The new Czech Cybersecurity Act has been in force since 01/11/2025, and the National Cyber and Information Security Agency (NÚKIB) estimates that it covers about 6,000 organisations. We find out whether yours is one of them, help you notify and prepare measures on a scale that makes sense. No scaremongering, no needless paperwork.
to notify NÚKIB of a regulated service, counted from the day the firm meets the conditions (section 6(1)).
to supply contact and other details after the registration decision is delivered (section 11(1)).
to put the security measures in place, from delivery of the registration decision (section 13(4)). Incident reporting must start within the same period at the latest (section 15(4)).
or both turnover and balance sheet above €10 million: from this size (a medium-sized enterprise under Commission Recommendation 2003/361/EC) the Act covers the services listed in Decree No. 408/2025 Coll.
(Czech crowns) or 2% of net worldwide annual turnover in the higher-obligations regime; up to 175m Kč or 1.4% in the lower-obligations regime, in each case whichever is higher (section 59(4)).
entities had notified NÚKIB by 08/02/2026. NÚKIB has long said that about 6,000 organisations would fall under the Act.
Sources: Act No. 264/2025 Coll. (in Czech), Decree No. 408/2025 Coll. (in Czech), European Commission SME definition, NÚKIB press release of 11/02/2026 (in Czech). The Act and decree as in force on 13/10/2026.
Three things decide it: what service you provide, in which sector, and how large your firm is, usually counting linked and partner enterprises. The Act mainly covers medium-sized and large enterprises that provide a service listed in Decree No. 408/2025 Coll.
Some services are covered regardless of size, for example public electronic communications networks and services, public DNS services and qualified trust services.
For a first check, NÚKIB recommends its calculator on the NÚKIB Portal and has also published a guide to the new Act (both in Czech). The criteria in the decree are what count, though, and borderline cases are worth a proper assessment.
Much of what it asks for is ordinary good practice: two-step sign-in, backups out of an attacker’s reach, updates, and knowing who has access and which suppliers you depend on.
Firms covered by the Act also have to address the security of their suppliers. If you supply one of them, it may ask the same of you.
If you’re outside the Act, we recommend a sensible security baseline, such as our Secure basics package (services 08 and 11).
We look at your services, sector and size. The answer: in scope or not, and why. You can also order the assessment on its own.
We help you notify the service and supply the details NÚKIB asks for.
We compare where you are today with the requirements of the Act and its implementing decree.
A one-year plan with priorities and named people responsible, so the deadline is met.
Security policies, supplier management, incident reporting. Only what the Act asks for and what you will actually use.
Sign-in, backups, updates, email security. We do them ourselves, or brief your supplier and check its work.
This is a typical situation, not a specific engagement. We describe what we would do and what you get.
Management has heard the new law may cover them. Nobody knows whether they need to register, or what the regulator would expect.
Clarity on what you must do and what you needn’t, and a plan you can deliver on time.
Notify as soon as you can. The 60 days run from the day the firm began to meet the conditions; firms that met them on 01/11/2025 should have notified by 31/12/2025. We can help with the notification and with what follows.
The Act doesn’t require certification. It requires security measures under the Act and its implementing decree. ISO 27001 can be a good framework, but it isn’t a condition.
Section 59 of the Act allows fines of up to 250 million Kč or 2% of net worldwide annual turnover in the higher-obligations regime, and up to 175 million Kč or 1.4% in the lower-obligations regime, in each case whichever is higher. The point isn’t to frighten anyone: sensible measures are above all good protection for the business.
The assessment alone costs from 7,500 Kč and the assessment with a plan of measures from 44,000 Kč, always at a fixed price based on your size and the number of services. Clear-cut cases are often settled in the free call. Putting the measures in place is quoted separately at a fixed price, or you hand it to your supplier and we check its work. We are not VAT-registered, so these prices are final.
No. We’re technical and security advisers. Interpreting the law in borderline cases is a lawyer’s job, and we’re glad to work alongside one.
This page is general information, not legal advice. It reflects the Act and decree as in force on 13/10/2026.
Updated 13/10/2026
The first call is free and commits you to nothing. Within a few days you get a short proposal with a fixed price.