Czech RepublicCybersecurity Act (Zákon o kybernetické bezpečnosti), Supply-Chain Security Mechanism for Strategically Significant Services
Act No. 264/2025 Coll., Cybersecurity Act, Sections 25 to 33 and 59(3)
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
What it requires
- This binds a provider of a regulated service whose service the government has listed by regulation as strategically significant, meaning its disruption could seriously affect the security or internal order of the Czech Republic (Section 25); a supplier to such a provider is reached through the provider's own duties and through NÚKIB's measures of general nature (reached by declaring that you are an essential or important entity).
- Make reasonable efforts to find out who supplies you with security-significant deliveries, record at least which deliveries and which suppliers, and report that information and any change to NÚKIB within 10 days of finding it out; make the first report within 1 year of your service becoming strategically significant (Section 31(1) and (2)).
- Observe the conditions, or the ban, that NÚKIB sets by a measure of general nature on using a supplier's performance in the critical part of your service, when the government has resolved the measure is necessary to protect the security of the Czech Republic (Section 29(1)).
- Report to NÚKIB within 60 days a change to your regulated service that makes it strategically significant (Section 26(1)).
- Keep the service available from the territory of the Czech Republic to the necessary extent, and check at least once every 2 years that it can be provided from there, keeping a record (Section 33).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
A breach of the Section 26, 29, 31 or 33 duties is an administrative offence (přestupek) under Section 59(3), not a criminal offence.
Penalty structure
Section 59(4)(a) sets the fine for an offence under Section 59(3)(a), (b), (f) or (g) at up to CZK 250,000,000 or up to 2 percent of the net worldwide annual turnover of the undertaking the offender belongs to, whichever is higher.
- Rule
- Higher of
- As of
- Currency
- CZK
- Fixed cap
- 250,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB, the National Cyber and Information Security Agency), the central administrative authority for cybersecurity under Section 42.
Settledness
- As of
What this law does
Section 25 of the Cybersecurity Act defines a strategically significant service as a regulated service whose disruption could have a serious impact on the security or internal order of the Czech Republic, and the government lists such services by regulation.
Under Section 29(1), where the government resolves that it is necessary to protect the security of the Czech Republic, NÚKIB sets by a measure of general nature the conditions on, or a ban on, the use of a supplier's performance in the critical part of the scope of a strategically significant service.
Under Section 31(1), a provider of a strategically significant service must make reasonable efforts to find out about its suppliers of security-significant deliveries, record them, and report the information and any change to NÚKIB within 10 days of finding it out. Under Section 33(1) and (2), that provider must keep the service available from the territory of the Czech Republic to the necessary extent and check at least once every 2 years that it can be provided from there.
Under Section 59(3) and (4)(a), breach of a Section 29 condition or ban is an offence punishable by a fine of up to CZK 250,000,000 or up to 2 percent of worldwide turnover, whichever is higher.
When LexLint raises it
When your app profile says your app runs an essential service.
Back to the example · Lint your app
Page updated .