NIS2 in Czech Republic — transposition status and what’s changed

The Czech industrial base — heavy manufacturing, automotive supply (notably the Škoda / VW Group ecosystem), energy, regional banking, and a deep managed-services layer — places thousands of Annex I and Annex II entities into NIS2 scope. The Czech Republic also hosts a disproportionate concentration of digital-infrastructure providers (data centres, regional cloud, MSPs serving German-speaking markets), which means many Czech entities are simultaneously regulated under Annex I and act as suppliers to other regulated entities elsewhere in the EU.

Mid-market Czech entities are now expected to hold the same shape of supplier-assurance evidence that multinational regulated buyers ask for, on a tighter notification cadence than most have ever operated. The work cluster is real and the timeline is now.

Act No. 264/2025 Coll. on Cybersecurity replaced the previous statutory regime in November 2025, aligning Czech law with NIS2 and replacing the old system-based categories with providers of "regulated services" (regulovaná služba), sorted into a higher-obligations and a lower-obligations regime. An entity notifies its regulated services through the NÚKIB Portal within 60 days of meeting the conditions (31 December 2025 for those in scope on day one); NÚKIB then registers each service by decision, and security measures and incident reporting must start within one year of that decision being delivered. Where measures are delivered through a supplier, the act makes the provider select the supplier in line with those measures and write the requirements into the supplier contract. NÚKIB publishes extensive Czech-language support materials — methodologies, manuals, regime-specific step-by-step guides — and the implementing decree catalogue is more prescriptive than the EU baseline.

Incident reporting is directive-aligned — a 24-hour initial report, a 72-hour notification for incidents with significant impact, a final report within 30 days. NÚKIB’s regime-specific manuals are particularly relevant for MSPs serving Czech regulated buyers.

Czech regulated entities sit inside cross-border supply chains tied tightly to German manufacturing — particularly the VW Group ecosystem via Škoda — which means supplier inheritance flows both ways across the border. A Czech automotive supplier increasingly inherits German NIS2 obligations from its OEM buyers AND must satisfy its own Czech NÚKIB obligations as an Annex II important entity.

The high concentration of MSPs serving the Czech mid-market is a distinctive pattern: many of these providers are themselves Annex I digital-infrastructure entities under NIS2, and they are increasingly central to the supplier-assurance conversation as both buyer and supplier. Contractual incident-notification SLAs from suppliers — particularly ICT services suppliers — are a natural negotiation point as Czech buyers work through how to inherit-up to their own 72-hour notification windows.

Czech-language UI is on the roadmap — after Slovak in the language sequence. NÚKIB-aligned evidence templates are planned against the regulator’s published methodologies — particularly the prescriptive measure catalogue of the higher-obligations regime. Designed so one supplier file supports both the inherited German NIS2 obligations and the native Czech ones in Czech-German and Czech-Slovak supply chains — cross-buyer routing is planned for later versions.

The MSP / MSSP partner channel is particularly relevant for the Czech market — co-delivery economics work well where a Czech MSP is itself regulated and serves multiple regulated mid-market buyers. The partner page covers the channel mechanics; the supplier-side surface of Vittnor — Supply Chain Assurance for the mid-market — keeps your questionnaire answers and evidence in one library, so the next request starts from what you already proved — cross-buyer reuse is planned for later versions.