Act No. 264/2025 Coll. does not regulate all manufacturing, only selected fields, and medium and large companies in them mostly fall in the lower-obligation regime. Below you'll find which fields are covered, what the lower regime asks of you, and how to approach it on the production network.
The services in the annex to decree 408/2025 Coll. that concern manufacturing, food, chemicals, waste and medical devices. The regime is set by the specific service, and one organisation has one regime.
| Service | Regime | Condition |
|---|---|---|
| Manufacture of computers, electronic and optical products (CZ-NACE 26) | Lower | Medium or large enterprise |
| Manufacture of electrical equipment (CZ-NACE 27) | Lower | Medium or large enterprise |
| Manufacture of machinery and equipment (CZ-NACE 28) | Lower | Medium or large enterprise |
| Series production of passenger cars (CZ-NACE 29) | Higher | No size condition |
| Other manufacture of motor vehicles, trailers, semi-trailers and parts (CZ-NACE 29) | Lower | Medium or large enterprise |
| Manufacture of other transport equipment (CZ-NACE 30) | Lower | Medium or large enterprise |
| Industrial production and processing of food, food wholesale | Lower | Medium or large enterprise |
| Manufacture and placing on the market of chemicals, and production of articles, under REACH | Lower | Medium or large enterprise |
| Site under the major-accident prevention act, group B | Higher | Medium or large enterprise |
| Site under the major-accident prevention act, group A | Lower | Medium or large enterprise |
| Manufacture of medical devices and in vitro diagnostics | Lower | Medium or large enterprise |
| Waste facilities (except storage of one's own waste), trading, brokering and transport | Lower | Medium or large enterprise, and at least 5% of turnover from the service |
Manufacture of human medicines and active substances, and of medical devices on the critical list, is in the higher regime for large enterprises and the lower one for medium ones. Other fields, such as metalworking or plastics processing, are not among the regulated services unless the company provides another service from the annex. Check the classification in the annex to decree 408/2025 Coll. or with the calculator on the NÚKIB Portal.
Duties under the Act and decree 410/2025 Coll. The higher regime follows the stricter decree 409/2025 Coll.; the NIS2 page has the details.
Through the NÚKIB Portal within 60 days of meeting the criteria. NÚKIB then issues a registration decision; within 30 days of its delivery you report contact and supplementary details.
Top management appoints a person responsible for cybersecurity, takes training itself, provides the resources and demonstrably follows how the measures are being met.
13 measures under decree 410/2025 Coll., in place no later than 1 year after the registration decision is delivered.
Set the priority and order for restoring technical assets, name who is responsible, and back up data and configurations regularly.
Only incidents with significant impact, and to the National CERT: an initial report within 24 hours, a notification within 72 hours, a final report within 30 days of that notification.
For suppliers delivering into the service's defined scope, assess their risks and put the requirements of Annex 2 to decree 410/2025 Coll. into the contracts.
The Act does not distinguish IT from OT; it speaks of the assets a regulated service runs on, and in manufacturing those often include the lines and control systems. Even in the lower regime, decree 410/2025 Coll. explicitly asks for network segmentation, limited remote connections and configuration backups, and the higher regime has a separate measure for industrial and control assets. Here is our recommendation on where to start.
Control systems, operator stations and production network devices belong in it when the service stands or falls with them.
The production network separated from the office one, with defined crossings, so ransomware that reaches the office does not reach the machines.
Machine builders' service access through a controlled, time-limited and logged channel instead of standing remote connections. The decree asks for remote connections to be limited to what is necessary and for a record of who uses them.
Backups of control-system programs and configurations, with restores that have been tested. They decide how fast production restarts.
Monitoring of the crossing between office and production, where attacks usually spill over, so a significant incident is reported inside the statutory window.
We build and run the measures, not just describe them.
Design of production-network segmentation, access and identity.
OpenWe verify that the production separation actually holds.
OpenRound-the-clock detection and the evidence for reporting within the statutory windows.
OpenMonitoring and audit evidence without paying per gigabyte of data.
OpenStraight answers to what clients ask us most.
Yes, if the company is a medium or large enterprise, meaning 50 or more employees, or annual turnover and balance sheet both above EUR 10 million. Manufacture of machinery and equipment (CZ-NACE 28) is in the lower-obligation regime under the annex to decree 408/2025 Coll. The company notifies the service through the NÚKIB Portal within 60 days of meeting the criteria and, from the delivery of the registration decision, has a year to put the 13 measures of decree 410/2025 Coll. in place.
No. Within manufacturing, the Act regulates electronics, electrical equipment, machinery, motor vehicles and parts, and other transport equipment (CZ-NACE 26 to 30), plus industrial food production, chemicals under REACH, medicines and medical devices. Metalworking, plastics processing or furniture making are not among the regulated services unless the company provides another service from the annex to decree 408/2025 Coll.
Series production of passenger cars is in the higher-obligation regime. The rest of CZ-NACE division 29, meaning trucks, buses, trailers, semi-trailers and parts for car makers, is in the lower regime for medium and large enterprises. Manufacture and distribution of chemicals under REACH is in the lower regime. Operators of sites under the major-accident prevention act that are medium or large enterprises are in the higher regime with a group-B site and in the lower one with a group-A site. One organisation has one regime, so a single service in the higher regime moves the whole organisation into it.
Yes. The Act covers waste-facility operators, waste traders, brokers and carriers that are medium or large enterprises and earned at least 5% of their turnover from that service in the last accounting period. Storing waste from the operator's own activity does not count. All of these services are in the lower-obligation regime, so they report incidents with significant impact to the National CERT and implement the measures of decree 410/2025 Coll.
The Act does not distinguish IT from OT; it speaks of the assets a regulated service runs on. Even in the lower regime, decree 410/2025 Coll. explicitly requires network segmentation, limited remote connections and backups of technical-asset configurations, and the higher regime has a separate measure for industrial and control assets. Where production runs on control systems, we recommend including them in the asset register, the recovery plans and monitoring.
It can still be in scope, but only if its annual turnover and its balance sheet both exceed EUR 10 million; turnover alone is not enough. Partner and linked enterprises count, typically the parent and sister companies, except those whose technical assets are fully separated (Section 7 of the Act). Staff are counted in annual work units, roughly full-time equivalents, and a change of size takes effect only after two consecutive accounting periods.
In the lower-obligation regime, to the National CERT, and only incidents with significant impact: an initial report within 24 hours of detection, a notification within 72 hours and a final report within 30 days of that notification. A manufacturer in the higher regime, such as series production of passenger cars, reports to NÚKIB. The reporting duty applies no later than one year after the registration decision is delivered.
We checked these facts on 29 September 2026 directly in the Act, the decrees and with NÚKIB.
This page is not legal advice. Check your service's classification in the annex to decree 408/2025 Coll. or with NÚKIB.
We'll go through the classification, the deadlines and the state of your production network with you, and propose a plan that fits in the year.