Act No. 264/2025 Coll., which transposes the NIS2 directive in Czechia, has been in force since 4 August 2025 and applies from 1 November 2025. It covers you if you provide a service in one of 15 sectors and you are not a small business. A small business has fewer than 50 people and an annual turnover or balance sheet total that does not exceed EUR 10 million. If you are above that line and your service is on the list, you must report it to the NÚKIB (the national cyber and information security agency) within 60 days. If you don't, you risk a fine of up to CZK 250 million.
- Act No. 264/2025 Coll. applies from 1 November 2025 and covers services in 15 sectors.
- A small business has fewer than 50 people and a turnover or balance sheet total of up to EUR 10 million, and larger firms on the list fall under the act.
- You must report your service to the NÚKIB within 60 days of meeting the conditions.
- The first notice of an incident must go out within 24 hours.
- The fine reaches up to CZK 250 million or 2% of turnover.
What NIS2 means in Czechia
NIS2 is Directive (EU) 2022/2555 of 14 December 2022. Act No. 264/2025 Coll. transposed it into Czech law and repealed the old Act No. 181/2014 Coll. The NÚKIB issued the implementing decrees. Decree No. 408/2025 Coll. defines which services and firms the act covers. Decrees No. 409/2025 Coll. and No. 410/2025 Coll. say which protective steps firms must put in place.
We are not a law firm and this is not legal advice. We go through what the text of the act and the decrees says. The NÚKIB makes the final call on which regime you fall into.
Who is covered: three questions
The act treats a firm as a regulated service provider when it meets both conditions in § 4(1).
- Sector. Your service belongs to one of 15 sectors: public administration, energy, manufacturing, food industry, chemical industry, water management, waste management, transport, digital infrastructure and services, financial market, healthcare, science, research and education, postal and courier services, defence industry and space industry. The annex to Decree No. 408/2025 Coll. lists which specific services count. The sector alone is not enough.
- Big or small. According to the Czech text of the Commission's 2003/361/EC rule, a medium-sized business has fewer than 250 people and an annual turnover of up to EUR 50 million or a balance sheet total of up to EUR 43 million. A small business has fewer than 50 people and a turnover or balance sheet total of up to EUR 10 million. If you are not small, you count as medium or large.
- Ties to other firms. Partner and linked businesses are added to your headcount and your money. Section 7(c) of the act makes one exception: firms whose technical assets are fully separate from the assets you use for the regulated service are not counted.
A small firm is not automatically out. In § 5 the act also covers services that nobody else in Czechia provides, services whose outage would affect more than 125,000 people, and critical infrastructure entities. Size does not matter for those.
The list in the annex to Decree No. 408/2025 Coll. is narrower than manufacturers expect. Manufacturing there covers only divisions 26 to 30 of CZ-NACE: computers and electronics, electrical engineering, machinery, motor vehicles and other transport equipment. A maker of furniture or clothing is not in it. Among IT businesses the list includes, for example, cloud computing, data centres and managed services, including managed security services.
Higher and lower regime
The act splits providers into two regimes (§ 8). The annex to Decree No. 408/2025 Coll. says which one applies to you, and for most services it depends on whether you are a medium or a large business. A managed service provider that is a medium business falls into the lower regime, a large one into the higher regime.
| What | Higher regime | Lower regime |
|---|---|---|
| Decree with the protective steps | No. 409/2025 Coll. | No. 410/2025 Coll. |
| Number of protective steps in the act (§ 14) | 14 organisational and 11 technical | 13 |
| Who gets the incident report | NÚKIB | National CERT |
| Which incidents must be reported | Those where intent cannot be ruled out | The same, and only those with a significant impact on the service |
| Highest fine for steps not put in place (§ 59) | CZK 250 million or 2% of turnover | CZK 175 million or 1.4% of turnover |
For fines, the higher of the two amounts always applies, and the turnover is worldwide, for the previous accounting period.
How the higher regime is built in practice is shown on the page about NIS2 and the cybersecurity act. The lower regime is not a break: it has 13 steps and you must report incidents there too.
Deadlines you have to watch
- 60 days to report your service to the NÚKIB. The clock starts on the day you began to meet the conditions (§ 6(1)). The agency then decides on the entry.
- 30 days from the day the agency delivers its decision for contact details and supplementary details: who owns the firm, how the service runs technically and how far it reaches (§ 11).
- 1 year from the same day to start carrying out the protective steps (§ 13(4)) and reporting incidents (§ 15(4)).
- 24 hours from the moment you detect an incident for the initial report. For an incident with a significant impact, send a notification with an initial assessment within 72 hours and a final report within 30 days of it (§ 16).
We found no common date in the text for firms that were already covered on 1 November 2025. The act counts 60 days from the moment you meet the conditions. If you are not sure whether you reported your service, find out now: anyone who does not report a service commits a separate offence with a fine of up to CZK 250 million or 2% of turnover (§ 60).
- 24 hoursFirst notice of an incidentCounted from detecting the incident.
