Czech RepublicCybersecurity Act (Zákon o kybernetické bezpečnosti), Cybersecurity Certification: Authorisation, Suspension and Offences
Act No. 264/2025 Coll., Cybersecurity Act, Sections 47, 57 and 61
In force since .
A product security requirements rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- If you are a conformity assessment body, a holder of a European cybersecurity certificate, or a manufacturer or provider that issues an EU declaration of conformity under Regulation (EU) 2019/881, these provisions bind you.
- Do not misuse the mark or label of a European cybersecurity certification scheme, a European cybersecurity certificate or an EU declaration of conformity, and do not forge or alter any of them (Section 61(1)(a) and (b)).no control in the NIST CSF 2.0
- As a conformity assessment body, carry out assessment at assurance level high, or any assessment the EU scheme reserves to an authorised body, only where you are entitled or authorised to, and issue a European cybersecurity certificate only for a product, process or service that meets the criteria of the EU scheme (Section 61(1)(c) to (e)).NIST CSF 2.0GV.OC-03
- As an accredited conformity assessment body, act only within your accreditation under Article 60(1) of the EU Cybersecurity Act, and suspend a certificate or attestation you issued when the Office orders it (Sections 57(1) and 61(1)(f) and (g)).NIST CSF 2.0GV.OC-03
- As a holder of a European cybersecurity certificate, inform the conformity assessment bodies concerned of any vulnerabilities or irregularities found later (Section 61(2)).NIST CSF 2.0RS.CO-03
- As a manufacturer or provider that issues an EU declaration of conformity, issue it only where the conditions of the EU Cybersecurity Act are met, keep the documents and information Article 53(3) requires, give a copy of the declaration to the Office or ENISA, and provide cybersecurity information as Article 55 requires (Section 61(3)).NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
A Section 61 infringement is an administrative offence (přestupek) heard by the Office, not a criminal offence.
Penalty structure
Section 61(4) sets the fine at up to CZK 50,000,000 for the offences in Section 61(1)(a) to (e), CZK 20,000,000 for Section 61(1)(f) and (g) and Section 61(3)(a), and CZK 2,000,000 for Section 61(2) and Section 61(3)(b) to (d).
- Rule
- Fixed only
- As of
- Currency
- CZK
- Fixed cap
- 50,000,000
Who enforces it
Enforcement body
Národní úřad pro kybernetickou a informační bezpečnost (NÚKIB, the National Cyber and Information Security Agency), which hears offences under Section 62(1).
Settledness
- As of
- Open questions
- Which 'jiný certifikát nebo osvědčení související se zajištěním kybernetické bezpečnosti' (other certificate or attestation connected with the cybersecurity of the regulated service) falls within Section 57(1) of the Cybersecurity Act, beyond a European cybersecurity certificate under the EU Cybersecurity Act?
What this law does
Sections 47, 57 and 61 of the Cybersecurity Act (Act No. 264/2025 Coll.), in force since , carry out the EU Cybersecurity Act (Regulation (EU) 2019/881) in the Czech Republic. Under Section 47 the Office, the National Cyber and Information Security Agency (NÚKIB), decides on applications to authorise a conformity assessment body, and it decides to suspend, restrict or withdraw an authorisation when the body breaches the requirements.
Under Section 57(1) the Office may, for at least six months, suspend the validity of a European cybersecurity certificate it issued to a higher-obligations provider that has not remedied the deficiencies ordered under Section 56, or order a conformity assessment body to suspend a certificate or attestation it issued.
Section 61 makes it an offence to misuse or forge a European cybersecurity certification mark, certificate or EU declaration of conformity, to carry out assessment at assurance level high or issue a certificate without the entitlement or authorisation, to act as an accredited body without accreditation or outside it, and to fail to suspend a certificate on the Office's order, and it sets offences for a certificate holder that does not tell conformity assessment bodies of later-found vulnerabilities and for a manufacturer or provider that issues an EU declaration of conformity wrongly, does not keep or submit the required documents, or does not give the required cybersecurity information.
Fines run to CZK 50,000,000 for the offences in Section 61(1)(a) to (e), CZK 20,000,000 for those in Section 61(1)(f) and (g) and Section 61(3)(a), and CZK 2,000,000 for those in Section 61(2) and Section 61(3)(b) to (d).
When LexLint raises it
When your app profile says your app distributes a software product.