Since 1 November 2025 a new Czech Cybersecurity Act, No. 264/2025 Coll., has been in force. It is the Czech implementation of the EU NIS2 directive, and instead of roughly a hundred institutions it now covers thousands of companies and organisations. There is a lot of uncertainty around it, though. School heads and doctors ask us whether they have to report anything and whether they face fines in the millions. Here is a short answer for those who do not have time to read the act and its implementing decrees.

Who the act applies to

The act is not aimed at "computers" but at regulated services. These are listed in Decree No. 408/2025 Coll. on regulated services across fifteen sectors, including energy, transport, manufacturing, healthcare, digital infrastructure, waste and public administration. The act works on the principle of self-identification: nobody will write to you, you have to assess yourself whether it applies to you.

For most services, size matters as well as the sector. In general, the act covers medium-sized and large enterprises, meaning those that have:

  • 50 or more employees, or
  • annual turnover and balance sheet total both above EUR 10 million.

Some services are regulated regardless of size, for example providers of certain electronic communications services or critical infrastructure entities. NÚKIB (the Czech National Cyber and Information Security Agency) can also designate a smaller entity if its service is essential to the state.

Medical practices and pharmacies

Healthcare is on the list, as the service "provision of healthcare". However, a stand-alone practice or pharmacy with a few employees will usually not meet the size condition, so the act does not apply to it.

Watch out for one trap: size also includes linked and partner enterprises. If a practice or pharmacy belongs to a group of companies with a common owner, the employees and turnover of the whole group are added together. A "small pharmacy" can then become a medium-sized enterprise. Polyclinics, larger healthcare facilities and pharmacy chains therefore need to go through this carefully.

Schools

NÚKIB is clear on this: education in itself is not a regulated service. An ordinary primary school or kindergarten therefore does not fall under the act. The exception would be a school that also provides one of the regulated services, which is very unlikely for an ordinary school run by a municipality.

That does not mean cybersecurity is not a concern for schools. Schools handle personal data of children and parents under the GDPR, and ransomware attacks on schools are common.

Small businesses

A company with fewer than 50 employees and turnover below EUR 10 million usually does not fall under the act, unless it provides one of the exceptional services. It can still affect you indirectly. Regulated customers must also look after the security of their suppliers, so requirements for backups, access management or incident reporting are making their way into contracts and tenders. If you supply a hospital, an energy company or a large manufacturer, expect this.

How to check

  1. Go through our simple test. In a minute it will tell you whether you should pay attention.
  2. For a binding assessment, use the calculator and self-identification guide on the NÚKIB Portal. It is the agency's official tool.
  3. If you are not sure, ask a lawyer or NÚKIB directly. It is worth having the assessment in writing.
An IT specialist and a company director at a whiteboard with the procedure drawn on it, the director signing a document
Notification, the registration decision and a year to put measures in place.

If the act applies to you

  • Notification on the NÚKIB Portal within 60 days of meeting the conditions. Those who already met them when the act came into force should have done so by the end of 2025. If you missed that, do not put it off any longer.
  • Lower or higher obligations regime. Most newly regulated companies will fall into the lower regime, which requires basic measures that are actually carried out.
  • One year to put measures in place from delivery of the registration decision: access management, backups, updates, protection against malicious code, an asset inventory, staff training and a procedure for handling incidents.
  • Incident reporting. A significant incident must be reported within 24 hours of detection, with a more detailed notification within 72 hours.
  • Management responsibility. The statutory body is responsible for cybersecurity; it cannot simply be "handed off to the IT guy".

The fines are high: in the lower regime up to CZK 175 million or 1.4% of turnover. But the agency's aim is not to punish those who are making an effort. The worst strategy is to do nothing and hope nobody finds out.

The measures pay off even without the act

Most of what the act requires is ordinary good practice: a working, tested backup kept outside the building, up-to-date systems (see the end of Windows 10), strong passwords with two-factor sign-in, a separate network for guests and an overview of who has access to what. A practice or school that has these in place is better off than many regulated companies.

Does the act apply to you, or are you not sure? We will go through the self-identification with you and prepare the technical side of the measures, from backups to incident reporting. Get in touch.

Note: this article is a general summary, not legal advice. A binding assessment of your case can be given by NÚKIB or a lawyer.