Is NIS2 in force in Czechia?

Yes. Zákon č. 264/2025 Sb., o kybernetické bezpečnosti, was made available in the Collection of Laws on 4 August 2025 and has applied since 1 November 2025 (§ 73), with NÚKIB decrees 334/2025, 408/2025, 409/2025 and 410/2025 in force the same day. It replaced Act No. 181/2014 Coll. The duties that follow registration start provider by provider: the security measures and incident reporting at the latest one year after NÚKIB delivers its registration decision (§ 13(4), § 15(4)).

How does a Czech organisation know whether it provides a regulated service?

By reading the annex of decree 408/2025, which lists 102 services in 22 sectors with each provider's significance conditions and regime (§ 4(2), § 8(2)). For most services the condition is being a medium or large enterprise within the meaning of Recommendation 2003/361/EC, with national deviations: state units, municipalities, regions and the Czech National Bank are not sized as enterprises, and partner or linked enterprises whose technical assets are fully separate are not counted (§ 7). Some rows apply at any size, such as public electronic communications, qualified trust services and TLD registries. NÚKIB's online calculator gives an indication only: its result is not NÚKIB's official opinion, and it does not add partner or linked enterprises.

How does a Czech provider notify its service to NÚKIB?

Within 60 days of meeting the conditions (§ 6(1)), and only through the electronic forms of the NÚKIB Portal: a notification made another way is ineffective unless the act allows it and the Portal cannot be used (§ 45(2)). The statutory body or an authorised representative files it, logging in with an electronic identity of substantial or high assurance (NÚKIB). The registration decision arrives in the organisation's data box, contact and supplementary data follow within 30 days of its delivery (§ 11(1)), and changes that may alter the regime are reported within 60 days (§ 9(1)).

Where does a Czech provider report a cybersecurity incident, and how fast?

Through the NÚKIB Portal: to NÚKIB in the higher obligations regime, to the Národní CERT in the lower one (§ 15, § 16(4)); only when the Portal cannot be used, by e-mail or data box to the same recipient, and the telephone is not a reporting channel (NÚKIB). The initial report goes in at the latest 24 hours after becoming aware of the incident, the notification within 72 hours (24 for trust service providers) and the final report at the latest 30 days after the notification; an incident still ongoing then gets a status report, and the final report follows 30 days after its resolution (§ 16). Incidents whose intentional cause can be ruled out are not reported, except by the § 18 digital services.

Does an ISO 27001 certificate prove compliance with the Czech decrees?

It helps, but NÚKIB says a certificate cannot be the only basis of an inspection. The measures are those of decree 409/2025 in the higher regime or decree 410/2025 in the lower one, and they apply within the managed scope of the regulated service, at least, rather than across the whole organisation (§ 12; NÚKIB). NÚKIB adds that a measure not yet in place when the one-year period ends is not a problem at inspection if the delay is objectively justified and recorded in the risk treatment plan or the overview of measures.

← Back to Reglyze

Transposed & Enforced

NIS2 in Czechia

Everything you need to know about the NIS2 directive in Česko: transposition law, competent authority, incident reporting, deadlines, and how Reglyze helps SMEs become compliant.

Czechia transposed NIS2 with a new Cybersecurity Act, zákon č. 264/2025 Sb., in force since 1 November 2025 together with four NÚKIB decrees. The act regulates services rather than entity types: a provider of a service listed in decree 408/2025 notifies it to NÚKIB within 60 days, and the decree's annex places each provider in the higher or the lower obligations regime, each with its own binding measures decree. Incidents go to NÚKIB or to the Národní CERT according to that regime, always through the NÚKIB Portal, and the final report is filed at the latest 30 days after the notification.

Key facts at a glance

Transposition Law

Zákon č. 264/2025 Sb., o kybernetické bezpečnosti (Act No. 264/2025 Coll. on Cybersecurity)

In force since: 2025-11-01

Competent Authority

Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB)

https://nukib.gov.cz/

Start now in Czechia: nothing to redo later

Reglyze runs your Czechia NIS2 compliance on the EU baseline today: scoping, the AI-guided assessment, AI-drafted documents and incident notification to NÚKIB for providers in the higher obligations regime, the Národní CERT for those in the lower one, both through the NÚKIB Portal.

