The Network and Information Security Directive 2 (NIS2) is the European Union's updated framework for cybersecurity regulation, replacing the original NIS Directive from 2016. Its scope is dramatically broader than its predecessor — extending to tens of thousands of entities across the EU that were previously outside mandatory cybersecurity regulation. In the Czech Republic, NIS2 was transposed into national law through the new Cybersecurity Act (zákon o kybernetické bezpečnosti), which came into force in 2024. If your business has not yet assessed whether it falls within scope, there is a reasonable probability that it does — and that you are already behind.
Who Is Covered: The Scope Has Changed Substantially
Under the original NIS Directive, mandatory cybersecurity requirements applied primarily to large operators of essential services in a narrow set of critical sectors — energy, transport, banking, healthcare, water, and digital infrastructure — along with certain digital service providers. NIS2 extends this scope significantly in two directions: it adds new sectors, and within existing sectors it brings in a much wider range of entities by size.
The new sectors brought into scope include, among others: postal and courier services; waste management; manufacture, production, and distribution of chemicals; food production, processing, and distribution; manufacturing of medical devices, computers and electronics, machinery, motor vehicles, and other transport equipment; digital providers including social networks and online marketplaces; and public administration. The sector list is now broad enough that a significant proportion of Czech medium and large businesses fall within it.
The size threshold also matters. NIS2 applies to "important entities" (střední subjekty) — generally businesses with 50 or more employees or annual turnover above EUR 10 million — as well as "essential entities" (klíčové subjekty), which are larger or in more critical sectors. Some entities fall within scope regardless of size, particularly in digital infrastructure and public administration. Czech businesses that assumed NIS2 applied only to critical infrastructure operators should revisit this assumption: the scope is far wider.
What NIS2 Requires: The Core Obligations
NIS2 mandates a risk-based approach to cybersecurity — entities must implement "appropriate and proportionate" technical and organisational measures to manage cybersecurity risks. The directive specifies a minimum set of measures that must be addressed, including: risk analysis and information system security policies; incident handling; business continuity and crisis management; supply chain security; security in network and information systems acquisition, development, and maintenance; policies and procedures for assessing the effectiveness of cybersecurity measures; basic cyber hygiene practices and cybersecurity training; policies and procedures regarding the use of cryptography; human resources security, access control policies, and asset management; and the use of multi-factor authentication.
Incident reporting is a significant new obligation for many Czech businesses. Essential and important entities must report significant incidents to NÚKIB (Národní úřad pro kybernetickou a informační bezpečnost — the Czech national cybersecurity authority) within specified timeframes: an early warning within 24 hours of becoming aware of a significant incident, an initial notification within 72 hours, and a final report within one month. For businesses that have never had formal incident reporting procedures, building these capabilities requires preparation.
Management accountability is another significant change. NIS2 places explicit responsibility for cybersecurity compliance on the management bodies of covered entities — not on IT departments or security officers alone. Czech company directors and board members of entities within scope are required to approve cybersecurity risk management measures, oversee their implementation, and can be held personally liable for violations. This is a material change in the legal exposure of Czech business leaders and should prompt governance-level attention to cybersecurity that has often been absent.
The Penalties Are Serious
NIS2's penalty regime is substantially more severe than its predecessor. Essential entities that fail to comply face fines of up to EUR 10 million or 2% of global annual turnover, whichever is higher. Important entities face fines of up to EUR 7 million or 1.4% of global annual turnover. NÚKIB also has supervisory powers that include on-site inspections, the ability to issue binding instructions, and in serious cases the authority to temporarily prohibit individuals from holding management positions.
Czech businesses should not assume that enforcement will be light or that the compliance deadline has passed and nothing has happened yet. NÚKIB has been building its supervisory capacity and the regulatory environment is tightening. The cost of a significant cyber incident combined with a regulatory penalty for non-compliance could be existential for a Czech SME that falls within scope.
A Practical Compliance Approach for Czech Businesses
Compliance with NIS2 does not require building an enterprise security operations centre or hiring an army of cybersecurity specialists. For Czech SMEs that fall within scope, a proportionate compliance programme typically involves four stages.
First, confirm scope and classify your entity. Verify whether your business falls within scope under the Czech Cybersecurity Act, and if so, whether it is an essential or important entity. The classification determines the level of supervision and penalty exposure. If uncertain, seek legal advice — the cost is modest and the classification question needs to be answered correctly.
Second, conduct a gap assessment against the NIS2 requirements. Map your current cybersecurity measures against the minimum requirements specified in the directive and identify the gaps. Many Czech SMEs will find that they have some relevant controls already in place — password policies, backup procedures, access controls — but that these are informal, undocumented, or inconsistently applied. Documenting what exists and identifying what is missing is the starting point for a remediation plan.
Third, implement proportionate remediation. Address the gaps identified in the assessment, prioritising by risk level and implementation complexity. For most Czech SMEs, the highest-priority items will be: a documented cybersecurity policy approved by management; multi-factor authentication on all critical systems and remote access; a tested backup and recovery procedure; a basic incident response plan; and an asset inventory. These can be implemented at reasonable cost and without enterprise-grade tooling.
Fourth, establish ongoing governance. NIS2 compliance is not a one-time project but an ongoing management responsibility. This means regular risk reviews, incident response rehearsals, training for staff and management, and a documented process for reviewing and updating security measures as the threat environment and the business's systems evolve. The governance overhead for a Czech SME in compliance is manageable, but it does require deliberate allocation of management time and attention.
Supply Chain: An Often-Overlooked Obligation
One of the most practically challenging aspects of NIS2 for Czech businesses is the supply chain security requirement. Entities within scope are required to address cybersecurity risks in their supply chains — meaning they need to assess and manage the cybersecurity practices of their significant technology suppliers and service providers, not just their own internal controls.
For Czech businesses that depend on a small number of critical IT service providers, this means having conversations about security practices, reviewing contractual provisions for security standards and incident reporting, and potentially reassessing supplier relationships where security standards cannot be confirmed. This is often unfamiliar territory for Czech SME management, and it requires legal and technical support to navigate effectively.
The supply chain obligation also flows in the other direction: Czech businesses that supply technology products or services to entities within NIS2 scope — which includes a large proportion of the Czech IT sector — will find that their clients increasingly impose security requirements as a condition of the commercial relationship, driven by those clients' own compliance obligations. NIS2 is reshaping the commercial environment for Czech IT businesses regardless of whether they are directly within its scope.