What is NIS2 and why Czech legislation is changing
The NIS2 directive (Directive (EU) 2022/2555) is an EU regulation aimed at harmonizing and raising the level of cybersecurity across member states. It builds on the original 2016 NIS directive, substantially expanding it — introducing stricter requirements for risk management, supply chain security, incident reporting, and the accountability of statutory bodies. The directive has been in force at EU level since early 2023, but its concrete obligations only apply to entities in individual countries once transposed into national law.
In the Czech Republic, transposition is overseen by the National Cyber and Information Security Agency (NÚKIB). Rather than amending the existing act, NÚKIB opted for an entirely new law, which went through the legislative process in the first half of 2025, was signed by the President, and took effect in the autumn of the same year. It replaces the previous Cybersecurity Act from 2014.
Who the Act affects
The new law dramatically expands the scope of regulated entities. While the previous framework covered only a few hundred organizations operating critical infrastructure, the new regulation covers dozens of sectors and hundreds of specifically listed services — estimates suggest thousands of companies now fall under one of the regulatory regimes.
Regulated sectors include, among others:
- energy, transport, and water management,
- banking and financial markets,
- healthcare and pharmaceuticals,
- digital infrastructure and digital service providers (cloud, data centers, DNS),
- public administration,
- waste management,
- postal and courier services,
- manufacturing and distribution across a range of industrial sectors, food production, and more.
The Act distinguishes between two basic categories of obligations depending on the significance of the entity and the service it provides — higher and lower obligation regimes — with the scope of specific requirements (and the level of potential sanctions) varying accordingly. Determining whether the regulation applies to a particular company depends not only on the sector and type of service, but also on the size of the organization (number of employees, turnover). Obligations can also indirectly extend to suppliers and subsidiaries of regulated entities through supply chain security requirements.
Why the regulatory boundary isn't always obvious
In practice, determining whether a particular company falls under the Act is not always straightforward. A company may find itself within the regulated regime even if it does not directly provide any of the key services itself — it is enough to be a significant supplier or subcontractor to an entity that is subject to the regulation. Similarly, seemingly minor details in the definition of a provided service, or proximity to size thresholds, can also play a role.
We therefore recommend that any company uncertain about its classification carry out a specific legal analysis — ideally before becoming the subject of an inspection or missing a registration deadline.
What comes next
In the following article, we take a detailed look at the specific obligations the new Act imposes on regulated entities — from registration with NÚKIB, through the implementation of security measures, to incident reporting — and the sanctions that apply if they are not met.
This article is for informational purposes only and does not replace individual legal advice. If you are unsure whether the new Cybersecurity Act applies to your organization, we would be happy to help you assess your situation.
