Who is affected?
The New Cybersecurity Act, which implements the EU NIS2 Directive, went through the third reading in the Chamber of Deputies. It is now awaiting approval by the Senates and the President’s signature. After the law comes into effect, companies will have 60 days to register on the NÚKIB portal and one year to comply with the new obligations.
The new Act expands the scope of regulated entities from the original few hundred to approximately 10,000 (some sources state 8,000 or even 12,000) across 22 different industries, including energy, transportation, healthcare, food industry, and many others.
In each industry, regulated services are precisely listed – more than 100 in total. These services are considered the most critical and require enhanced protection in the field of cybersecurity.
Whether the new law affects you depends on the size, type, and scale of services that you provide. For quick verification, you can use publicly available tools, including our guide URCI.SE.
Timeline
Key obligations
Self-identification and registration: All companies must assess whether they fall under the regulation and register on the NÚKIB Portal within 60 days of either the law’s effectiveness or upon discovering that they provide a regulated service.
Implementation of security measures: Implement security measures to ensure cybersecurity under higher or lower levels of requirements. The implementation of basic security measures should take from 3 to 12 months.
Risk and Incident Management: Conduct risk analyses, establish information system security policies, report incidents, and ensure the security of the supply chain.
Roles and Documentation: Fill security roles, manage and update documentation, and establish systems for event monitoring.
Engage Leadership in Cybersecurity: Top management will need to take responsibility for cybersecurity. This means knowing key information, understanding the impacts of their decisions, supporting security, and undergoing regular training.
What are the penalties?
Failure to comply with the obligations can lead to fines of up to CZK 250 million or up to 2 % of the company's total annual turnover.
