Czechia NIS2 Implementation: Act 264/2025, NÚKIB regimes and deadlines

Czechia's Cybersecurity Act (No. 264/2025 Coll.) has applied since 1 November 2025, and for most entities that registered at the end of 2025 the one-year period to put security measures and incident reporting in place runs out in late 2026 or early 2027. The Czech law departs from the Directive's vocabulary: it regulates "providers of regulated services" in a higher or lower regime, with a third strategic layer for the most important services, and the National Cyber and Information Security Agency (NÚKIB) as the single regulator. This guide covers the regimes, the NÚKIB Portal notification, the implementing decrees, reporting, sanctions, supplier rules, and what the measures mean for service accounts, API keys and AI agents. It is for CISOs, compliance leads and auditors with Czech entities. The Directive is covered in the NIS2 Directive Guide and the cross-country status in the NIS2 Transposition Tracker.

Sources and status, checked 9 November 2026: the effective date, decrees, Portal and registration window come from NÚKIB's own pages and its guide to the new Act (version 1.0, 20 October 2025, hosted by the Confederation of Industry). The Act text on e-Sbírka and NÚKIB's Portal guide could not be read during research, so deadlines within the year, reporting times and fines are based on secondary sources: Lupa.cz, Právní prostor and the Czech Bar Association's Advokátní deník. Figures appear only where two sources agree. Confirm against the official text before relying on it. This page is not legal advice.

Key takeaways

• Self-identify, then notify: organisations decide for themselves whether they provide a regulated service under Decree 408/2025 and notify NÚKIB through its Portal within 60 days; for the launch cohort that meant by the end of 2025.
• The clock starts at registration: secondary sources agree that the security measures and incident reporting duties start one year after NÚKIB's registration decision, so the dates differ per entity.
• Two regimes, one per organisation: Decree 409/2025 sets higher-regime measures and Decree 410/2025 lower-regime measures; if any service is higher regime, the whole organisation follows the higher regime.
• Higher-regime fines reach CZK 250 million: or 2% of worldwide net turnover, according to two secondary sources.
• Machine identities are inside the measures: MFA, logging and access control in the decrees reach service accounts, keys and AI agents.

Scope: regulated services and regimes

NÚKIB's guide says the Act applies to providers of regulated services: an organisation is covered if it provides at least one regulated service, defined mainly by Decree No. 408/2025 Coll. NÚKIB published a calculator and guidance on its Portal to help with self-identification, and Lupa.cz estimates more than 6,000 organisations are affected.

• Size benchmark: Právní prostor notes that size follows Commission Recommendation 2003/361/EC, with headcount, turnover and balance sheet.
• Public sector: Decree 411/2025 covers security levels for public administration information systems and Decree 412/2025 security rules for public bodies using cloud services (Lupa.cz). NÚKIB runs separate desks for public bodies and for digital services and infrastructure, including cloud.
• Digital providers: Implementing Regulation (EU) 2024/2690 applies to DNS, cloud, data centre, managed service and similar providers. See the NIS2 Implementing Regulation 2024/2690 Guide.
• Financial sector: DORA applies to financial entities. See the DORA and NIS2 Overlap Mapping Guide.

Notification on the NÚKIB Portal

1. Sign in to the NÚKIB Portal with the national identity scheme (NIA ID, for example BankID or eObčanka), according to Advokátní deník.
2. In "Chci vyřídit", choose the regulated service notification and identify the statutory body and, if designated, the person responsible for cybersecurity.
3. File within 60 days of the law applying to you (Advokátní deník; Právní prostor).
4. After NÚKIB's registration decision, add contact and supplementary details within 30 days (Právní prostor; Lupa.cz).
5. Keep the data current: Advokátní deník reports a deadline for updating changes such as a new responsible person or the end of a service; check the period in the Act.

Portal access is privileged: the person who can notify and report for the company holds a powerful identity. Record who it is, keep a deputy and review the access on role change.

Timeline

Find your registration decision date: that, not 1 November 2026, sets your deadline.

