The new Cybersecurity Act imposes obligations on companies in the sectors listed in the Act. The deadline for notifying the National Cyber and Information Security Agency (NÚKIB) is December 31, 2025 – there is one month left.
Who has to notify NÚKIB?
Three factors are decisive:
The sector in which you operate. The Act lists specific sectors that fall under cybersecurity regulation.
Size based on number of employees. The number of employees is one of the criteria for assessing whether you are an obligated entity.
Turnover and balance sheet total. The company's financial indicators play a key role in determining its obligations.
The last month to notify
Keep in mind that the assessment itself may take several days, and the end of the year is approaching. If you have been putting off your obligations so far, it is high time to get to work.
The process is not complicated, but it requires a thorough review of the criteria and a correct assessment of your situation. It is not enough to know that the Act applies to you – you also need to correctly identify the scope of your obligations.
What happens if you miss the notification deadline?
Penalties can reach up to CZK 250 million or 2% of the company's total worldwide annual net turnover.
Although some initial leniency on the part of NÚKIB can be expected, you cannot rely on it. The agency has the power to impose penalties, and the longer you delay your notification, the higher the risk of sanctions.
How can we help you?
Whether you are just starting the assessment, need to verify your findings, or would like an experienced “guide” to take you through the entire process, we are fully at your disposal.
We will go through exactly what you need to report with you, and, if needed, represent you in the notification. Our goal is to make sure you meet all your legal obligations correctly and on time – without unnecessary stress or the risk of penalties.
RAW_CMS_FAQ: {"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Who does the new Cybersecurity Act apply to?","acceptedAnswer":{"@type":"Answer","text":"The obligations apply to companies in the listed sectors. Whether you are an obligated entity is determined by three factors: the sector in which you operate, your size based on the number of employees, and financial indicators, i.e. turnover and balance sheet total."}},{"@type":"Question","name":"How do I know whether I am an obligated entity?","acceptedAnswer":{"@type":"Answer","text":"You need to go through the criteria of the Act and correctly assess your situation. It is not enough to know that the Act applies to you; you also need to correctly identify the scope of your obligations. The assessment itself may take several days."}},{"@type":"Question","name":"What was the deadline for notifying NÚKIB?","acceptedAnswer":{"@type":"Answer","text":"The deadline for notifying the National Cyber and Information Security Agency was set for December 31, 2025."}},{"@type":"Question","name":"What penalties apply for failing to meet the obligations?","acceptedAnswer":{"@type":"Answer","text":"Penalties can reach up to CZK 250 million or 2% of the company's total worldwide annual net turnover. Initial leniency from the agency cannot be guaranteed, and the agency has the power to impose penalties."}},{"@type":"Question","name":"What should I do if I have not notified yet?","acceptedAnswer":{"@type":"Answer","text":"As soon as possible, go through the criteria, assess whether and to what extent you are an obligated entity, and complete the notification. The longer you delay, the higher the risk of sanctions, because you cannot rely on initial leniency from the agency."}}]}
Thank you for subscribing to our newsletter.
We will send you legal news and updates to your email address.
Something went wrong. Please try submitting the form again.
.jpg)
