Czechia NIS2: security measures due one year after NÚKIB registration
Under Czech Act 264/2025, security measures and incident reporting apply one year after NÚKIB's registration decision: early 2027 for many.
Czechia's NIS2 law, Act No. 264/2025 Coll. on cybersecurity, has applied since 1 November 2025. The registration phase is over. The next deadline is the one that matters most: under §§ 13 and 15 of the Act, a provider must start applying the security measures and reporting incidents no later than one year after the registration decision from NÚKIB was delivered.
Who is covered and where registration stands
The criteria are set by Decree No. 408/2025 Coll. on regulated services. NÚKIB has long expected about 6,000 organisations to fall under the Act: companies, public authorities, regions, municipalities and others. Those that met the criteria on 1 November 2025 had 60 days to notify their service, a period that ended on 31 December 2025. By 8 February 2026, 4,825 had done so, and NÚKIB sent them a registration decision.
NÚKIB urges anyone who has not notified to do it without delay. It notes that the length of the period in which obligations are not met affects any later penalty.
Key deadlines
- Notification: within 60 days of meeting the criteria, through Portál NÚKIB (§ 6).
- Contact and supplementary data: within 30 days of the registration decision; changes within 14 days (§ 11).
- Security measures: within one year of the registration decision, under Decree 409/2025 (higher regime) or Decree 410/2025 (lower regime) (§ 13).
- Incident reporting: an initial report within 24 hours of detection; for an incident with a significant impact, a notification within 72 hours and a final report within 30 days of that notification (§ 16). The duty starts within the same one-year period (§ 15).
For an organisation whose decision was delivered in early 2026, the year runs out in early 2027. The exact date follows from the delivery of your own decision.
Fines
For the higher regime, fines reach CZK 250 million or 2% of worldwide annual turnover, whichever is higher. For the lower regime, CZK 175 million or 1.4% (§ 59).
What to do now
Check the delivery date of your registration decision, determine your scope under § 12 and plan the measures of your regime before the year is up. For the lower regime, NÚKIB has published a manual with practical examples and a template for the required overview of measures.
Dazr Compliance includes the measures of Decrees 409/2025 and 410/2025 as a ready-made framework on every plan, Free included. Each measure becomes a recurring task with an owner, evidence and reminders, and the incident register counts down the 24-hour, 72-hour and 30-day deadlines.
Sources
- e-Sbírka: Act No. 264/2025 Coll., on cybersecurity
- e-Sbírka: Decree No. 409/2025 Coll. (higher regime)
- e-Sbírka: Decree No. 410/2025 Coll. (lower regime)
- NÚKIB: Byl publikován nový zákon o kybernetické bezpečnosti
- NÚKIB: Portál NÚKIB becomes the mandatory platform (3 November 2025)
- NÚKIB: Over 4,800 organisations have notified under the new act (11 February 2026)
- NÚKIB: Manual for providers in the lower regime (31 March 2026)
For information only, not legal advice. Last updated 7 November 2026.
Also available in: Čeština