conditions on 1 November 2025 had until 31 December 2025. Those that meet them later, for example as the company grows, have 60 days from the day they met them.
How long do we have to implement the security measures?
At the latest one year from the day the decision registering your regulated service was delivered. Your exact deadline therefore depends on when you received the decision.
How quickly must a cyber incident be reported?
The initial report must be submitted within 24 hours of detecting the incident and the notification within 72 hours. Reports go through the NÚKIB Portal.
What is the difference between the lower and higher obligations regimes?
The higher obligations regime applies to organisations of greater economic, social or security importance and involves more extensive measures under Decree No. 409/2025 Coll. All others fall under the lower obligations regime and Decree No. 410/2025 Coll.
What are the penalties?
Up to CZK 250,000,000 or 2% of worldwide annual turnover in the higher obligations regime, and up to CZK 175,000,000 or 1.4% of turnover in the lower obligations regime. Whichever amount is higher applies.
Will you replace our security manager?
No, we prepare and maintain the materials and processes, but responsibility for managing security stays with you. We help you decide who in the company will take on that role.
Related offers
Services
Legacy system rescue
Migration from MS Access, Excel macros and old PHP to a modern application. Step by step, without downtime, with documentation.
Products
AI Act and AI literacy
AI literacy training, an internal AI policy template and training records for companies where people use ChatGPT, Copilot or Claude.
Free consultation
Tell us what you are working on. We will get back to you and arrange a short call to see whether and how we can help.