Czech Republic - Cybersecurity Act (264/2025)

Overview

The Act on Cybersecurity (Act No. 264/2025 Sb.) establishes a modern, NIS2-aligned Czech regulatory framework for the protection of national cyberspace and the resilience of services critical to society and the economy. Adopted on 11 June 2025 and published in the Collection of Laws on 4 August 2025, it entered into force on 1 November 2025. The Act expands sectoral coverage, introduces a self-identification and registration model via the official NÚKIB portal, and differentiates obligations through a two-tier regime. The National Cyber and Information Security Office (NÚKIB) exercises broad supervisory, investigative, and enforcement powers. For official published text, see Act No. 264/2025 Sb., and for regulator guidance, see NÚKIB Regulation and Control.

Definitions

The Act defines key terms that structure scope and obligations, including "regulated service" (services meeting statutory criteria in listed sectors), "provider of a regulated service", "regime of higher obligations" (entities of strategic, essential significance) and "regime of lower obligations" (entities of important significance), "cybersecurity incident" (events with cyber origin causing or likely to cause operational, financial or integrity harm), "critical information infrastructure" and "national CERT". Definitions align closely with NIS2 language to ensure interoperability with EU reporting and certification instruments. The detailed statutory definitions are set out in the opening sections and in implementing regulations and are essential for applying thresholds and reporting duties.

Governance and Institutional Framework

The Act assigns central supervisory responsibility to the National Cyber and Information Security Office (NÚKIB) which manages registration, oversight, incident evaluation and enforcement. NÚKIB operates in coordination with the National CERT (GovCERT/Národní CERT) for incident intake, technical support and international exchange. Sectoral regulators (e.g., the Czech National Bank in finance, health ministry in healthcare, Energy Regulatory Office in energy) retain parallel powers for sector‑specific supervision and can cooperate with NÚKIB under memoranda and statutory provisions. The Act authorises NÚKIB to maintain public registers, issue binding reactivemeasures and general measures, require supplier risk mitigation, order audits, demand documentation and to apply administrative sanctions. The law also frames interagency cooperation and data‑sharing protocols to ensure confidential information is protected while enabling effective oversight; see NÚKIB guidance at NÚKIB - Regulation and Control and practical portal instructions at the NÚKIB Portal portal.nukib.gov.cz.

Key Focus Areas

The Act concentrates on (1) scope and registration: organisations operating in 15 broad sectors must self‑identify and, if criteria are met, register regulated services through the NÚKIB portal within statutory deadlines; (2) risk management: providers must implement governance, asset and vulnerability management, supplier and supply‑chain risk management, cryptography and patch management, backup and continuity planning; (3) incident reporting and response: the Act stipulates initial notification timelines (without undue delay; initial reporting for many incidents expected within 24 hours) and follow‑up reporting, plus cooperation with NÚKIB and CERTs for mitigation and coordinated disclosure; (4) accountability and corporate governance: statutory responsibility sits with management and boards, including obligations to ensure resources, training and management oversight; (5) supervision and enforcement: NÚKIB can issue orders, impose fines and coercive measures and require remediation plans; (6) transparency: certain reporting, evidence retention and possible public disclosure of systemic weaknesses or sanctions are foreseen; and (7) international cooperation and alignment with EU cyber certification frameworks. Extensive implementing measures and sectoral rules clarify thresholds and technical details.

Implementation Framework

The Act sets an implementation architecture combining primary law with secondary instruments: NÚKIB implementing decrees, technical standards and operational guidelines, plus sectoral regulations and cooperation agreements. Entities that meet statutory thresholds must self‑identify (samoidentifikace) and register regulated services via the NÚKIB portal; NÚKIB classifies services into higher or lower obligation regimes, issues registration certificates and publishes certain registry data internally for supervisory use. Providers are obliged to maintain documented information security management systems (ISMS), keep audit trails of decisions and incidents, perform periodic audits and penetration tests, engage in supplier due diligence and provide contact and operational information to NÚKIB. Transitional and grandfathering rules allow previously regulated entities to map existing duties into the new two‑tier system; see the transitional provisions in §71 and related articles. The practical operational steps and templates for registration, notification and coordination are published by NÚKIB on the portal; see NÚKIB Portal and NÚKIB’s "Regulation and Control" page at NÚKIB.

Monitoring and Evaluation

NÚKIB is charged with monitoring compliance through self‑reporting, mandatory notifications, targeted inspections and evidence required during audits. The Act requires NÚKIB to maintain registers and an evidence database for incidents, vulnerabilities and enforcement actions. Periodic review cycles, reporting obligations and evaluation clauses are built into the law to align national measures with EU monitoring and to permit NÚKIB to revise technical guidance and thresholds. The law also obliges providers to keep records of security measures, incident handling and supplier assessments for supervisory review. The Act foresees cooperation with sectoral regulators who may conduct parallel checks and share findings with NÚKIB under confidentiality safeguards.

Penalties, Liability, and Appeals

The Act defines administrative sanctions and offence regimes for non-compliance. In the higher obligation regime, maximum administrative fines reach up to CZK 250,000,000 or 2% of total global annual turnover, whichever is higher. In the lower obligation regime, statutory maximum fines reach up to CZK 175,000,000 or 1.4% of global turnover. NÚKIB is empowered to issue corrective orders, impose coercive fines, restrict or suspend the provision of regulated services, and in severe cases temporarily suspend management activities of responsible executive officers. Decisions issued by NÚKIB are subject to administrative appeal and judicial review under Czech administrative law.

Relationship to Other Instruments

The Act operates alongside and amends a range of existing Czech laws (including sectoral statutes) so that responsibilities for cyber‑security are coherent across banking, energy, healthcare and communications law. It transposes Directive (EU) 2022/2555 (NIS2) into national law and references EU cyber certification regulation (Regulation (EU) 2019/881). The Act modifies and integrates previous domestic cybersecurity duties and creates cross‑references that require updates to other statutes (many of which were amended by implementing acts such as Act No. 265/2025 Sb.). Sectoral regulators maintain parallel powers where sector law demands it; the Act specifies cooperation mechanisms and data‑sharing rules to avoid conflicting supervision.

International Alignment

The Act intentionally aligns Czech obligations with NIS2 and relevant EU instruments to enable interoperability within the EU incident reporting, information sharing and certification frameworks. It establishes provisions for sharing incident and vulnerability data with international partners and ENISA where appropriate, while safeguarding confidentiality under Czech law. The Act also contemplates alignment with EU cyber certification schemes and allows NÚKIB to participate in EU‑level certification and coordination activities. Cross‑border notification rules reflect NIS2 requirements regarding incidents with potential or actual cross‑border impact.

Implementation Timeline

Sources and References