What obligations the Act imposes
- 1. Registration and notification with NÚKIB. An entity must notify NÚKIB that it provides a regulated service, generally within 60 days of the moment it meets the conditions for registration (for most organizations, this coincided with the Act's effective date of 1 November 2025, or shortly thereafter). Notification is made through the NÚKIB Portal. Further details must then be supplied within a deadline following delivery of the registration decision.
- 2. Implementation of security measures. The Act requires the implementation of technical, organizational, and operational measures to ensure the confidentiality, integrity, and availability of information systems — ranging from risk management and personnel security to business continuity planning. Entities have a transition period to implement these measures, generally one year from the registration decision or the issuance of a certificate of entry in the register.
- 3. Supply chain security management. Companies must assess and manage cybersecurity risks among their suppliers and contractual partners, and demonstrate that those suppliers also meet the relevant security requirements — one of the significant new elements compared to the previous legislation.
- 4. Reporting of cybersecurity incidents. Significant security incidents must be reported to NÚKIB very quickly — an initial report generally within 24 hours of detection, with an obligation to submit follow-up reports. Entities must have a functioning detection and reporting system in place within the same deadline as for implementing security measures.
- 5. Personal liability of statutory bodies. The Act explicitly emphasizes the responsibility of company management for compliance with cybersecurity obligations — this is not merely an "IT matter," but a topic that belongs at board and executive level.
Sanctions for non-compliance
The Act introduces a noticeably stricter sanctions framework than the previous legislation. For entities under the higher obligation regime, fines can reach tens to hundreds of millions of Czech crowns, or alternatively a percentage of the group's worldwide turnover — whichever figure is higher applies. This is precisely why compliance with the new regulation should not be left until the last minute, even where a registration deadline has already passed — completing an outstanding obligation promptly can still help mitigate the risk of sanctions.
What regulated entities should do now
Whether your organization has not yet assessed whether it falls under the new Act, or has completed that analysis but is only beginning the practical implementation steps, we recommend the following:
- 1. Confirm your classification — assess whether the regulation applies to your organization, under which regime (higher/lower obligations), and from what point in time.
- 2. Check whether registration with NÚKIB has been completed — if the notification deadline has passed and the company missed it, registration should be completed without delay, even if belated.
- 3. Map the current state of security measures against the Act's requirements and prepare an implementation plan within the statutory deadline.
- 4. Establish contractual and procedural mechanisms for managing supplier risk.
- 5. Involve company management — given the personal liability of statutory bodies, NIS2 compliance should be a recurring item at management level, not just an IT department task.
How Proxima Legal can help
Implementing NIS2 brings together legal, procedural, and technical considerations — from a legal assessment of whether the regulation applies to a specific entity, through drafting internal policies and supplier contract documentation, to methodological support in communicating with NÚKIB. Our team can help you understand exactly which obligations apply to your organization and set up a practical, sustainable plan to meet them — without unnecessary administrative burden beyond what the law actually requires.
If you are unsure whether, and to what extent, the new Cybersecurity Act applies to your company, please get in touch — we would be happy to review your organization's specific situation.
This article is for informational purposes only and does not replace individual legal advice. As implementing regulations and NÚKIB's interpretive practice may continue to evolve, we recommend consulting with experts on the current state of the law.
