What does Act 264/2025 Coll. and the NIS2 transposition into Czech law bring?
The Czech Republic has completed the transposition of the European NIS2 Directive by adopting a new Cybersecurity Act - Act No. 264/2025 Coll. The new act took effect on 1 November 2025 and replaces the original Act No. 181/2014 Coll.
This is not a partial amendment but a complete recodification. It expands the range of regulated entities, redefines obligation regimes, strengthens management accountability, and introduces new sanctions.
The supervisory and methodological body remains the National Cyber and Information Security Agency (NÚKIB), which issues implementing decrees and operates the portal for registration and communication with regulated entities.
The act distinguishes companies by the importance of services they provide. You can determine which regime applies to you using the official NÚKIB calculator.
For providers of critical services and large entities in regulated sectors.
For mid-sized companies in regulated sectors and providers of certain digital services.
Under the higher obligations regime, the cybersecurity architect is a mandatory separate role. They are responsible for the technical design of security measures and the overall security architecture of the organization - from network infrastructure through IAM to application security.
Decree 409/2025 Coll. defines competence requirements: at least 3 years of relevant practical experience or qualifications evidenced through accredited certifications.
The architect role must be separated from the cybersecurity auditor role - independence is both formal and practical. The act does not require the role to be staffed by an internal employee. An external person is a fully valid option.
Act No. 264/2025 Coll. becomes effective.
From the moment the company meets the regulation criteria, it has 60 days to register via the NÚKIB portal. Companies regulated from 1 Nov 2025 must register by 31 Dec 2025.
After registration, the company has one year to implement all mandatory organizational and technical measures.
Free 30-minute consultation. We assess your current state and propose concrete steps to reach your target state.
Free consultation