Zákon o kybernetické bezpečnosti schválen Poslaneckou sněmovnou

On 25 April 2025, the Chamber of Deputies approved the draft of the new Cybersecurity Act (hereinafter referred to as "CSA"), which aims to transpose the NIS2 Directive into Czech legislation. In comparison to the currently applicable legislation in the field of cybersecurity, the CSA significantly broadens the range of entities subject to which the legal regulation applies.

The CSA will apply to service providers who have 50 or more employees, or whose annual turnover or balance sheet total exceeds 10 million EUR, and who operate in any of the 15 specified business sectors, including the  energy sector, manufacturing, food industry, transportation, financial markets, and healthcare.

Regulated service providers under the CSA will be required to implement a number of new security measures. The extent of these obligations varies depending on whether the provider falls into the so-called higher or lower regime of obligations.

Affected providers will be required to report the provision of regulated services to the National Cyber and Information Security Agency (hereinafter referred to as "NÚKIB"). To protect data and systems, they will need to, for example, develop and maintain an up-to-date cybersecurity strategy that reflects current threats.

If the CSA is approved by the Senate and the President, it is expected to come into effect on 1 January 2026. After the CSA comes into effect, regulated service providers will need to take several key steps. First, they must self-identify and report to the regulator, i.e., NÚKIB, within 60 days.

Subsequently, no later than one year from the delivery of the decision on the registration of the regulated service, regulated service providers must implement the relevant measures in accordance with the applicable regime.

The CSA sets penalties of up to CZK 250,000,000 (approximately EUR 10,000,000) or 2% of the net worldwide turnover, with the fine always calculated from the higher amount. In extreme cases, a temporary ban on performing the function of a member of the statutory body of the provider violating legal obligations may be imposed.

Compliance with the requirements set by the CSA will not only be a matter of avoiding penalties. Proper fulfilment of these requirements will contribute to the overall cybersecurity of entities, enhance the trust of customers and business partners, and protect internal information from potential threats.

If you have any questions about how the proposed changes may affect you, please contact the authors of the article or other members of the EY Law firm or EY team you collaborate with.

Authors:

Ondřej Havránek

František Schirl

Michal Sladký