NIS2 obligations in Czechia

Competent authority & CSIRT

• National Cyber and Information Security Agency (NÚKIB) National CERT ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 4,5

• NIS2 as well as the defence industry sector. ecs-org.eu · 28 Oct 2026 · secondary source
• Medium-sized or large enterprises, significant for the provision of services on a regional or national level. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities are categorised into two different regimes of obligations: higher obligations (essential entities) and lower obligations (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Additional thresholds are provided to show that entities further meet the conditions for registration: impact of a disruption on the security of the Czech Republic, internal order, life and health, potential cross-border impact, impact on at least 125,000 people, impact on property value or the environment. Sector-specific thresholds (for instance, an entity could be considered essential based on criteria such as being a large enterprise in electricity production or having a certain output, and similar thresholds for the gas storage sector) ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 6, 11

• A service provider that meets the conditions of registration laid out in Article 4 must report this service to the National Cyber and Information Security Agency no later than 60 days from the date on which conditions are met. ecs-org.eu · 28 Oct 2026 · secondary source
• The procedure for registering a regulated service that meets the conditions for registration under Article 5 can only be initiated by the National Cyber and Information Security Agency. ecs-org.eu · 28 Oct 2026 · secondary source
• The provider of a regulated service shall report contact details and additional data (ownership, technical data, geographical spread, cross-border provision) to NÚKIB no later than 30 days from the date of the delivery of the decision on registration. ecs-org.eu · 28 Oct 2026 · secondary source
• The National Cyber and Information Security Agency shall determine by decree the format and method of reporting. NÚKIB shall also decide on the registration of a regulated service if the conditions of registration laid out in articles 4 or 5 are met. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 15, 16

• Affected companies do not have to report incidents until 1 year after receipt of the registration confirmation. ecs-org.eu · 28 Oct 2026 · secondary source
• Important entities shall report significant incidents to the National CERT with an initial report within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Essential entities shall report incidents to the National Cyber and Information Security Agency, through the NÚKIB Portal, according to the following timeline: ecs-org.eu · 28 Oct 2026 · secondary source
• Initial report within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours (within 24 hours if the entity is a provider of trust services under directly applicable European Union legislation). ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report with up-to-date information at the request of the national CERT or NÚKIB. ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 30 days after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing), no later than 30 days after sending the incident report, and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Affected companies do not have to report incidents until 1 year after receipt of the registration confirmation. Increased scope for reporting of incidents that goes beyond reporting of significant incidents. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 59

• Up to 250,000,000 CZK or up to 2% of the total worldwide annual turnover for essential entities. ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 175,000,000 CZK or up to 1.4% of the total worldwide annual turnover for important entities. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 13,14

• The provider of a regulated service is obliged to implement security measures laid out in Article 14. The content of these measures and the method of their implementation shall be determined by the National Cyber and Information Security Agency (NÚKIB) by decree. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final Text

What changed recently

1. 1 Nov 2025
   National NIS2 law enters into force (per tracker) ecs-org.eu secondary source