NIS2 in Czech Republic: What your organisation must do.
Act No. 264/2025 Coll. (Zákon o kybernetické bezpečnosti) — full replacement of Act No. 181/2014 Coll. · In force November 1, 2025Czech Republic has transposed the EU NIS2 Directive. If your organisation operates in a covered sector, you are likely in scope and must comply with NÚKIB — Národní úřad pro kybernetickou a informační bezpečnost (National Cyber and Information Security Agency) requirements.
Entity classification
Are you an Essential or Important Entity?
250+ employees or €50M+ annual turnover (higher-obligations regime)
Penalties: up to €10M or 2% of global turnover
Proactive supervision, authorities can audit at any time
50+ employees or €10M+ annual turnover (lower-obligations regime)
Penalties: up to €7M or 1.4% of global turnover
Reactive supervision, investigated when non-compliance is indicated
Not sure which classification applies to your organisation? The free self-check takes 3 minutes and tells you exactly where you stand, including Czech Republic-specific rules. Start your free self-check →
What Czech Republic requires
Your obligations under Act No. 264/2025 Coll. (Zákon o kybernetické bezpečnosti) — full replacement of Act No. 181/2014 Coll..
Register with NÚKIB within 60 days of meeting in-scope conditions (entities already in scope on 1 November 2025: by 30 December 2025)
Implement Article 21 risk management measures with a documented risk treatment plan
Higher-obligations entities: external audits required
Achieve full compliance within 1 year of NÚKIB registration confirmation
Report significant incidents to the NÚKIB national CERT (24h early warning, 72h full report)
Management body accountability — directors face personal liability for non-compliance
ISO 27001 in Czech Republic
ISO 27001 is a useful framework for NIS2 compliance in the Czech Republic but no formal presumption of conformity exists under the new Cybersecurity Act.
Sectors in scope in Czech Republic
What makes Czech Republic different
Czech Republic enacted a brand-new Cybersecurity Act (not an amendment) effective 1 November 2025, fully replacing the 2014 law.
The two-tier regime uses Czech-specific terminology: "higher obligations" (essential) and "lower obligations" (important).
Thousands of organisations are in scope across key sectors including energy, healthcare, finance, digital infrastructure, transport, and manufacturing.
Fines for higher-obligations entities: up to CZK 250M (~€10.3M) or 2% of global annual turnover (whichever is higher).
Fines for lower-obligations entities: up to CZK 175M (~€7.2M) or 1.4% of global annual turnover.
National CSIRT: NÚKIB operates the national CERT.
Know exactly where you stand on NIS2 in Czech Republic.
The free self-check takes 3 minutes. It applies Czech Republic-specific rules, tells you your entity type, and recommends the right assessment plan.
Start your free self-check →