Czech Republic AI Regulation Overview

Overview

The Czech Republic's approach to artificial intelligence regulation is characterized by a deliberate transition from strategic policy planning toward structured, statutory alignment with European Union frameworks. Initially established under the National Artificial Intelligence Strategy (NAIS) in 2019 and updated to NAIS 2030 in 2024, national policy emphasizes concentrating research and development excellence, facilitating SME digital transformation, enhancing public administration services, and embedding trust and ethical safeguards into automated systems.

Operational execution relies on annual implementation packages, notably the Action Plan of the NAIS 2030 for 2025 within the broader Digitální Česko (Digital Czech Republic) programme, alongside inter-ministerial coordination via the Committee for Artificial Intelligence (Výbor pro umělou inteligenci). Following formal government decisions in May 2025, the Ministry of Industry and Trade (MPO) serves as the central coordinating body (gestor) responsible for national AI strategy and operationalising Regulation (EU) 2024/1689 (EU AI Act) across domestic authorities.

Regulatory Approach

The Czech Republic employs a hybrid governance model that combines non-binding strategic planning, conditional public funding requirements, and statutory enforcement. Policy documents like the NAIS 2025 Action Plan establish a risk-based and trust-oriented posture by making public project support contingent upon safety testing, technical documentation, model cards, mandatory risk assessments for high-impact deployments, and privacy-by-design compliance.

Binding statutory obligations are established through focused legislative measures. Rather than creating a standalone substantive regime, the pending Draft Adaptation Act to Implement the EU Artificial Intelligence Act adopts a minimalist approach that relies directly on the EU AI Act's risk classifications while defining domestic supervisory procedures, language standards, and national agency mandates. Complementing this, Act No. 264/2025 Sb. on Cybersecurity enforces mandatory risk management and incident reporting across critical societal and economic sectors.

Key AI Legislation

• National Artificial Intelligence Strategy of the Czech Republic (NAIS 2019 / NAIS 2030): Adopted in 2019 and revised in 2024, this foundational policy framework outlines long-term national objectives for research concentration, infrastructure development, workforce upskilling, and rights-respecting AI deployment.
• Action Plan of the NAIS 2030 for 2025 (RAI-CZ-NA-APNAIXX-2025): Integrated into the Digitální Česko programme, this CZK 19 billion implementation package funds applied pilots and enforces compliance expectations—including risk assessments and model documentation—for public sector and grant-supported AI deployments.
• Act No. 264/2025 Sb. on Cybersecurity (Zákon o kybernetické bezpečnosti): Enacted in 2025 to transpose the EU NIS2 Directive, this statute establishes a two-tier cybersecurity compliance framework (higher and lower obligation regimes) enforced by NÚKIB across key industrial, digital, and public services.
• Draft Adaptation Act to Implement the EU Artificial Intelligence Act (Adaptační návrh zákona o umělé inteligenci): A pending national bill designed to operationalise Regulation (EU) 2024/1689 by appointing market surveillance authorities, designating the notifying authority, establishing a national regulatory sandbox, and defining administrative penalty procedures.

Governance & Enforcement Bodies

Central policy leadership and coordination are vested in the Ministry of Industry and Trade (MPO), designated by the government as the principal gestor for national AI policy and EU AI Act implementation. MPO convenes the Committee for Artificial Intelligence (Výbor pro umělou inteligenci), an inter-agency body bringing together representatives from central ministries, regulatory authorities, academia, and industry to align policy proposals, funding allocations, and market surveillance strategies.

Enforcement responsibilities under the Draft Adaptation Act are decentralized across existing specialized regulatory bodies. The Czech Telecommunication Office (ČTÚ) is designated as the primary market surveillance authority and central contact point, while the Czech Office for Standards, Metrology and Testing (ÚNMZ) acts as the notifying authority for conformity assessment bodies. Domain-specific market surveillance is assigned to the Office for Personal Data Protection (ÚOOÚ) for privacy matters and the Czech National Bank (ČNB) for financial institutions. Additionally, the Czech Standardization Agency (ČAS) is tasked with operating the national regulatory sandbox, while the Public Defender of Rights (Ombudsman) monitors fundamental rights concerns.

Penalties & Enforcement

Administrative sanctions and enforcement mechanisms vary depending on the applicable statutory framework. Under Act No. 264/2025 Sb. on Cybersecurity, the National Cyber and Information Security Office (NÚKIB) possesses authority to conduct inspections, order binding reactive measures, and levy administrative fines. Fines can reach up to CZK 250,000,000 or two percent of global annual turnover for entities in the higher obligation regime, and up to CZK 175,000,000 or 1.4 percent of global turnover for entities in the lower obligation regime, alongside potential executive management suspensions.

For general AI regulatory compliance, the Draft Adaptation Act incorporates a pro-innovation and proportionate enforcement approach aligned with the EU AI Act framework. The draft emphasizes informal corrective measures, admonitions, and reduced fine structures for minor infringements, particularly for small and medium-sized enterprises (SMEs), while establishing a five-year statutory limitation period for administrative offences. Under policy frameworks like the NAIS Action Plan, compliance is enforced via funding conditions, where failure to maintain technical documentation or conduct risk assessments results in project suspension or reallocation of funds.

