Act No. 264/2025 Coll. On Cybersecurity has introduced not only new obligations but also significantly stricter sanctions for non-compliance. If your company is among the regulated entities and fails to meet legal requirements, you face fines that could threaten the very existence of even a large corporation.
What exactly is at risk and how to avoid it?
Fine amounts under Act No. 264/2025 Coll.
The Act stipulates sanctions graduated according to the severity of the breach and the type of entity:
Basic subjects (BS)
- Up to 10 000 000 Kč or 2% of total annual global turnover (the higher of both values applies)
- For the most serious breaches, failure to register, non-compliance with safety measures, and failure to report an incident.
Important Entities (IE)
- Up to 7 000 000 Kč or 1.4% of total annual global turnover (the higher amount applies)
- For the same categories of faults as with the PBX
Example: A company with an annual turnover of 500 million Kč could face a fine of up to 10 million Kč as a basic entity. A company with an annual turnover of 1 billion Kč could face a fine of up to 20 million Kč (2% of turnover).
Personal liability of management: a new legal requirement
This is a fundamental change compared to the previous legal regulation: Act No. 264/2025 Coll. Has introduced direct personal liability of the statutory body for the company's cybersecurity.
What exactly does this mean:
- The managing director or a member of the board may be personally fined.
- NÚKIB may require the company to demonstrate that management was adequately informed and approved the security strategy.
- Insufficient engagement from management is an aggravating factor in itself.
- Management must complete cybersecurity training.
The law therefore shifts cybersecurity from the IT department directly to the desk of the managing director or CEO.
What specific offences carry a fine?
NÚKIB may initiate proceedings and impose a fine for:
- Failure to register - if you are a mandatory entity and have not registered with NÚKIB
- Failure to implement technical safety measures in accordance with Decree No. 409/2025 Coll.
- Failure to report a cyber incident within the statutory deadline (24 hours for the initial notification)
- Failure to carry out regular risk assessments
- Insufficient documentation - missing ZHR, POA or security policies
- Not having a designated CISO with appropriate qualifications
- Non-cooperation during NÚKIB inspection
How to avoid fines
The good news is that NÚKIB prefers a corrective approach over repression. If a company actively works towards compliance with the law, NÚKIB's procedure is significantly more lenient.
Key steps:
- Verify whether you are a mandatory entity. - and if so, register as soon as possible
- Appoint a KB manager with certification according to Decree No. 409/2025 Coll. And ENISA ECSF
- Carry out a GAP analysis - find out where you stand and what is missing
- Draw up a remediation plan with realistic deadlines
- Involve management - Cybersecurity must be a board-level agenda item, not just an IT concern.
Not sure where to start?
Free 30-minute consultation. I will assess your case and outline specific first steps. No obligation.
Free consultationConclusion
The penalties for non-compliance with Act No. 264/2025 Coll. Are sufficiently high to motivate even large companies to act quickly. At the same time, the earlier you start, the lower the implementation cost and the smaller the risk of a fine.
As a certified cybersecurity manager under Decree 409/2025 Coll. And ENISA ECSF, I will help your company meet legal obligations efficiently and without unnecessary costs. Contact me for a non-binding consultation.