Čeština

NIS2 self-check

Are we covered by the Czech Cybersecurity Act (NIS2)?

Start the self-checkFree consultation

Questionnaire

Answer yes / no / not sure. The result appears immediately, no sign-up.

  1. Do you operate in one of the regulated sectors – for example energy, transport, healthcare, financial market, digital infrastructure and services, water or waste management, manufacturing, food, chemicals, postal and courier services?

    The sectors are listed in Section 4 of Act No. 264/2025 Coll. The exact list of regulated services and their descriptions is set out in Decree No. 408/2025 Coll. What counts is the service you actually provide, not the business activity on your trade licence.

  2. Do you have at least 50 employees, or both annual turnover and balance sheet total above EUR 10 million?

    The Act refers to the definition of medium-sized and large enterprises in Commission Recommendation 2003/361/EC. A “yes” here means you are at least a medium-sized enterprise.

  3. Do you have 250 or more employees, or annual turnover above EUR 50 million and a balance sheet total above EUR 43 million?

    This is the threshold for a large enterprise. Size affects whether you fall under the higher or lower obligations regime – but the actual classification is determined by Decree No. 408/2025 Coll. based on the type of service.

  4. Do you provide cloud computing, DNS services or trust services (for example electronic signatures, seals and time stamps)?

    According to available information, some digital infrastructure services are regulated regardless of the provider’s size. Simply using the cloud (for example Microsoft 365) does not count – the question is whether you offer such a service to others.

  5. Are you a public administration body or other public-law entity (an authority, region, municipality, state-established organisation)?

    Public administration is one of the regulated sectors. Which bodies and services are regulated is set out in Decree No. 408/2025 Coll. A private company should answer “no”.

  6. Do you supply IT services, software or other services to organisations covered by the Czech Cybersecurity Act?

    Even if you are not regulated yourself, regulated customers may require a certain level of security from you in their contracts.

Who the Act applies to

The Act regulates service providers in sectors listed in the Act and in Decree No. 408/2025 Coll. on regulated services – among others energy, transport, water and waste management, digital infrastructure, financial markets, healthcare, manufacturing, food, chemicals and public administration.

Size criterion: typically medium-sized or large enterprises as defined in Commission Recommendation 2003/361/EC (in simple terms at least 50 employees, or turnover and balance sheet total above EUR 10 million). Some services, such as cloud, DNS or trust services, are regulated regardless of size.

The Act distinguishes a higher-obligation and a lower-obligation regime. Those who meet the conditions must notify NÚKIB within 60 days; security measures and incident reporting must then be in place within 1 year of receiving the registration decision.

Frequently asked questions

By when do we have to register with NÚKIB?

The notification must be filed within 60 days of the day the company met the conditions. For entities that met them on 1 November 2025, the deadline expired on 31 December 2025; if you missed it, file as soon as possible.

What are the incident reporting deadlines?

An initial incident report is due within 24 hours of detection and a more detailed notification within 72 hours. Reports are filed via the NÚKIB Portal.

What are the penalties?

Up to CZK 250 million or 2% of worldwide annual turnover in the higher regime, and up to CZK 175 million or 1.4% in the lower regime – whichever is higher.

Is the self-check result binding?

No, it is an orientation tool. What counts is an assessment under the Act and Decree No. 408/2025 Coll.; we also recommend going through the guide on the NÚKIB portal.

Products

NIS2 and cybersecurity

Asset register, risk analysis, security documentation and incident process under Czech Act No. 264/2025 Coll. As a one-off project or with monthly maintenance.

Want to discuss your result?

In a consultation we go through your situation and propose next steps.

Free consultation