Since 1 November 2025, Czechia has had a new Cybersecurity Act, which transposes the EU NIS2 Directive into Czech law. It replaced the act from 2014, which covered a few hundred organisations: in 2025 the National Cyber and Information Security Agency (NÚKIB) recorded 69 operators of critical information infrastructure, 151 operators of essential service information systems and 194 operators of important information systems. Under the new act, the agency expects more than 6,000 obliged entities.
Sources: Act No. 264/2025 Coll. (in Czech), NÚKIB, Report on the State of Cybersecurity for 2025 (in Czech)
Who does the act cover?
The act regulates services that companies and public bodies provide. The list of regulated services and the criteria are set out in Decree No. 408/2025 Coll. The sector and the size of the business usually decide. The act has two regimes:
- The higher-obligation regime for providers that are of considerable economic, social or security importance (Section 8). These are typically large companies in regulated sectors; some services fall here regardless of size.
- The lower-obligation regime for other regulated providers, typically medium-sized companies.
By 15 January 2026, 4,685 entities had notified NÚKIB, and by the end of July 2026 the figure was 5,864, according to agency data published by Seznam Zprávy. In the higher regime, 1,435 entities were registered by 23 February 2026. Of their services, the largest shares were in energy (25.7%), digital infrastructure (22.4%) and healthcare (21.7%).
Sources: Decree No. 408/2025 Coll. (in Czech), NÚKIB, 15 January 2026 (in Czech), NÚKIB, 26 February 2026 (in Czech), Seznam Zprávy (in Czech)
What deadlines does the act set?
| Obligation | Deadline | Provision |
|---|---|---|
| Notify NÚKIB of a regulated service | within 60 days of meeting the conditions; those who met them when the act took effect, by 31 December 2025 | Section 6(1) |
| Put security measures in place | within 1 year of receiving the registration decision at the latest | Section 13(4) |
| Start reporting incidents under the new act | within 1 year of receiving the registration decision at the latest | Section 15(4) |
The one-year period runs from receipt of the registration decision. Anyone who received it in 2026 must put the measures in place in 2027 at the latest. NÚKIB has to issue more than 6,000 such decisions. Organisations regulated under the 2014 act meet their existing obligations until then and report incidents under the new rules as soon as they receive the decision (Section 71).
Source: Act No. 264/2025 Coll. (in Czech)
What does the act require of companies?
- Report incidents quickly. The first report within 24 hours of detecting an incident. For a significant incident, a notification with an initial assessment within 72 hours and a final report within 30 days of the notification (Section 16).
- Involve management. Requirements for top management are among the mandatory organisational measures (Section 14). In the higher regime, NÚKIB can temporarily bar a member of the statutory body from office for at least 6 months. This happens if they repeatedly or seriously breach their duties when carrying out an agency decision to remedy shortcomings (Section 58).
- Keep an eye on suppliers. When a company implements security measures through a supplier, it must choose the supplier according to the requirements of those measures and write them into the contract (Section 13(5)).
Source: Act No. 264/2025 Coll. (in Czech)
What fines can be imposed?
For most offences, the cap in the higher regime is CZK 250 million or 2% of net worldwide annual turnover, whichever is higher. In the lower regime it is CZK 175 million or 1.4% (Section 59(4)). Some other offences, such as failing to provide contact details, carry lower caps.
Source: Act No. 264/2025 Coll. (in Czech)
What did the first year show?
In 2025 NÚKIB recorded 203 cybersecurity incidents, 65 fewer than a year earlier. Almost half (46%) targeted the availability of services, in other words were meant to stop a system working.
One part of the act does not work yet. Screening suppliers of strategically significant services needs two government regulations, and according to the NÚKIB report from August 2026 both were still in inter-ministerial consultation.
In Europe, Czechia is among the countries that transposed the directive late. The deadline was 17 October 2024, and in May 2025 the European Commission sent Czechia and 18 other countries a reasoned opinion. In July 2026 the Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the EU.
A change in encryption is also coming, outside the act. In January 2025 NÚKIB joined a statement by 18 EU countries recommending that the most sensitive systems move to post-quantum cryptography as soon as possible, ideally by 2030. The statement is not binding. We summarise the deadlines in the article Quantum computers: where they really are today.
Sources: NÚKIB, Report for 2025 (in Czech), European Commission, May 2025, European Commission, July 2026, NÚKIB, January 2025
Where do companies find cybersecurity experts?
A NÚKIB questionnaire was completed by 425 organisations, most of them regulated under the old act. Of these, 75% said the main reason candidates turn them down is insufficient pay; in the public sector it was 92%. The hardest roles to fill are cybersecurity architects, security monitoring staff, network and server administrators and auditors. Outsourcing is the most common solution. How hard Czech companies find it to fill IT roles in general is shown by Eurostat data in the article Companies that cannot fill IT roles.
The EU agency ENISA sees something similar: in its survey of 1,080 organisations, 76% have trouble recruiting experts and 71% have trouble keeping them. For 70% of organisations, compliance is the main driver of security investment.
Sources: NÚKIB, Report for 2025 (in Czech), ENISA, NIS Investments 2025
Summary
- NÚKIB expects the new act to cover more than 6,000 entities; the old one covered a few hundred.
- Companies must put security measures and the new incident reporting in place within a year of receiving the registration decision, so often not until 2027.
- Fines can reach CZK 250 million or 2% of turnover, whichever is higher. Both NÚKIB and ENISA report a shortage of experts.
If you are looking for a cybersecurity specialist or need to strengthen your team, get in touch. How we find people is described on the IT recruitment page. Specialists can find the role on the cybersecurity specialist page.
As of 1 November 2026. This article is general information, not legal advice.
- cybersecurity
- NIS2
- Czech Cybersecurity Act
- NÚKIB
Sources
- Act No. 264/2025 Coll., on Cybersecurity (Sections 6, 8, 13, 14, 15, 16, 58, 59, 71) (in Czech)
- Decree No. 408/2025 Coll. on regulated services (in Czech)
- NÚKIB: Report on the State of Cybersecurity in the Czech Republic for 2025 (in Czech)
- NÚKIB: information on regulated entities, 15 January 2026 (in Czech)
- NÚKIB: information on regulated services, 26 February 2026 (in Czech)
- Seznam Zprávy: NÚKIB data on registration under the Cybersecurity Act, 12 August 2026 (in Czech)
- European Commission: Commission calls on 19 Member States to fully transpose NIS2 (7 May 2025)
- European Commission: infringement proceedings for failure to transpose NIS2 (IP/26/1499, 8 July 2026)
- NÚKIB: EU Member States warn of the quantum threat (17 January 2025)
- ENISA: NIS Investments 2025 (8 December 2025)