Data Protection Framework

Data protection governance in Czech AI deployments is rooted in the GDPR and national privacy legislation, overseen by the Office for Personal Data Protection (ÚOOÚ). National policy frameworks explicitly require AI developers and deployers to integrate data governance, privacy-by-design principles, and privacy impact assessments into system design, particularly when deploying automated decision-making in public services.

The Draft Adaptation Act reinforces privacy governance by formally appointing ÚOOÚ as a specialized market surveillance authority under the EU AI Act framework. In this role, ÚOOÚ is empowered to inspect and supervise AI deployments where fundamental rights to privacy and data protection are at risk, ensuring continuous cross-regulatory coordination within the Committee for Artificial Intelligence.

Sector-Specific Rules

Sector-specific AI deployment is governed through specialized administrative mandates and existing sectoral frameworks. In the financial sector, the Czech National Bank (ČNB) retains supervisory jurisdiction over financial institutions and is designated under the Draft Adaptation Act to perform market surveillance over AI systems deployed within financial markets.

In critical infrastructure sectors—including energy, transport, healthcare, water, and digital infrastructure—AI systems integrated into operational processes are subject to the cybersecurity and resilience rules of Act No. 264/2025 Sb. Furthermore, applied AI pilots in healthcare, public administration, and mobility funded under the NAIS 2025 Action Plan are overseen by executing line ministries (e.g., Ministry of Health, Ministry of Transport) and must comply with sectoral procurement guidelines, technical documentation standards, and public deployment registries.

International Alignment

The Czech Republic aligns its national AI framework closely with European Union regulations and international standards. National strategic objectives derived from NAIS 2030 mirror the EU Coordinated Plan on AI, Digital Europe priorities, and OECD principles on trustworthy AI. The primary domestic legislative effort is explicitly designed to operationalise Regulation (EU) 2024/1689 (EU AI Act) within the domestic administrative order.

Through MPO and the Committee for Artificial Intelligence, the Czech Republic coordinates its representation in EU governance structures, including the European AI Board. The national strategy also emphasizes international scientific collaboration, participation in European Digital Innovation Hubs (DIHs), and the development of "AI gigafactories" to support testing, experimentation, and scaling of AI technologies across Member States.

Future Developments

The key upcoming milestone in Czech AI regulation is the parliamentary consideration and formal enactment of the Draft Adaptation Act to Implement the EU AI Act, which completed its inter-ministerial consultation phase in late October 2025 and targets entry into force around 2026. Following enactment, secondary decrees and operational guidelines will be issued by ČTÚ, ÚNMZ, and participating regulators to finalize market surveillance and notification procedures.

In parallel, the National AI Strategy maintains a periodic updating schedule, with the next annual review of the NAIS Action Plan scheduled for 2026. Additionally, the Czech Standardization Agency (ČAS) is tasked with launching the national regulatory sandbox, providing a supervised testing environment for high-risk AI applications before full commercial deployment.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Ministry of Industry and Trade (MPO)	Principal national coordinator (gestor) for AI policy, NAIS implementation, and EU AI Act transposition. Host of the Committee for Artificial Intelligence.	Policy drafting, cross-ministerial coordination, action plan management, funding allocation oversight.	MPO AI Portal
Český telekomunikační úřad (ČTÚ)	Central market surveillance authority and public contact point for AI under the Draft Adaptation Act.	Market surveillance, public complaint handling, compliance inspections, administrative enforcement orders.
Úřad pro technickou normalizaci, metrologii a státní zkušebnictví (ÚNMZ)	Notifying authority for AI conformity assessment bodies under the Draft Adaptation Act.	Designation, accreditation, and supervision of notified bodies; registration with the European Commission.
Úřad pro ochranu osobních údajů (ÚOOÚ)	Data protection authority and designated market surveillance authority for AI implicating privacy rights.	Privacy supervision, data protection audits, market surveillance over privacy-sensitive AI deployments.
Česká národní banka (ČNB)	Central bank and financial regulator, designated market surveillance authority for AI in financial institutions.	Financial sector oversight, market surveillance over AI systems deployed in regulated financial entities.
National Cyber and Information Security Office (NÚKIB)	Primary supervisory authority for cybersecurity under Act No. 264/2025 Sb.	Central portal management, compliance audits, issuance of reactive measures, imposition of administrative fines up to CZK 250M or 2% global turnover.
Česká agentura pro standardizaci (ČAS)	Technical standardization agency designated to establish and operate the national regulatory sandbox.	Sandbox governance, administration of supervised testing environments for novel AI technologies.
Office of the Public Defender of Rights (Ombudsman)	National human rights institution tasked with fundamental rights monitoring under the Draft Adaptation Act.	Monitoring human rights impacts, reviewing fundamental rights compliance in AI enforcement and sandbox governance.