Your national rules (Zákon č. 264/2025 Sb., o kybernetické bezpečnosti (Act No. 264/2025 Coll. on Cybersecurity)) layer national specifics on top of NIS2. When they apply to you, what you have built carries straight over: your scores, your documents and your evidence are kept, not reset. You simply add the national layer (registration with NÚKIB and local incident notification) onto your existing work. You never start from scratch.

Priority sectors for NIS2 in Czechia

NIS2 covers 18 sectors across Annex I (highly critical) and Annex II (other critical); the class depends on the annex and the size together, and an Annex II entity is never essential by its size alone. These are the sectors where Czechia's transposition and NÚKIB supervision focus most.

Electronic communications, DNS, TLD registries and trust services

Public electronic communications networks and services are regulated at any size: medium and large providers are in the higher regime, small and micro ones in the lower, and a provider with at least 350,000 active mobile SIM cards or 100,000 active fixed internet connections in Czechia is higher whatever its size (annex rows 16.1 and 16.2). Qualified trust service providers and TLD registries are in the higher regime at any size (16.12, 16.6). A DNS provider is higher at any size when it offers publicly available recursive resolution or authoritative resolution for more than 10,000 second-level domains; an authoritative-only provider for fewer is not regulated (16.4).

Managed (security) services, cloud and data centres

Managed and managed security services supplied to customers that are not consumers, data centres and CDNs are regulated in the higher regime for a large provider and the lower one for a medium provider; small and micro providers are not regulated (annex rows 16.9, 16.10, 16.13, 16.14). Cloud computing follows the same split, plus the state cloud provider, always higher (16.8). These are § 18 digital services: they apply the Commission's implementing act for measures and, for which incidents to report, its significance criteria (§ 18(1) and (2)).

Public administration, municipalities with extended powers and Prague's districts

Public administration is in by name, at any size (annex row 1.1). Central state bodies, the Czech National Bank, health insurers, the regions and Prague are in the higher regime; territorial offices, professional chambers, universities, the Academy of Sciences, municipalities with extended powers and the districts Prague 1 to 22 are in the lower regime. The annex names no other municipality, and state units, municipalities, regions and the Czech National Bank are not sized as enterprises (§ 7(b)).

Key deadlines

2025-08-04

Zákon č. 264/2025 Sb., o kybernetické bezpečnosti, was made available in the Collection of Laws (Sbírka zákonů).

2025-11-01

The act entered into force (§ 73) with its four NÚKIB decrees: 334/2025 on the Portal, 408/2025 on regulated services, 409/2025 and 410/2025 on the security measures of the higher and the lower obligations regime. It repealed Act No. 181/2014 Coll. (§ 72), and the NÚKIB Portal became the mandatory channel between NÚKIB and regulated providers.

2025-12-31

Last day, as NÚKIB counts it, of the 60 days that organisations meeting the criteria on 1 November 2025 had to notify their regulated services (§ 6(1)). A provider that meets the conditions later notifies within 60 days of meeting them.

Registration + 1 year

For each regulated service, the security measures and incident reporting apply at the latest one year after NÚKIB delivers its registration decision (§ 13(4), § 15(4)). A provider already regulated under the 2014 act reports incidents in the new act's manner from the day the decision is delivered (§ 71(1)).

Is your company in scope? Common Czechia scenarios

Two worked examples of how NIS2 scoping plays out in Czechia. Not sure where you land? Run the free NIS2 scope checker.

A 5-person Czech web-hosting and DNS company

Depends on its DNS service, not its size

As a micro enterprise it provides no regulated cloud, data-centre, CDN, MSP or MSSP service: those rows start at medium size (annex rows 16.8 to 16.10, 16.13 and 16.14). Its DNS service is regulated, in the higher regime, only if it offers publicly available recursive resolution to internet end users or authoritative resolution for third parties for more than 10,000 second-level domains (row 16.4); it then notifies the service to NÚKIB within 60 days and, once registered, reports incidents to NÚKIB through the Portal. Out of scope, it still meets the act through its regulated customers, who choose their suppliers by the measures' requirements and write those requirements into the contracts (§ 13(5)).

