Czech RepublicDecree on Regulated Services (Vyhláška o regulovaných službách), Service List, Significance Conditions and Regimes
Decree No. 408/2025 Coll., on Regulated Services, Sections 2 and 3 and the Annex
In force since .
A sector security regimes rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security, Governance
As of .
What it requires
- If you provide a service listed in the Annex to Decree No. 408/2025 and meet its significance conditions, you are a provider of a regulated service under Section 4 of the Cybersecurity Act, in the higher-obligations or lower-obligations regime the Annex assigns; the sector classes the Annex covers are reached by declaring that you are an essential or important entity.
- When you assess the significance conditions, convert the euro amounts in Commission Recommendation 2003/361/EC at the Czech National Bank's rate for the last day before the assessed calendar year (Section 2(2)).
These lines are LexLint's reading of the law's text, as of . Also read by: National Cyber and Information Security Agency (NÚKIB) (guidance, recorded ).
Who enforces it
Settledness
The guidance is the Agency's own revised explanatory report to the decree, published as an informative document that is not identical to the version submitted in the legislative process.
- As of
- Guidance link
- https://portal.nukib.gov.cz/storage/uploads/2025/12/03/duvodova-zprava-vyhlaska-regulovane-sluzby_uid_69303a3285993.pdf
- Guidance body
- National Cyber and Information Security Agency (NÚKIB)
What this law does
Decree No. 408/2025 Coll. of the National Cyber and Information Security Agency (NÚKIB), promulgated on , is issued under Section 4(2) and Section 8(2) of the Cybersecurity Act. It lists the regulated services and the conditions under which a provider is significant for the purposes of Section 4(1) of the Act, and allocates the providers of each regulated service to the higher-obligations or lower-obligations regime under Section 8(1).
Its Annex begins with public administration, whose exercise of delegated powers makes a central state administration body, among others, a provider in the higher-obligations regime. Under Section 2(2), the euro amounts in Commission Recommendation 2003/361/EC are converted into Czech currency at the Czech National Bank's rate for the last day before the assessed calendar year. The decree takes effect on .
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.