NIS2: Overview

Regulation: Directive (EU) 2022/2555 / National Cybersecurity Act (transposition) Dates: EU transposition deadline 17 October 2024; Czech Act No. 264/2025 Coll. effective 1 November 2025 Scope: Cybersecurity of specified services and organisations

What is NIS2?

NIS2 is the EU directive on the security of network and information systems. It is transposed into national law by each Member State. Its scope depends on the services provided, the type and size of the organisation and other statutory conditions.

Who Falls Under NIS2?

Annex I — sectors of high criticality

Energy; transport; banking; financial market infrastructures; health; drinking water; waste water; digital infrastructure; ICT service management between businesses; public administration; space.

Annex II — other critical sectors

Postal and courier services; waste management; manufacture, production and distribution of chemicals; production, processing and distribution of food; specified manufacturing activities; digital providers; research.

A sector name is not enough

Annexes I and II identify particular types of entity. For example, distinguish:

Financial infrastructure: Annex I lists operators of trading venues and central counterparties. This does not automatically include every business in finance. Article 4 NIS2 addresses the relationship with DORA.
Medical devices: Annex I includes manufacturers of devices on the list of critical devices for public-health emergencies. Annex II covers other specified medical-device and in-vitro diagnostic manufacturers.
Public administration: Member States define central and regional entities; regional entities also require the assessment in Article 2(2)(f). Extension to local government under Article 2(5) is a national option, not automatic inclusion of every municipality.
Space: Annex I covers operators of specified ground-based infrastructure supporting space-based services, excluding providers of public electronic communications networks.
Food and waste: Annex II specifies wholesale distribution and industrial food production or processing. It excludes waste businesses for which waste management is not the principal economic activity.
Manufacturing: Annex II specifies medical devices and in-vitro diagnostics and NACE divisions 26–30: electronics and optics, electrical equipment, machinery, motor vehicles and other transport equipment.

Assess the service, legal entity, size and exceptions under Articles 2–3. In the Czech Republic determine the regulated service and higher/lower obligations under national law. Annex I membership alone does not mean essential-entity status.

Key Obligations

Security risk management — Articles 20–21

Implement proportionate technical, operational and organisational measures: risk analysis, incident handling, business continuity and backups, supply-chain security, secure acquisition/development, vulnerability handling, effectiveness assessment, hygiene/training, cryptography, access/asset/HR security and appropriate multi-factor authentication. Management approves and oversees the measures and receives training.

An ISMS is mandatory in the general Czech higher regime (§ 14 of the Act, Decree 409 § 3); the lower regime requires a minimum cybersecurity system (Decree 410 § 3). Section 18(1) services follow the specific regime in Regulation 2690. NIS2 Article 21 itself does not mandate AES-256, TLS 1.3, a SIEM product, one-year log retention, monthly internal audits or semi-annual external audits. Determine concrete requirements from the applicable Czech regime or EU implementing act and your risk assessment; distinguish them from chosen implementation targets.

Incident Reporting

Article 23 stages concern the same significant incident, not separate “critical = 24h” and “significant = 72h” categories.

Stage	Deadline and trigger
Early warning	Without undue delay, within 24 hours of becoming aware of a significant incident
Incident notification	Without undue delay, within 72 hours of awareness; trust service providers have a specific 24-hour rule
Intermediate report	On request of the CSIRT or competent authority (Article 23(4)(c))
Final report	Within one month after the incident notification; for an ongoing incident, a progress report by that deadline and a final report within one month of handling

Czech reporting (§§ 15–16): In the general higher-obligation regime, report to NÚKIB incidents arising within the defined scope, originating in cyberspace and for which intentional causation cannot be excluded within the initial 24-hour period, even without a significant impact. The lower regime adds a significant impact on the regulated service to those same conditions; the recipient is the National CERT (§ 15(1)–(3), Decree 410 § 14). Submit the initial report without undue delay and within 24 hours of detection. Further stages under § 16(3) concern a significant impact on the service under § 15(2) or on the state’s cyberspace under § 16(2): notification without undue delay within 72 hours of detection (24 hours for trust services), an interim report on request and a final report within 30 days of notification. If the incident continues beyond that period, submit a progress report without undue delay and a final report within 30 days of resolution. Use the NÚKIB portal; if unavailable, use the designated email or data box of NÚKIB or the National CERT according to the regime (§ 16(4)).

Digital services: Section 18(2) replaces the definition of reportable incidents for the listed services other than trust services; significance is determined by Regulation 2024/2690 (Articles 3–4 and the relevant sector article). The general procedure in §§ 15–16 remains unless EU rules prescribe a specific procedure. Also assess a main establishment or representative in another EU/EEA state (§ 18(3)). The trust-service exception here is not an exemption from incident reporting; Article 1 of Regulation 2690 includes trust services. Keep records of other incidents; § 15(5) allows voluntary reporting. In addition to reporting to an authority, assess the duty to inform users about incidents and significant threats under § 19.

Czech registration and implementation dates

Czech Act No. 264/2025 Coll. has applied since 1 November 2025. Report a regulated service to NÚKIB within 60 days of meeting the reporting conditions; organisations already meeting them at commencement had their initial deadline at the end of 2025. NÚKIB then decides registration. In the general regime, start complying with the duty to implement and operate measures under § 13(2) and report incidents under § 15(1)–(2) no later than one year from delivery of the registration decision for each regulated service (§ 13(4), § 15(4)). Submit contact and supplementary data within 30 days of delivery (§ 11(1)); report changes to data not held as reference data in the basic registers within 14 days of the change (§ 11(2)). Section 13(2) does not apply to § 18(1) services, so its one-year period cannot automatically be transferred to their measures; assess reporting under § 18(2)–(3) and §§ 15–16. Previously regulated persons have transitional duties under § 71, including the new reporting method from delivery of registration. A move from the lower to the higher regime starts new periods under § 9(2). This is neither a new deadline for the first service notification nor general permission to defer existing duties. Use the NÚKIB portal.

Other Member States have their own implementing law; do not apply Czech dates EU-wide.

Timeline

Date/trigger	Meaning
17 October 2024	EU transposition deadline
1 November 2025	Czech law takes effect
Conditions for a regulated service met	60-day Czech reporting period starts
Registration decision delivered	General regime: measures and reporting no later than one year; data within 30 days. Assess § 18, § 71 and § 9(2)

Penalties

Article 34 requires national maximum fines for the relevant Articles 21/23 infringements of at least EUR 10 million or 2% of total worldwide annual turnover of the undertaking to which the entity belongs in the preceding financial year, whichever is higher, for essential entities; for important entities, at least EUR 7 million or 1.4%, whichever is higher. These are requirements for national penalty ceilings, not a uniform fine for every breach.

In the Czech Republic, the new law provides, for relevant offences, ceilings of CZK 250 million or 2% in the higher-obligation regime and CZK 175 million or 1.4% in the lower-obligation regime, whichever is higher. Percentages use the net worldwide annual turnover of the undertaking under Articles 101–102 TFEU of which the accused is part, for the immediately preceding accounting period (§ 59(4)). The offence, regime and statutory conditions determine the applicable sanction. Remedial measures and any management-related restrictions have their own conditions; no universal 30–60 day remediation period applies.

Next Steps

Resources

Content reviewed: 6 September 2026. Primary sources: NIS2 — Arts. 2, 3, 20, 21, 23, 34, NÚKIB — Czech law, NÚKIB — reporting and registration.

Czech legal basis: 264/2025, 408/2025, 409/2025, 410/2025, 2024/2690.