A 120-employee machinery manufacturer in Brno

Regulated service, lower obligations regime

Manufacture of machinery and equipment (CZ-NACE 28) is annex row 7.3, regulated in the lower regime for a medium or large enterprise; with 120 employees it is at least medium under Recommendation 2003/361/EC, and the row never reaches the higher regime whatever its turnover. It notifies the service to NÚKIB within 60 days of meeting the conditions, applies decree 410/2025 (an overview of measures updated at least yearly, multi-factor authentication) and, at the latest one year after its registration decision, reports to the Národní CERT through the NÚKIB Portal the incidents with a significant impact on the service whose intentional cause cannot be ruled out.

What Czechia businesses need to know

Czechia transposed NIS2 with a new Cybersecurity Act, zákon č. 264/2025 Sb., made available on 4 August 2025 and in force since 1 November 2025 (§ 73). It repealed Act No. 181/2014 Coll. (§ 72), and the European Commission closed its infringement case INFR(2024)0261 on 8 July 2026.
The act regulates services, not entity types. A provider of a service listed in the annex of NÚKIB decree 408/2025 that meets that service's conditions (for most services, being a medium or large enterprise within the meaning of Recommendation 2003/361/EC) notifies it to NÚKIB within 60 days (§ 4, § 6(1)), and the service becomes a regulated service by NÚKIB's registration decision (§ 3).
Two regimes instead of two classes: each provider is in the higher obligations regime (režim vyšších povinností) or the lower one (režim nižších povinností), as the annex of decree 408/2025 sets per service (§ 8). One organisation has one regime, the higher one as soon as one of its services is higher (NÚKIB). For the § 18 digital services the act matches the higher regime to essential entities and the lower one to important entities (§ 18(4)).
The measures are a national catalogue in two binding decrees, applied within the managed scope (stanovený rozsah) of the regulated service's assets (§ 12): decree 409/2025 for the higher regime (an ISMS evaluated at least yearly, a risk assessment at least yearly with a statement of applicability, a cybersecurity audit at least every two years, logs kept at least 18 months, four security roles) and decree 410/2025 for the lower one (an overview of measures updated and documented at least yearly and kept four years, multi-factor authentication). The § 18 digital services, among them DNS, cloud, data centre, CDN, managed and managed security services, apply the Commission's implementing act instead (§ 18(1)).
Incidents go to NÚKIB in the higher regime and to the Národní CERT in the lower one, through the NÚKIB Portal, and by e-mail or data box only when the Portal cannot be used (§ 15, § 16(4)). The initial report (prvotní hlášení) is sent at the latest 24 hours after becoming aware of the incident (po zjištění, the words of the Czech text of the directive), the notification (oznámení) within 72 hours, 24 for trust service providers, and the final report at the latest 30 days after the notification (§ 16).
The higher regime reports every incident that showed in its managed scope, originates in cyberspace and whose intentional cause cannot be ruled out, significant or not; NÚKIB says within 24 hours whether it significantly affects the state's cyberspace, and the notification and the final report are owed only if it does (§ 15(1), § 16(2) and (3)). The lower regime reports only such incidents that also have a significant impact on the regulated service, so its notification always follows (§ 15(2), § 16(3)).
Top management (vrcholné vedení) demonstrably completes initial and regular training, with no interval set by either decree (decree 409/2025 § 4(1)(a) with § 10(3)(a); decree 410/2025 § 4(b) with § 5(2)(a)). In the higher regime at least one of its members or a delegate sits on a cybersecurity committee that meets at least once a year (decree 409/2025 § 4(3)).
NÚKIB reported on 11 February 2026 that 4,825 organisations had notified their services by 8 February, against the roughly 6,000 it had long said the act would cover, and that each was sent a registration decision.