- 72 hoursFollow-up reportFor an incident with a significant impact, from detection.
- 30 daysFinal reportFrom submitting the follow-up report.
- 60 daysReport the service to the NÚKIBFrom the moment you meet the conditions.
- 30 daysContact detailsFrom delivery of the decision on the entry.
- 1 yearProtective steps and reportingFrom delivery of the decision on the entry.
What the act asks of the bosses
Protecting data stops being the network administrator's business here. In the higher regime, under § 4 of Decree No. 409/2025 Coll., the statutory body demonstrably completes a course, secures a security policy and the goals of the ISMS, meaning the system by which a firm manages the protection of its data, and gives it money and people. In the lower regime, under § 4 of Decree No. 410/2025 Coll., management appoints a person in charge of cyber protection, also demonstrably completes a course and secures the resources.
The act thinks about penalties too. If a member of the statutory body of a firm in the higher regime repeatedly or seriously breaches their duties and so defeats the carrying out of an NÚKIB remedial decision, the agency can ban them from the post for at least 6 months (§ 58).
What to do in a firm of 80 people
Take an example: a firm makes machinery, has 80 employees and a turnover of EUR 18 million. Machinery is division 28 of CZ-NACE and the firm is not small, so the lower regime and Decree No. 410/2025 Coll. apply. The steps:
- Go through the annex to Decree No. 408/2025 Coll. and write down which service and which regime it assigns to you.
- Report the service to the NÚKIB within 60 days. Decide who acts for the firm and prepare the details about the owners.
- The managing director appoints a person in charge of cyber protection and completes a course personally.
- Write the overview of protective steps: what you already have, what you will put in place and when, what you won't and why. Many steps overlap with what GDPR asks from the technical side.
- Go through your supplier contracts. If a supplier puts protective steps in place, you must, under § 13(5), choose the supplier by the requirements of the step and write the requirements into the contract.
- Test that the steps hold. What such a test looks like is explained in the text on how a penetration test runs.
For the higher regime, the NÚKIB published a guide to assets and risks with 14 annexes of sample documents on 20 October 2026, along with a brief methodology for assets and risks. The NÚKIB itself writes that the samples are not a universal solution. A firm has to adapt them.
The decrees do not mention the ISO 27001 standard, but firms use it as a backbone for their own protection. What it involves is shown on the page about ISO 27001.
Mistakes that keep repeating
- Waiting for a summons. The act tells a firm to report its service itself. It should not wait for a letter from the NÚKIB.
- Guessing by sector. A firm says it is in manufacturing and assumes the act applies to it. It takes only a look at the annex to Decree No. 408/2025 Coll.
- The lower regime as a break. The steps and the reports apply there too.
- Contracts without requirements. Suppliers sign contracts that say nothing about protection, although the act wants the opposite.
Common questions
Does NIS2 apply to firms under 50 people?
Mostly not, because § 4 requires a medium or large business. The exceptions are in § 5: the only provider of a service in Czechia, a service affecting more than 125,000 people, and critical infrastructure entities. A small firm can also be a supplier to a regulated firm, and that firm must write the requirements into the contract.
Is NIS2 a directive or a law?
Both. Directive (EU) 2022/2555 is addressed to the member states and in Czechia it is carried out by Act No. 264/2025 Coll. Firms follow the act and the decrees.
Where do you report an incident?
In the higher regime to the NÚKIB, in the lower regime to the National CERT, through the agency's portal (§ 16(4)). The first notice must go out within 24 hours of detection.
How high are the fines?
For steps not put in place, up to CZK 250 million or 2% of worldwide turnover in the higher regime and up to CZK 175 million or 1.4% of turnover in the lower one. The higher of the two amounts applies. For an unreported service, up to CZK 250 million or 2%.
Is it enough to buy software?
No. The decrees want policies, roles, records and courses for the bosses. A tool helps, but it replaces none of that.
Does the old Act 181/2014 Coll. still apply?
Act No. 264/2025 Coll. repealed it. Under § 71, those who were covered before keep their old duties until the new deadlines run out.
Sources
- Act No. 264/2025 Coll., version in force from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-264
- Decree No. 408/2025 Coll., on regulated services, in force from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-408
- Decree No. 409/2025 Coll., in force from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-409
- Decree No. 410/2025 Coll., in force from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-410
- Ministry of Industry and Trade, No. 7/2023 Coll., Czech text of the Commission's 2003/361/EC rule: https://www.zakonyprolidi.cz/cs/2023-7
- NÚKIB, guide to assets and risks, 20 October 2026: https://nukib.gov.cz/cs/infoservis/aktuality/2469-rizeni-aktiv-a-rizik-krok-za-krokem-nukib-vydal-noveho-pruvodce-i-metodicky-postup
Risk analysis for NIS2 and ISO 27001: a step-by-step guide
PHP2Shell vulnerability: does it affect your website and what to do
Free CRM: when it's enough and when it costs more than a paid one
