- Hana Skoupá
- 5 min read
A notice from NÚKIB (the National Cyber and Information Security Agency) doesn’t mean your organisation automatically falls under the new Cybersecurity Act. It does mean you need to review your situation and reply within the deadline stated in the notice. Below is a practical guide to structuring the assessment, who should be involved, and what to do depending on the outcome.
What the letter from NÚKIB means
NÚKIB may ask an organisation to check whether it provides a regulated service. The agency doesn’t need to know every detail of your business to do so. It may be working from public registers, available data or the nature of the sector you operate in.
So don’t treat the notice as automatic confirmation that the Act applies to you – but don’t shelve it as irrelevant either. What’s expected is a well-founded assessment and a reply that follows the instructions in the notice.
Step-by-step guide
1. Map the services you actually provide
Start with what you really do, not just your entry in the Commercial Register. List both the core and secondary services your organisation actually provides. Contracts, product sheets, your website, price lists, an internal service catalogue or invoicing records can all help. For each service, note down:
- what exactly you provide to the customer or user,
- who uses the service and in which territory,
- which legal entity provides it under contract,
- whether it is your own service or merely support for another company in the group,
- how essential the service is to your customers’ operations or to the public.
2. Compare your services against the decree on regulated services
The new Act works with specific regulated services in individual sectors. A conclusion like “we’re a manufacturing company” or “we work in IT” therefore isn’t enough. For every potentially relevant service, you need to go through its legal definition and the related conditions.
For an initial check, you can also use the free Urči.seguide. Keep in mind, though, that the result of this indicative tool doesn’t replace an assessment of the specific service – especially for more complex groups or non-standard business models. You’ll find more detail in our article What is self-identification under the new Cybersecurity Act.
3. Check the size of your organisation and other conditions
For many regulated services, the size of the enterprise is decisive. But it isn’t always just about the headcount of a single company. Financial thresholds and relationships with partner or linked enterprises may also come into the calculation. If you’re part of a group, bring in someone who understands the ownership structure and can provide the figures you need.
Some services also have criteria of their own. These may include the number of users, the scope of the service, the provider’s special status, or the fact that the service can’t easily be replaced. So assess each service against the rules that apply specifically to it.
4. Determine your regime of obligations
5. Document your conclusion so it can be traced back
Whether you conclude that you must register a regulated service or that the Act doesn’t apply to you, keep the supporting documents and the reasoning behind your decision. A short internal record should state the services assessed, the criteria applied, the data sources, the outcome and the date of the assessment.
A record like this will help you both when replying to NÚKIB and later on, if your activities, the size of your organisation or your group structure change. Self-identification isn’t a one-off task. Whenever circumstances change, you need to reassess whether the Act applies to you.
How to reply to NÚKIB
Follow the instructions and the deadline in the letter exactly. Your reply should be brief, factual and based on the assessment you’ve carried out. Don’t automatically send more internal information than the agency asks for, but be ready to back up your conclusion.
Depending on the outcome, one of two scenarios applies:
- You don’t provide a regulated service. Inform NÚKIB of your conclusion and explain the key reasons, to the extent the notice requires. Keep your internal documentation on file.
- You do provide a regulated service. Register the service via the NÚKIB Portal and continue with the registration process.
NÚKIB publishes a dedicated guide, How to register a regulated service and a Registration and management of a regulated service section directly on the NÚKIB Portal.
Watch the registration deadline
The general deadline for registering a regulated service is 60 days from the moment the organisation starts meeting the relevant conditions. For organisations that already met the conditions when the Act took effect on 1st November 2025, the original deadline expired on 31st December 2025.
If you missed that deadline, don’t wait for another notice. Complete the assessment as quickly as possible, register the service if required, and decide on next steps based on your specific situation. The deadline stated in your current letter from NÚKIB may be different, and you must meet it separately.
What comes after registering a regulated service
Registration isn’t the finish line – it’s where your ongoing obligations begin. After registering, you’ll mainly need to deal with reporting contact details, assigning responsibilities, defining the scope of cybersecurity management, security measures, documentation, suppliers, training and the incident reporting process.
A practical first step is a gap analysis . It shows what already works in your organisation, what you can carry over from ISO 27001 or other internal policies, and what’s genuinely missing. Only then does it make sense to put together an implementation plan with task owners, a budget and priorities.
Most common self-identification mistakes
- Assessing only the main line of business rather than the services actually provided.
- Determining size based on a single company without checking linked and partner enterprises.
- Reaching one conclusion for the whole group, even though each legal entity is assessed separately.
- Finding one regulated service and not checking other services that could change the regime of obligations.
- Leaving the outcome in an email or in one person’s head, with no evidence of what it was based on.
- Putting off implementation after registration instead of immediately mapping the current state and preparing a plan.
When it makes sense to bring in an expert
An organisation can assess a straightforward situation on its own. A consultation pays off mainly when you provide multiple services, are part of a group or operate in several sectors, when it’s unclear who the actual service provider is, or when you’re close to the size thresholds or other criteria.
