Act No. 264/2025 Coll. On Cybersecurity, which came into force in November 2025, is the Czech implementation of the European NIS2 Directive. It brings fundamental changes, expanding the scope of obligated entities and tightening cybersecurity requirements. It is estimated that in the Czech Republic the Act will affect over 6 000 organisations.
But how do you find out whether the law applies to your company?
Two types of regulated entities
The law distinguishes between two types of obligated entities: basic entities (BE) and important entities (IEs). Two criteria are key: sector, in which the company operates, and size companies.
Basic subjects (BS)
These are large organisations in key sectors. The law imposes stricter requirements on them, and NÚKIB can actively audit them. This includes companies with more than 250 employees or an annual turnover exceeding 50 million euros in the following sectors:
- Energy sector (electricity, gas, oil, heat)
- Transport (air, rail, water, road)
- Banking and financial infrastructure
- Healthcare (hospitals, laboratories, research)
- Digital infrastructure (DNS, cloud, data centres)
- Public administration (state authorities, regional offices)
- Universe
Important Entities (IE)
Medium-sized enterprises in the same or related sectors. Requirements are similar to those for LS, but the control mechanism is less intensive. This includes companies with more than 50 employees or a turnover exceeding 10 million euros in sectors such as:
- Postal and courier services
- Waste Management
- Manufacturing (chemicals, foodstuffs, medical devices, electronics, engineering)
- Digital providers (search engines, online marketplaces, social networks)
- Science and Research
Important: The law may also apply to smaller companies if they are critical in terms of their impact on society or the economy, regardless of their size. NÚKIB can individually classify such a company as an obligated entity.
Mandatory registration with NÚKIB
If your company meets the above criteria, you are required to register with NÚKIB via the portal portal.nukib.gov.cz. The registration deadline was set for 17 July 2025.
After registration, you incur obligations that must be fulfilled within 12 months of registration:
- Appointment of a Cybersecurity Manager (CSM)
- Carrying out a risk assessment
- Implementation of security measures in accordance with Decree No. 409/2025 Coll.
- Preparation of documentation (ZHR, POA, policies)
- Setting up a cyber incident reporting system
I don't know if my company falls under the Act: what should I do?
The law is complex and its interpretation is not always clear-cut. I recommend three steps:
- Verify the sector. Check whether your main activity falls under the regulated sectors listed in the Act's annex.
- Check the size. Calculate the number of employees and turnover for the last completed accounting period.
- Consult an expert. And even if you think the law does not apply to you, we recommend verification: the risk of a fine for non-registration is high.
Are you unsure whether the law applies to your company?
I offer a free 30-minute consultation where I will assess your specific case at no cost.
Free consultationConclusion
Act No. 264/2025 Coll. Is the most extensive legislative change in the field of cybersecurity in the Czech Republic in the last 10 years. Companies that fail to meet their obligations face fines of up to 10 million Kč or 2% of annual turnover, plus personal liability for the statutory body.
If you have doubts about whether the law applies to you or where to start with implementation, contact me. As a certified KB manager under Decree 409/2025 Coll. And ENISA ECSF, I will advise you specifically and without unnecessary jargon.