Does NIS2 apply to your small business?
The new Czech Cybersecurity Act transposes the NIS2 Directive into Czech law and is aimed primarily at medium-sized and large companies in listed sectors. Most small businesses therefore have no direct legal obligation - yet the topic may still affect them indirectly, through contracts with larger customers, and a practical security baseline pays off regardless of whether the Act applies to you directly.
Rather talk it through?
Describe the situation and I will suggest a first step and an estimate of the scope.
Let’s talkWho the new Act binds directly
Since 1 November 2025, Act No. 264/2025 Coll., on Cybersecurity, has been in force, transposing the European NIS2 Directive into Czech law. It imposes a direct obligation on companies that meet two conditions at the same time: they operate in one of the sectors listed in the Act and its implementing decree (typically energy, transport, healthcare, banking and the financial sector, water management, digital infrastructure and services, public administration and several others), and they also reach the size of a medium-sized or large enterprise under the EU definition - roughly, from 50 employees or an annual turnover or balance-sheet total above EUR 10 million. Smaller businesses providing precisely defined critical services may be covered regardless of size, but that is more of an exception.
Micro and small enterprises outside these exceptions are generally exempt from the Act. Compliance is supervised by NÚKIB (the National Cyber and Information Security Agency), and it is up to each company to assess its own obligations and, if it falls within the scope of the Act, to register with NÚKIB - no automatic notification will arrive.
Both the sector definitions and the size thresholds have exceptions and details that depend on the company’s specific activities. This article is general guidance, not a legal assessment of any individual case.
How to find out whether the Act applies to you
- Check your sector.Does the company operate in one of the sectors listed in the Act and its implementing decree, or does it provide a digital service that is subject to special rules?
- Work out the size of the enterprise.How many employees does the company have, and what is its annual turnover or balance-sheet total according to its latest financial statements?
- If both conditions apply, check the regime with NÚKIB.The agency distinguishes between a lower and a higher regime of obligations; only NÚKIB can confirm the exact classification and the registration deadline.
- Even without a direct obligation, check your contracts.Larger customers and suppliers that fall under NIS2 themselves may pass security requirements on to smaller suppliers through their contracts.
- Put a practical baseline in place whatever the outcome.Backups, multi-factor authentication, updates and incident readiness reduce a company’s risk even where no obligation applies.
A practical security baseline that pays off even without an obligation
Regardless of whether the Act applies to a company directly, a few concrete, inexpensive measures reduce the real risk of an outage or a data leak:
Separate backups with verified restores
A backup that has never been test-restored is not a reliable safety net. The verification procedure is described in testing backup restores.
Multi-factor authentication and permissions
Administrator accounts with a shared password and no second factor are the most common route of attack. This is covered by IT infrastructure security.
Regular security patches
An unpatched, publicly accessible service is one of the easiest points of entry - it belongs to the same infrastructure security work.
A prepared first step when something looks wrong
Who should be contacted, who decides whether to disconnect a system and where the backups are - this should be written down in advance, not worked out on the fly.
It pays to have both the starting point and the proposed measures written down - see company IT documentation. An IT security audit shows exactly where the company stands. You will find more practical topics in the IT guides.
Verified as of 28 September 2026 against publicly available sources: Guide to the new Cybersecurity Act (NÚKIB portal, in Czech), ePravo.cz and iThope.cz. Act No. 264/2025 Coll. This text is not a substitute for legal advice; the exact classification of a specific company is always confirmed by NÚKIB.
Let’s look at the real state of your infrastructure.
Whether or not the Act applies directly to your company, an audit will show the specific risks and the order in which to address them.