Cybersecurity law & regulation in Czechia (2026)

Legal framework

Act No. 264/2025 Coll. on Cybersecurity (Zákon o kybernetické bezpečnosti), in force 1 November 2025, transposing EU NIS2 Directive (2022/2555); supervised by NÚKIB (National Cyber and Information Security Agency)

NIS2 & cybersecurity law in Czechia

In Czechia, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Czechia implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Czechia

1. 01NIS2 Transposition, Act No. 264/2025

   The Chamber of Deputies passed the act on 25 April 2025; it was signed by the President on 26 June 2025, published in the Collection of Laws on 4 August 2025, and entered into force on 1 November 2025, missing the EU's 17 October 2024 deadline. It replaces the earlier cybersecurity act entirely.

   rowan.legal cliffordchanceprague.com nukib.gov.cz

2. 02Scope, Essential vs. Important Entities

   The act covers entities with ≥50 employees or annual turnover/balance sheet >€10 million operating in 15 sectors (energy, healthcare, transport, finance, digital infrastructure, food, manufacturing, etc.), classified as either 'essential entities' (higher obligations) or 'important entities' (lower obligations). Entities had 60 days from 1 November 2025 to self-assess and register with NÚKIB.

   iclg.com portal.nukib.gov.cz twobirds.com

3. 03Incident Reporting Obligations

   Essential entities must report to NÚKIB all cybersecurity incidents affecting their regulated service that originate in cyberspace and where intentional conduct cannot be excluded; important entities must report incidents with a significant impact on service provision, with reports directed to the national CSIRT. The act goes beyond the NIS2 minimum by requiring reporting of all (not only significant) incidents for essential entities.

   cms.law bnt.eu iclg.com

4. 04Risk Management & Governance Duties

   Regulated entities must implement technical and organisational cybersecurity measures, ensure top-level management oversight and cybersecurity training, conduct supply chain risk assessments, and maintain business continuity plans for serious cyber incidents. NÚKIB may request extensive supply-chain information and prohibit or restrict use of specific suppliers deemed security risks.

   pwc.com twobirds.com

5. 05Penalties

   Essential entities face fines of up to CZK 250 million or 2% of global annual turnover (whichever is higher); important entities face up to CZK 175 million or 1.4% of global annual turnover. NÚKIB may also impose coercive fines up to CZK 10 million, suspend operations, require remediation, and in cases of repeated serious management failures, take action affecting corporate bodies.

   iclg.com rowan.legal bnt.eu

6. 06Pending Secondary Legislation & 2026 Outlook

   As of early 2026, several Government regulations implementing the act, particularly on essential functions and strategically significant services with enhanced supply-chain resilience requirements, remained pending. NÚKIB was processing entity registrations submitted by the December 2025 deadline; once confirmed, a one-year transitional compliance period begins before full enforcement of all security controls and reporting obligations.

   twobirds.com nis2.nukib.gov.cz portal.nukib.gov.cz

NIS2 in Czechia: FAQ

Timeline of decisions

1. 1 Nov 2025Law · official
   New Cybersecurity Act (No. 264/2025 Coll.) Enters into Force – NIS2 Transposition

   Act No. 264/2025 Coll., signed June 2025 and published in the Czech Collection of Laws on 4 August 2025, repealed the 2014 Cybersecurity Act and fully transposed the EU NIS2 Directive; it dramatically expanded the regulated population from roughly 400 to an estimated 6,000–15,000 entities across 18 sectors and imposed stricter incident-reporting timelines, supply-chain security requirements, and top-management accountability, with NÚKIB as the central enforcer.

   NÚKIB – National Cyber and Information Security Agency

2. 1 Nov 2025Law
   New Cybersecurity Act No. 264/2025 Enters into Force

   Act No. 264/2025 Coll., transposing EU NIS2 Directive, became effective and expanded Czech cybersecurity obligations to an estimated 6,000–15,000 regulated entities across energy, healthcare, finance and digital infrastructure — each carrying data-security duties enforced by NÚKIB with significant financial penalties for non-compliance.

   Clifford Chance Prague

3. 3 Sept 2025Guidance · official
   NÚKIB Formal High-Risk Warning: Chinese Technology Transfers and Remote Administration

   NÚKIB issued a formal high-risk warning (probability 'likely to very likely') advising critical-infrastructure operators against products and services that send data to or allow remote management from the People's Republic of China, covering IP cameras, PV inverters, smart meters, connected vehicles, cloud storage, and LLMs. Entities regulated under the Cybersecurity Act must integrate this risk into mandatory risk analyses and apply commensurate controls.

   NÚKIB

4. 4 Aug 2025Law · official
   New Cybersecurity Act No. 264/2025 Enacted, Full NIS2 Transposition (Effective 1 Nov 2025)

   The Czech Parliament enacted Act No. 264/2025 Coll. on Cybersecurity, published in the Official Gazette on 4 August 2025 and entering into force 1 November 2025. It replaces Act No. 181/2014, expands regulated entities from roughly 400 to an estimated 6,000-15,000 across 18 sectors, introduces essential/important entity tiers, mandatory supply chain risk management, executive accountability, 24-hour incident reporting, and fines up to CZK 250 million or 2% of global annual turnover.

   NÚKIB

5. 26 Jun 2025Law
   Czech Parliament Adopts New Cybersecurity Act Transposing NIS2

   Parliament enacted Act No. 264/2025 Coll., replacing the 2014 Cybersecurity Act, significantly broadening the scope of regulated entities, raising management accountability, and aligning Czech law with EU NIS2 Directive obligations on incident reporting and data-security measures.

   Rowan Legal

6. 28 May 2025Incident · official
   Czech Government Publicly Attributes APT31 (China/MSS) Espionage Campaign Against Ministry of Foreign Affairs

   The Czech Government formally attributed a cyber-espionage campaign active since at least 2022 to APT31, assessed with high certainty to be operated by China's Ministry of State Security, which had persistently targeted the unclassified network of the Czech Ministry of Foreign Affairs, designated critical infrastructure. The attribution was concluded jointly by all four Czech intelligence and security agencies.

   NÚKIB

7. 3 May 2024Incident · official
   Czechia Publicly Attributes APT28 (Russia/GRU) Attacks on Political Institutions; Joins EU-NATO Condemnation

   The Czech MFA, alongside Germany, the EU, and NATO, formally attributed to Russia's GRU-linked APT28 a campaign exploiting a Microsoft Outlook zero-day (CVE-2023-23397) to target Czech political entities and government institutions. The EU Council issued a parallel statement condemning Russia's 'continuous pattern of irresponsible behaviour in cyberspace.'

   Czech Ministry of Foreign Affairs

8. 1 Jan 2020Guidance · official
   National Cybersecurity Strategy of the Czech Republic 2021-2025 Adopted

   The Czech Government adopted its second National Cybersecurity Strategy, covering 2021-2025 with an accompanying Action Plan. Built with input from dozens of public and private organisations, it established binding goals across three pillars: confidence in cyberspace, strong international alliances, and a resilient digital society, and set the institutional agenda for NÚKIB's regulatory expansion.

   NÚKIB

9. 3 May 2019Guidance · official
   Prague 5G Security Conference, 'Prague Proposals' Published

   Hosted by the Czech Government and NÚKIB, the conference brought together representatives from 30+ countries, the EU, and NATO to address 5G supply-chain risks. The resulting 'Prague Proposals' became an internationally influential framework recommending vendor evaluation based on rule-of-law, transparency, and security, effectively providing the geopolitical and technical rationale for restricting high-risk vendors such as Huawei in critical networks.

   Czech Government

10. 17 Dec 2018Guidance · official
    NÚKIB Issues First National Security Warning Against Huawei and ZTE Products

    NÚKIB issued a formal warning declaring that hardware and software of Huawei Technologies and ZTE Corporation posed a threat to national security, citing Chinese law's compelled-cooperation provisions for private companies. The warning directed critical-infrastructure operators to treat these vendors as high-risk and pre-dated similar actions by most EU partners, establishing Czechia as an early mover in the Western 5G vendor debate.

    NÚKIB

11. 1 Aug 2017Law · official
    NÚKIB Established as Standalone National Cybersecurity Authority

    Act No. 205/2017 Coll. amended the 2014 Cybersecurity Act to separate cybersecurity functions from the National Security Authority and create the National Cyber and Information Security Agency (NÚKIB) as the dedicated central administrative body. NÚKIB assumed responsibility for regulation and audit of critical entities, national CERT/CSIRT coordination, and international cyber diplomacy, also transposing core NIS Directive obligations into Czech law.

    NÚKIB

12. 1 Jan 2015Law
    Act No. 181/2014 Coll. on Cybersecurity Enters into Force

    Czech Republic's first dedicated cybersecurity law entered into force, placing mandatory security obligations and incident-reporting duties on critical infrastructure operators, directly complementing the data-protection framework by requiring measures to prevent data breaches via cyberattacks.

    PwC Czech Republic

13. 23 Jul 2014Law · official
    Czech Cybersecurity Act No. 181/2014 Enacted, First Dedicated Cybersecurity Law in Central Europe

    The Czech Parliament enacted Act No. 181/2014 Coll. on Cyber Security, establishing the country's first comprehensive cybersecurity legal framework. It imposed mandatory security measures and incident-reporting obligations on operators of critical information infrastructure and important information systems, and created the National Security Authority as the supervising body, one of the earliest such laws in the EU, predating the EU NIS Directive by two years.

    NÚKIB

Sources

1. 1.nukib.gov.cz/en/cyber-security/regulation-and-audit/legislation/
2. 2.portal.nukib.gov.cz/information-about-portal-nukib
3. 3.nis2.nukib.gov.cz/
4. 4.rowan.legal/en/news/new-cybersecurity-act-to-implement-nis2/
5. 5.cliffordchanceprague.com/nis-2-in-czech-practice-the-new-cybersecurity-framework-effective-fro
6. 6.iclg.com/practice-areas/cybersecurity-laws-and-regulations/czech-republic
7. 7.cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
8. 8.twobirds.com/en/insights/2026/what-to-expect-in-2026-in-czech-cybersecurity-and-te
9. 9.bnt.eu/legal-news/czechia-new-cyber-security-act-what-does-it-mean-for-your-
10. 10.pwc.com/cz/en/akademie/cyber-security-act.html
11. 11.twobirds.com/en/insights/2025/czech-republic/czech-republic-%E2%80%93-nis2-impleme