Legislation guide
This guide connects the five regulations to the decisions an organisation needs to document. It is a navigation aid, not a completed assessment of any particular organisation.
Scope first
| Regulation | What determines applicability | Practical output |
|---|---|---|
| AI Act | System/model definition, role, intended purpose, EU nexus and Article 2 exclusions; Article 6 and Annexes I/III for high risk | Inventory, reasoned classification and obligations for each role |
| NIS2 / Czech law | Specific service, entity type, size including enterprise relationships, and special exceptions; Czech higher/lower regime rules | Record of regulated service assessment, regime and deadlines |
| GDPR | Material and territorial scope in Articles 2–3, processing operation and controller/processor role; not people’s citizenship | Purposes, legal bases, processing records and rights procedures |
| Data Act | User, data holder/recipient, manufacturer, related service or data processing service provider role; relevant chapter and exclusions | Data rights map, access process and contractual/technical switching plan |
| DORA | Listed Article 2 financial entities and exceptions; the special oversight framework for critical ICT providers follows Article 31 designation; ordinary ICT contracts carry duties without that designation | ICT framework, contract register, reporting and testing plan for the applicable regime |
Key obligations and their limits
- AI Act: Article 4 literacy measures and the original Article 5 prohibitions have already applied; Article 50 transparency has applied since 2 August 2026, with the Article 111(4) transition for specified older generative systems. Technical documentation under Annex IV and conformity assessment concern relevant high-risk providers. A third-party assessor is not required for every Annex III system. FRIA under Article 27 and GDPR DPIA have separate triggers. Using a GPAI API does not automatically make you a GPAI model provider.
- NIS2: Apply the national implementation and relevant implementing rules. An ISMS is mandatory in the Czech higher regime under Decree 409 (with the separate § 18 Cybersecurity Act regime for specified digital services); ISO 27001 certification is not universally required by NIS2. Czech registration is not postponed until the end of 2026.
- GDPR: Establish a legal basis for each purpose and an Article 9 condition for special categories. Consent is one possible basis, not the universal answer. The controller reports without undue delay and, where feasible, within 72 hours of awareness, unless a risk to individuals’ rights and freedoms is unlikely; a processor reports to the controller without undue delay.
- Data Act: IoT access and cloud switching have different scopes. Personal data remain protected by GDPR, and the Data Act gives no general permission to bypass GDPR; where the requesting user is not the subject of the requested personal data, Articles 4(12) and 5(7) expressly require a GDPR Article 6 basis and any applicable GDPR Article 9 and ePrivacy Article 5(3) conditions. Article 40 does not impose the GDPR fine cap on every IoT infringement.
- DORA: The simplified Article 16 framework applies only to listed categories. Advanced TLPT applies to entities identified under Article 26, not every bank or every large company.
When requirements apply
| Date / trigger | Requirement and scope |
|---|---|
| 25 May 2018 | GDPR has applied since this date; it is not a new 2026 requirement. |
| 17 January 2025 | DORA applies to Article 2 entities, subject to its exclusions. |
| 2 February 2025 | AI Act Chapters I and II, including AI literacy and the original Article 5 prohibitions. |
| 2 August 2025 | In particular, GPAI provider rules, governance and the penalty framework, except Article 101. For older GPAI models, see Article 111(3). |
| 12 September 2025 | Main application date of the Data Act; Article 50 contains further transitional rules. |
| 1 November 2025 | Czech Cybersecurity Act No. 264/2025 Coll. entered into effect. |
| 27 July 2026 | Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force. |
| 2 August 2026 | General application of the AI Act, including Article 50 transparency according to role and system type. |
| After 12 September 2026 | Data Act Article 3(1): access by design for connected products and related services placed on the market after this date. This is not a general deferral of data access rights. |
| 2 December 2026 | New AI Act Article 5(1)(ba), (bb) prohibitions and paragraphs 1a, 1b; also the Article 111(4) deadline for compliance with Article 50(2) for generative systems placed on the market before 2 August 2026. |
| 12 January 2027 | Data Act Article 29: switching charges prohibited for data processing services. Account for Article 31 exceptions for specified custom services and temporary non-production testing. Ordinary service fees and permissible early termination penalties require separate assessment. |
| 2 August 2027 | AI Act Article 111(3): compliance for providers of GPAI models placed on the market before 2 August 2025. |
| 2 December 2027 | AI Act Chapter III Sections 1–3 except Article 6(5), for Article 6(2) / Annex III. This does not automatically defer other high-risk provisions; account for Article 111. |
| 2 August 2028 | AI Act Chapter III Sections 1–3 except Article 6(5), for Article 6(1) / Annex I; account for Article 111 and the special Article 2(2) regime for Annex I Section B. |
| Entity-specific — Czech NIS2 implementation | Notify each regulated service normally within 60 days of meeting the conditions (§ 6); provide § 11 details within 30 days of delivery of registration. Under § 13(4), fulfilment of security measures must begin no later than one year after delivery of that service’s registration decision; mandatory reporting starts within the same limit under § 15(4). This is not a one-year deferral of all duties: separately assess § 18 for specified digital services, § 9 regime changes and § 71 transitions. |
Assess sanctions accurately
Statutory maxima depend on the offence and entity. AI Act Article 99 distinguishes prohibited practices, listed operator duties and incorrect information, with lower-of-the-two rules for SMEs and, more narrowly, small mid-caps. Article 101 permits GPAI provider fines up to 3% of worldwide annual turnover in the preceding financial year or EUR 15 million, whichever is higher, under its stated conditions. GDPR Article 83 uses two categories of infringement and the higher applicable amount for undertakings. Czech NIS2 sanctions follow the national offence and regime. DORA penalties for financial entities follow national law; Article 35 periodic payments concern designated critical ICT providers. Do not add headline maxima together or present them as guaranteed avoided cost.
Practical examples
| Use case | What to check |
|---|---|
| Natural-person creditworthiness scoring | AI Act Annex III 5(b), including the financial-fraud exception; provider/deployer duties and Article 27 FRIA, GDPR basis and Articles 22/35; DORA where the entity is in scope |
| Anonymous analytics | Whether data are actually anonymous rather than pseudonymous; AI purpose and sectoral security obligations remain separate questions |
| Smart factory | Data Act connected-product rights, the AI system’s purpose and product legislation, actual manufacturing activity and size for NIS2, employee personal data under GDPR |
| SaaS with AI features | Whether the provider meets cloud service definitions, AI provider/deployer roles, processing roles under GDPR and exportable data under the Data Act |
Continue
Content reviewed: 6 September 2026. Primary sources: AI Act, Digital Omnibus on AI, NIS2, NÚKIB: registrace a lhůty, GDPR, DORA, Data Act.
Primary source for the Czech rules: 264/2025 Sb..