Does NIS2 apply to you?
A short check based on the Czech Act No. 264/2025 Coll. and Decree No. 408/2025 Coll. It shows whether your company or authority probably falls under the Czech NIS2 law, in which regime, and what to do next. The result is indicative and not legal advice.
The result is indicative and not legal advice. It is based only on your answers, and NÚKIB decides on registration. ABUCO ICT and its partner ABSEC do not provide legal services.
The check is currently available in Czech only: the questions follow the wording of Czech decrees and the list of regulated services. An English version is being prepared.
Who falls under NIS2 in Czechia
The Act No. 264/2025 Coll. applies to an organisation that provides a service listed in the annex to Decree No. 408/2025 Coll. (for example energy, transport, health, digital infrastructure, public administration or selected manufacturing) and is a medium-sized or large enterprise. Some services are regulated regardless of size or above a special threshold set by the decree.
The annex assigns each service to the regime of higher obligations (Decree No. 409/2025 Coll.) or lower obligations (Decree No. 410/2025 Coll.). Whether an organisation is regulated is decided by the National Cyber and Information Security Agency (NÚKIB) under the act and the decrees; the check only gives a first orientation.
Suppliers of regulated organisations are not regulated directly, but regulated organisations must reflect security requirements in their supplier contracts, so questionnaires and contract addenda reach suppliers anyway.
Enterprise size under Recommendation 2003/361/EC
| Category | Employees (annual work units) | Annual turnover | or balance sheet total |
|---|---|---|---|
| Micro | fewer than 10 | up to EUR 2 million | up to EUR 2 million |
| Small | fewer than 50 | up to EUR 10 million | up to EUR 10 million |
| Medium | fewer than 250 | up to EUR 50 million | up to EUR 43 million |
| Large | exceeds the limits of a medium-sized enterprise | ||
Meeting one of the two financial limits is enough. Linked enterprises are added in full, partner enterprises (25–50 % holding) proportionally. See the NÚKIB portal for the official methodology (in Czech).
Sources and disclaimer
- Act No. 264/2025 Coll., on cybersecurity (Czech)
- Decree No. 408/2025 Coll., on regulated services (Czech)
- NÚKIB portal
- Commission Recommendation 2003/361/EC
The result of the check is indicative, based only on your answers. It is not legal advice, and NÚKIB decides on registration. In unclear cases contact NÚKIB (regulace@nukib.gov.cz) or a lawyer. ABUCO ICT and its partner ABSEC do not provide legal services.
Try Triconform on your own data
Triconform helps you record measures, track deadlines and prepare evidence of meeting your obligations. 30-day free trial, no commitment.
The demo runs right away, no sign-up needed. See the pricing.