Key obligations

Security measures

Lupa.cz summarises the duties as risk analysis, an information security management system, incident detection and reporting, supplier security, regular staff training, and technical measures such as MFA, network segmentation, encryption and logging. The detailed controls are in Decree 409/2025 (higher) or 410/2025 (lower), which you should read in full. ISO/IEC 27001 work maps well to the management system parts; see the ISO 27001 Certification Guide.

Management and roles

• Top management: Lupa.cz reports that top management is responsible for overseeing cybersecurity.
• Contact person: every regulated organisation names a contact for NÚKIB (Lupa.cz).
• Cybersecurity manager: required in the higher regime (Lupa.cz).
• Office bans: Právní prostor reports that for repeated or serious violations in the higher regime, a member of the statutory body can be temporarily barred from office. See the NIS2 Management Liability Executive Briefing.

Incident reporting

Since 1 November 2025 incidents are reported through a form on the NÚKIB Portal (NÚKIB). Lupa.cz and Právní prostor both give the stages as an initial report within 24 hours of detection, a follow-up within 72 hours and a final report within one month (Právní prostor: 30 days after the incident is resolved). See the Cyber Incident Reporting Requirements Map.

Strategic services and suppliers

Právní prostor describes a strategic layer: providers of strategically significant services must vet suppliers of security-relevant deliveries to the critical part of their scope, and NÚKIB, with intelligence services and other bodies, can on a government decision set conditions on or prohibit a supplier judged risky. Lupa.cz noted that a government regulation on supply chain security was still awaited when the Act took effect. Check its status before relying on this section.

Sanctions

• Higher regime: up to CZK 250 million or 2% of worldwide net annual turnover (Lupa.cz; Právní prostor).
• Lower regime: a lower ceiling applies; we could not confirm the figure from two sources, so check the Act.
• Other measures: suspension of a European cybersecurity certificate in the higher regime, procedural and coercive fines to enforce decisions (Právní prostor).

What it means for AI agents and non-human identities

• Scope the identities with the service: once you define the scope of each regulated service, list every service account, API key, OAuth application, certificate and AI agent inside it, with an owner. The Non-Human Identity (NHI) Guide sets out the categories.
• MFA and machines: where a non-human identity cannot use MFA, document the compensating control: short-lived tokens, workload identity federation, certificate binding or network restriction.
• Logging: make sure machine identity use is logged, so a 24-hour initial report can say which credential was involved.
• Agents: give each AI agent its own scoped identity and keep its action log.
• Suppliers: register credentials and OAuth grants held by suppliers; in the strategic layer, supplier access to the critical scope will be scrutinised.
• Review cadence: NHI Mgmt Group recommends quarterly review of privileged machine identities and annual review of the rest. This is our recommendation, not a Czech rule.

Common failure patterns

• Wrong deadline: counting from 1 November 2025 rather than from the registration decision.
• Mixed regimes: applying lower-regime measures to some services when one higher-regime service pulls the whole organisation up.
• Unfiled changes: a new responsible person or ended service not updated on the Portal.
• Human-only access evidence: service accounts and agents left out of reviews.
• One Portal user: nobody else can report when the 24-hour clock starts.

Practitioner checklist

• Confirm each regulated service under Decree 408/2025 and the regime.
• Record the NÚKIB registration decision date and the resulting one-year deadline.
• Check contact details were filed within 30 days and are current.
• Read Decree 409/2025 or 410/2025 in full and map controls.
• Appoint a cybersecurity manager in the higher regime.
• Inventory machine identities and AI agents inside each service scope.
• Keep at least two Portal users able to report.
• Rehearse 24-hour, 72-hour and final reporting.

Standards and references

• NÚKIB: Regulace a kontrola
• NÚKIB guide to the new Cybersecurity Act (via Svaz průmyslu a dopravy ČR)
• Lupa.cz: Regulace podle NIS2, zákon o kyberbezpečnosti začal platit
• Právní prostor: Nový zákon o kybernetické bezpečnosti, klíčové změny pro firmy
• Advokátní deník: Jak ohlásit regulovanou službu
• EUR-Lex: Directive (EU) 2022/2555 (NIS 2)

Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Transposition Tracker · Austria NIS2 Implementation Guide · NIS2 Readiness Checklist · Non-Human Identity (NHI) Guide. This guide summarises the Czech Cybersecurity Act as it stood on 9 November 2026 and is not legal advice.