The new Czech Cybersecurity Act (264/2025 Coll.) has been in effect since 1 November 2025. The one-year clock to implement measures runs from NÚKIB's registration decision, and in the higher-obligation regime non-compliance carries fines up to CZK 250m or 2% of turnover. Kybit doesn't build compliance out of slide decks. We build and run the exact measures the Act requires.
The Act rests on self-identification, which it calls notification of a regulated service: each organisation assesses whether it provides one of the services in decree 408/2025 Coll. and notifies it through the NÚKIB Portal. The Act names 15 sectors (Section 4(1)); the decree's annex breaks them into 22 parts and 102 regulated services and assigns each service a regime. One organisation has one regime. NÚKIB expected around 6,000 entities; over 4,800 had notified by February 2026.
Set by the specific service, not the whole sector. It includes, for example, series production of passenger cars and group-B sites under the major-accident prevention act. Critical infrastructure is always in this regime, and NÚKIB registers it itself.
Typically medium and large companies in manufacturing, food, chemicals and waste: makers of electronics, machinery, vehicles and parts, industrial food producers, manufacturers and distributors of chemicals under REACH, or waste-facility operators for whom that service is at least 5% of turnover.
The Act targets medium and large enterprises: 50 or more employees, or annual turnover and balance sheet both above EUR 10 million. Partner and linked enterprises count. For some services, such as public administration or critical infrastructure, size does not matter.
Specific deadlines run from the moment you meet the criteria. The essentials are below. Verify exact wording with NÚKIB or legal counsel.
Notify the regulated service through the NÚKIB Portal within 60 days of meeting the criteria (for entities in scope from 1 Nov 2025 the deadline was 31 Dec 2025); NÚKIB then issues the registration decision. Failing to notify is an offence with a fine of up to CZK 250m or 2% of turnover.
Report contact details via the NÚKIB Portal within 30 days of receiving the registration decision.
Implement, per your assigned regime, within 1 year of receiving the registration decision: the higher regime under decree 409/2025 Coll., the lower under decree 410/2025 Coll.
The higher regime reports to NÚKIB, the lower regime to the National CERT and only incidents with significant impact. An initial report within 24 hours of detection, a notification within 72 hours for significant-impact incidents, and a final report within 30 days of that notification.
Higher regime: business impact analysis (BIA), recovery time (RTO) and recovery point (RPO) objectives, tested continuity plans and a register of significant suppliers. Lower regime: recovery priorities, responsibilities and regular backups. Supplier requirements go into contracts in both regimes.
Fines up to CZK 250m or 2% of worldwide annual turnover in the higher-obligation regime, CZK 175m or 1.4% in the lower regime, whichever is higher. The Act sets no personal fines for management; in the higher regime, however, NÚKIB can temporarily bar a member of the statutory body from office if their repeated or serious breach of duty has frustrated a remedial measure.
Obligation by obligation, operationally and not just on paper. Each area maps to a specific service we actually run.
24/7 SOC/MDR that catches and contains the incident and prepares the report to NÚKIB or the National CERT within the statutory windows.
Threat hunting, risk analysis and CTI that underpin the cyber-risk-management obligation.
Penetration tests, red-team and threat-led testing (TLPT) that evidence control effectiveness for NIS2 and DORA.
SIEM/SOAR/XDR and detection-as-code: the technical measures the Act requires, deployed and tuned.
Zero Trust, IAM and PKI, ISMS and policy design: the organisational measures at governance level.
Cloud hardening, Infrastructure as Code and operational resilience: business continuity and supply-chain control.
Short on people to meet the obligations? We embed senior capacity into your team, short- or long-term.
NIS2 isn't the only regulation aimed at you. We cover the full spectrum, from finance to automotive.
The five filings under Section 16, deadlines running from detection, the two regimes, and the trust-services exception.
Regulation (EU) 2022/2554, applicable since 17 Jan 2025. ICT-risk management, TLPT and incident reporting for finance.
The VDA ISA / ENX information-security assessment demanded across automotive suppliers. We get you assessment-ready.
The information-security management system NIS2, DORA and TISAX all build on. Design, implementation and operation.
Straight answers to what clients ask us most.
Act No. 264/2025 Coll. on Cybersecurity was published in the Collection of Laws on 4 August 2025 and has been in effect since 1 November 2025. It replaced Act No. 181/2014 Coll. and its decrees and transposes the EU NIS2 Directive (2022/2555) into Czech law. Four implementing decrees took effect the same day: 408/2025 Coll. on regulated services, 409/2025 Coll. for the higher-obligation regime, 410/2025 Coll. for the lower-obligation regime and 334/2025 Coll. on the NÚKIB Portal.
