NIS2 in Czechia

The law

The Act replaced Act 181/2014 and took effect on 2025-11-01. It took effect on the first day of the third calendar month after publication. The Czech Act does not use the Directive's terms. It sorts providers of a regulated service into a higher regime and a lower regime.

Name

Zákon č. 264/2025 Sb., o kybernetické bezpečnostiAct on Cybersecurity, No. 264/2025 Coll.

Published

2025-08-04

In force

2025-11-01

Text

Read the Cybersecurity Act

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Czechia differs

• § 7(c) Cybersecurity Act Partner and linked enterprise figures do not count when their technical assets are fully separate from the assets that the entity uses for the regulated service.
• § 4(1)(b) Cybersecurity Act Czechia does not use size alone. A provider of a listed service that is significant for society or the economy is in scope at any size. The NÚKIB decree 408/2025 sets the criteria.

Also note

• One entity has one regime. If one service falls in the higher regime, all regulated services of that entity fall in the higher regime.
• The regulated services come from a list in a NÚKIB decree, not from the Directive's annexes.

Registration

The Act calls this step a report of a regulated service. Entities that met the criteria on 2025-11-01 had 60 days, to 2025-12-31. An entity that meets the criteria later has 60 days from that day. NÚKIB then sends a registration decision. Later duties run from the delivery of this decision. The entity reports contact data within 30 days of the decision. Late reporters still must report now.

Portal

Portál NÚKIB

Rule

Fixed deadline

Deadline

2025-12-31

Later entrants

60 days after the rules first apply to you

You need

A login to the NÚKIB Portal. File the form "Ohlášení a správa regulované služby" in the section "Chci vyřídit".

Changes

Report changes to your data within 14 days

Incident reporting

1. 24 hEarly warning
2. 72 hIncident notification
3. 30 daysFinal reportafter the notification

Send the reports to NÚKIB for the higher regime; the national CERT for the lower regime.

The duty starts 1 year after the registration decision is delivered. The higher regime reports every incident that may be intentional. The lower regime reports only incidents with a significant impact. Both reports go through the NÚKIB Portal.

Measures and proof

Essential

Run a cybersecurity audit at least every 2 years and after major changes. If a full audit does not fit, cover the full scope in rolling parts within 5 years. An independent person must do the audit. NÚKIB can also inspect the entity.

Important

The law sets no audit cycle for the lower regime. NÚKIB can inspect the entity. Security roles such as manager and auditor are not required. The entity names 1 person who leads cybersecurity.

The dates, in order

1. 2025-11-01 The Act takes effect and the 60-day reporting window opens
2. 2025-12-31 End of the first reporting window

Duties of management

In the higher regime, the top management sets up a cybersecurity steering committee. The top management also names the security roles. NÚKIB can ban a member of the statutory body from office for at least 6 months. The ban applies when the member seriously or repeatedly breaks duties and so blocks a NÚKIB remedy order.

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

The Act sets the fixed ceilings in CZK: 250,000,000 for the higher regime and 175,000,000 for the lower regime. The EUR figures shown are the Directive amounts. A failure to report contact data costs up to CZK 100,000,000 in the higher regime. The % applies to the turnover of the undertaking, as in the Directive.