The Cyber Security Act: who it applies to and by when

Who does the Act apply to?

For most regulated services, two things decide it in combination: what a company provides and how big it is. As a rule it must be at least a medium-sized enterprise within the meaning of European Commission Recommendation 2003/361/EC, so neither size alone nor sector alone is enough.

Size is not a universal condition, though, and this is the most common reason a company tells itself “this doesn’t apply to us” and stops reading. For some services, other significance criteria decide and size plays no role at all: this is the case, for example, for DNS service providers, top-level domain name registries and public administration.

For the first time, the number of companies concerned can be backed by figures. NÚKIB, the Czech National Cyber and Information Security Agency, expected roughly six thousand organisations to fall under the Act; by 8 February 2026, 4,825 of them had filed a notification (opens in a new window), even though the deadline expired at the end of 2025. The six thousand is an estimate of the size of the regulated population, not a list of specific companies, so the two numbers cannot simply be subtracted from each other. The agency itself concludes from them, however, that some entities that meet the criteria have not yet filed a notification.

Which deadlines does a company face?

Three, and each is counted from a different event. That is the most commonly overlooked thing about them: they are triggered not by the date the Act took effect, but by what happens at your company.

• Notification to NÚKIB within 60 days of the day the company meets the conditions (Section 6(1)). Anyone who already met them when the Act took effect had to notify by the end of 2025.
• Implementation of security measures within one year of the day the company receives the registration decision (Section 13(4)). So the year does not run from November 2025 but from the agency’s decision.
• Reporting an incident that has to be reported: an initial report without undue delay, no later than 24 hours after detection (Section 16). For an incident with a significant impact, this is followed by a notification with an initial assessment within 72 hours and a final report within 30 days.

The toughest of these is the 24 hours, because they are counted not from the moment the company has a clear picture but from the detection of the incident. In practice this means knowing in advance who will send the report, where they will get the data from and who can stand in for them at that moment. Which incidents have to be reported at all differs by regime (Section 15), so this question, too, starts with classification. The full wording of the deadlines and obligations is in Act No. 264/2025 Coll. (opens in a new window), which replaced the Czech legislation of 2014 and transposed the European NIS2 Directive.

What do the higher and lower obligations regimes mean?

The Act does not divide companies into regulated and unregulated, but into two groups within the regulation. The scope of obligations depends on how significant the service is and how large the company providing it is, and each regime has its own implementing decree: 409/2025 Coll. for higher obligations and 410/2025 Coll. for lower ones.

One rule here surprises companies with several services: one organisation has one regime. As soon as at least one of your regulated services falls into the higher regime, the higher regime applies to all the others as well. For the lower regime, NÚKIB has published a manual with practical examples (opens in a new window) of how to implement the measures.

What counts as security measures?

Not buying a tool. Both decrees describe organisational as well as technical measures, so alongside securing the technology, it is about who in the company is responsible for security, how risks are managed, how suppliers are dealt with and how people are trained.

The specific documentation depends on the regime, which is another reason to start with classification. The decree for the higher regime requires, among other things, a risk assessment report, a risk treatment plan, business continuity and recovery plans, audit records and a statement of applicability, that is, an overview of which measures the company has implemented, which it has not, and why (Section 8). In the lower regime the scope is smaller.

What both regimes have in common is that the work with people has to be evidenced too. Staff training is a measure like any other and has to be demonstrated during an inspection just like the technical configuration, so every training session must leave an auditable record.

How high are the fines?

For the most serious offences, the fine can reach CZK 250 million or 2% of net worldwide annual turnover in the higher obligations regime, and CZK 175 million or 1.4% of turnover in the lower regime. In both cases, whichever of the two figures is higher applies, so for a large company the penalty is capped not by a fixed amount but by a percentage of turnover. For less serious failings the limits are lower. It is a ceiling, not a price list: the Act does not say how much is paid for a specific failing, and anyone who claims otherwise is doing their own arithmetic.

A more practical view is that the fine is only the second loss. The first comes from the incident itself and from the company not having prepared for it: from downtime, from data that cannot be restored, and from a report written under the pressure of 24 hours.

Where should you start if you don’t know whether it applies to you?

The first step is to establish your classification, not to buy technology. That is where Securent’s GAP analysis begins: it assesses whether, and in which regime, the Act applies to your company, and reviews the state of processes and documentation, organisational and technical measures, the ICT environment, the supply chain, GDPR, training and physical security. It produces three documents: management reporting for the leadership, an explanatory report analysing the gaps, and a roadmap setting out the order of the steps.

The second common question is whether the regulation means you have to hire someone. It doesn’t: a cyber security manager, architect and auditor, as well as a DPO, can be outsourced, which in a market where such people are scarce is usually a quicker route than recruitment. What cannot be outsourced is responsibility. The statutory obligations remain with your organisation, whoever fulfils them.

If you are also looking after the operation of networks and end devices, you will find both in the Cyber security category, where Securent sits alongside ICT services.