NIS2 and the Czech Cybersecurity Act
Meet the new obligations in good time and without unnecessary red tape.
The NIS2 Directive has significantly widened the range of organisations that must meet cybersecurity obligations. In the Czech Republic it has been transposed by the Czech Cybersecurity Act (No. 264/2025 Coll.), in force since 1 November 2025, which applies to thousands of companies and institutions – from manufacturing and transport through healthcare and energy to digital services. We help you find out which obligations apply to you and meet them step by step.
What the law requires
- assess whether and under which regime (higher or lower obligations) the law applies to you, and notify NÚKIB (the National Cyber and Information Security Agency) of your regulated service
- implement risk-based security measures within 12 months of the registration decision – from asset and access management to backups and supplier security
- report cybersecurity incidents – an initial report within 24 hours, for significant incidents a notification within 72 hours, and a final report within 30 days of resolution
- involve top management, which is accountable for cybersecurity
How we help
- We assess whether the law applies to you and under which regime.
- We carry out a gap analysis against the requirements of the law.
- We prepare an action plan with clear priorities and a cost estimate.
- We help with implementation – from documentation to technical measures.
- We set up incident reporting and train management and staff.
What you get
- clarity on which obligations apply to you
- a realistic, prioritised plan instead of hundreds of pages of documentation
- documentation and processes ready for inspection
- technical measures that provide real protection, not just paper compliance
AI
AI in practice: AI helps us quickly compare your documentation with the legal requirements; recommendations and conclusions come from our consultants.
Who it's for: companies and institutions covered by the law, and those who want to verify that their existing measures meet the new requirements.