The Act rests on self-identification, which it calls notification of a regulated service: each organisation assesses whether it provides one of the 102 regulated services in the annex to decree 408/2025 Coll., grouped into 15 sectors, and whether it is a medium or large enterprise (50 or more employees, or annual turnover and balance sheet both above EUR 10 million). The regime is set by the specific service, not the sector, and one organisation has one regime. Scope is far wider than under Act 181/2014; according to NÚKIB, from about 400 entities to around 6,000, and over 4,800 had notified by February 2026.
Self-identification is the assessment an organisation makes for itself: whether it provides one of the regulated services in the annex to decree 408/2025 Coll. and whether it meets the size conditions. The Act calls the result a notification of a regulated service (Section 6), and it is filed only through the NÚKIB Portal, which also offers a calculator; a notification sent any other way has no effect. NÚKIB then issues a registration decision, and its delivery starts the clocks: 30 days for contact details and one year for security measures and incident reporting.
A regulated service is notified through the NÚKIB Portal within 60 days of meeting the criteria. Organisations that met them on 1 November 2025 had until 31 December 2025; anyone who meets them later has 60 days from that date. Failing to notify is an offence with a fine of up to CZK 250 million or 2% of turnover, and NÚKIB has said that a longer period of non-compliance increases the fine.
Four decrees accompany Act No. 264/2025 Coll., all in effect since 1 November 2025. Decree 408/2025 Coll. on regulated services lists the 102 services, the size conditions and the regime for each. Decree 409/2025 Coll. sets the security measures for the higher-obligation regime, and decree 410/2025 Coll. those for the lower regime, including how to judge whether an incident has significant impact. Decree 334/2025 Coll. governs the NÚKIB Portal and the format of notifications and incident reports. The former cybersecurity decree 82/2018 Coll. was repealed.
The maximum fine is CZK 250 million or 2% of worldwide annual turnover in the higher-obligation regime and CZK 175 million or 1.4% in the lower regime, whichever is higher. Failing to notify a regulated service carries up to CZK 250 million or 2%. The Act sets no personal fines for management; in the higher regime, however, NÚKIB can bar a member of the statutory body from office, for at least six months, if their repeated or serious breach of duty has frustrated a remedial measure.
Act No. 264/2025 Coll. sets three stages in Section 16. The initial report goes in without undue delay and no later than 24 hours after you detect the incident. For an incident with significant impact, a notification follows no later than 72 hours after detection, adding the first assessment, the impact and any indicators of compromise. Within 30 days of that notification you file a final report; if the incident is still running, you file an interim report and the final one within 30 days of resolution. Otherwise interim reports are due only on request. The higher regime reports to NÚKIB; the lower regime reports to the National CERT, and only incidents with significant impact. Kybit prepares this evidence as part of the SOC/MDR service.
Security measures for your assigned regime must be in place within one year of receiving NÚKIB's registration decision: the higher regime under decree 409/2025 Coll. (14 organisational and 11 technical measures), the lower regime under decree 410/2025 Coll. (13 measures). For most organisations registered after 1 November 2025 that clock is running now.
In the higher regime, decree 409/2025 Coll. (Section 15) requires a business impact analysis (BIA), a minimum service level, a recovery time objective (RTO) and a recovery point objective (RPO), a continuity policy, and continuity and recovery plans that are tested regularly; top management must take part in the BIA. In the lower regime, decree 410/2025 Coll. (Section 6) requires the priority and order for restoring technical assets, named responsibilities and regular backups.
Yes, if they are medium or large enterprises in the listed fields. Manufacture of electronics, electrical equipment, machinery, vehicles and parts, and other transport equipment (CZ-NACE 26 to 30) falls in the lower-obligation regime, as do industrial food production and manufacturers and distributors of chemicals under REACH. The higher regime covers series production of passenger cars and group-B sites under the Czech major-accident prevention act. In waste management the Act covers facility operators, waste traders, brokers and carriers for whom that activity is at least 5% of turnover, in the lower regime. The exact classification is in the annex to decree 408/2025 Coll.
We meet the obligations operationally, not with a deck. SOC/MDR covers detection, response and incident reporting. Penetration tests evidence control effectiveness. Security engineering and architecture implement the technical and organisational measures. And when you're short on people, we add capacity to your team.
Book a consultation with a senior specialist. We'll map your obligations, show you where the gaps are, and lay out a realistic path to compliance. No discovery-call deck.