How NÚKIB enforces NIS2 in Czechia

NÚKIB decides which services are regulated (§ 3, § 6(2)), inspects compliance with the act and with directly applicable EU cybersecurity law (§ 55), can order a provider to remove the shortcomings it finds within a set time, with no suspensive appeal (§ 56), and hears the offences itself (§ 62(1)). In the higher regime it may also bar a statutory-body member who thwarted such an order from that office until the shortcomings are removed (§ 58). Failing to notify a regulated service is itself an offence for whoever should have notified it (§ 60(1)(a)); NÚKIB's guidance adds that suffering an incident is not an offence, while failing to report it in time is. Financial entities under DORA still notify their services to NÚKIB, while their measures, incident reporting and supervision follow DORA, under the primary supervision of the Czech National Bank (§ 70; joint statement of the ČNB and NÚKIB of 24 June 2026).

NIS2 in Czechia: frequently asked questions

Is NIS2 in force in Czechia?: Yes. Zákon č. 264/2025 Sb., o kybernetické bezpečnosti, was made available in the Collection of Laws on 4 August 2025 and has applied since 1 November 2025 (§ 73), with NÚKIB decrees 334/2025, 408/2025, 409/2025 and 410/2025 in force the same day. It replaced Act No. 181/2014 Coll. The duties that follow registration start provider by provider: the security measures and incident reporting at the latest one year after NÚKIB delivers its registration decision (§ 13(4), § 15(4)).
How does a Czech organisation know whether it provides a regulated service?: By reading the annex of decree 408/2025, which lists 102 services in 22 sectors with each provider's significance conditions and regime (§ 4(2), § 8(2)). For most services the condition is being a medium or large enterprise within the meaning of Recommendation 2003/361/EC, with national deviations: state units, municipalities, regions and the Czech National Bank are not sized as enterprises, and partner or linked enterprises whose technical assets are fully separate are not counted (§ 7). Some rows apply at any size, such as public electronic communications, qualified trust services and TLD registries. NÚKIB's online calculator gives an indication only: its result is not NÚKIB's official opinion, and it does not add partner or linked enterprises.
How does a Czech provider notify its service to NÚKIB?: Within 60 days of meeting the conditions (§ 6(1)), and only through the electronic forms of the NÚKIB Portal: a notification made another way is ineffective unless the act allows it and the Portal cannot be used (§ 45(2)). The statutory body or an authorised representative files it, logging in with an electronic identity of substantial or high assurance (NÚKIB). The registration decision arrives in the organisation's data box, contact and supplementary data follow within 30 days of its delivery (§ 11(1)), and changes that may alter the regime are reported within 60 days (§ 9(1)).
Where does a Czech provider report a cybersecurity incident, and how fast?: Through the NÚKIB Portal: to NÚKIB in the higher obligations regime, to the Národní CERT in the lower one (§ 15, § 16(4)); only when the Portal cannot be used, by e-mail or data box to the same recipient, and the telephone is not a reporting channel (NÚKIB). The initial report goes in at the latest 24 hours after becoming aware of the incident, the notification within 72 hours (24 for trust service providers) and the final report at the latest 30 days after the notification; an incident still ongoing then gets a status report, and the final report follows 30 days after its resolution (§ 16). Incidents whose intentional cause can be ruled out are not reported, except by the § 18 digital services.
Does an ISO 27001 certificate prove compliance with the Czech decrees?: It helps, but NÚKIB says a certificate cannot be the only basis of an inspection. The measures are those of decree 409/2025 in the higher regime or decree 410/2025 in the lower one, and they apply within the managed scope of the regulated service, at least, rather than across the whole organisation (§ 12; NÚKIB). NÚKIB adds that a measure not yet in place when the one-year period ends is not a problem at inspection if the delay is objectively justified and recorded in the risk treatment plan or the overview of measures.

Official sources

Primary references for NIS2 in Czechia. Verify the latest text and deadlines directly with the authority.

Ready to become NIS2 compliant in Czechia?

Reglyze is the AI-powered NIS2 compliance platform built for European SMEs. Start free: scoping, gap assessment, and policy generation tailored to NÚKIB requirements.