Czech RepublicCybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification
Act No. 264/2025 Coll., Cybersecurity Act, Sections 15-16
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds a poskytovatel regulované služby under Sections 3 to 5, which Section 18 extends by name to an online marketplace, an internet search engine and a social-networking-platform provider among other digital-infrastructure-and-services roles; the wider sector classes are reached as on this jurisdiction's companion security-measures row.
- If you are in the higher-obligations regime, notify NÚKIB no later than 24 hours after detecting a qualifying cybersecurity incident, with an initial report giving your identifying details, basic incident data, and whether you believe the incident was caused by an unlawful intervention or could have a cross-border impact.
- If you are in the lower-obligations regime, notify the Národní CERT on the same 24-hour clock instead, for a qualifying incident with significant impact on your service's provision.
- For an incident with significant impact, follow with a report no later than 72 hours after detection that updates your initial assessment and gives the incident's impact and, where available, indicators of compromise.
- If you provide a trust service under the directly applicable EU regulation, submit the notification of an incident with significant impact within 24 hours after detection, not 72.
- Submit an interim report on request, and a final report no later than 30 days after submitting the notification under Section 16(3)(a) (the 72-hour notification, or the 24-hour one for a trust-service provider), or, if the incident is still ongoing at that point, a progress report followed by a final report within 30 days of resolution.
- If you provide a DNS resolution, top-level-domain registry, cloud computing, data-centre, content-delivery-network, online-marketplace, internet-search-engine, social-networking-platform, managed or managed-security service, report every incident with significant impact on that service, with significance set by the Commission's NIS2 implementing regulation; the procedure in Sections 15 and 16 still applies unless that regulation sets a special one.
- Report through NÚKIB's Portál Úřadu where you can; otherwise a higher-obligations provider emails NÚKIB or uses its data-box address, and a lower-obligations provider does the same with the Národní CERT.
These lines are LexLint's reading of the law's text. Also read by: Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB) (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
A Section 16 reporting infringement is an administrative offence (přestupek) under Section 59, not a criminal offence.
Penalty structure
The same Section 59(4)(a) and (b) tiers that govern a Section 13/18 infringement govern a Section 59(1)(h) or 59(2)(h) infringement (failing to submit the initial incident report under Section 16(1), failing to complete required incident data under Section 16(3), or failing to report an incident under Section 18(2)): up to CZK 250,000,000 or 2 percent of worldwide turnover for a higher-obligations provider, and up to CZK 175,000,000 or 1.4 percent for a lower-obligations provider, whichever amount is higher in each case.
- Rule
- Higher of
- As of
- Currency
- CZK
- Fixed cap
- 250,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB), directly for a higher-obligations provider and, for a lower-obligations provider, through the Národní CERT it may contract to operate under Section 53.
Settledness
- As of
- Guidance link
- https://portal.nukib.gov.cz/pruvodce-novym-zakonem-o-kyberneticke-bezpecnosti
- Guidance body
- Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB)
What this law does
Section 15 requires a provider in the higher-obligations regime to report a qualifying cybersecurity incident directly to NÚKIB, and a provider in the lower-obligations regime to report to the Národní CERT. Section 16 sets a graduated notification clock, transposing NIS2 Article 23.
An initial report is due no later than 24 hours after detecting the incident, giving the provider's identifying details, basic incident data, and whether the provider believes the incident was caused by an unlawful intervention or could have a cross-border impact.
For an incident with significant impact, a follow-up report is due no later than 72 hours after detection, updating that assessment and giving an initial evaluation of the incident's impact and, where available, indicators of compromise.
An interim report is due on NÚKIB's or the Národní CERT's request, and a final report is due no later than 30 days after the notification under Section 16(3)(a); if the incident is still ongoing at that point, a progress report is due instead, followed by a final report within 30 days of resolution.
A provider reports through NÚKIB's Portál Úřadu where possible; a higher-obligations provider otherwise emails NÚKIB or uses its data-box address, and a lower-obligations provider does the same with the Národní CERT.
Section 18(2) separately requires a provider of the digital-infrastructure services named in Section 18(1), other than a trust service, to report every incident with significant impact on that service, with significance set by the Commission's implementing regulation, and Sections 15 and 16 still govern how it reports unless that regulation sets a special procedure.
Under Section 15(4), a provider must begin reporting incidents for each regulated service no later than one year from the day the decision registering that service is delivered to it. Section 70(1) disapplies this Act's provisions on security measures and incident reporting, including their supervision, where a directly applicable EU regulation lays down such obligations with at least comparable effect.
Section 70(3) counts as having that effect the provisions of a directly applicable EU regulation that itself says they do. Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .