{"id":6850,"date":"2025-12-12T10:56:40","date_gmt":"2025-12-12T09:56:40","guid":{"rendered":"https:\/\/m2apartners.cz\/amendment-to-the-cybersecurity-act\/"},"modified":"2025-12-12T11:08:38","modified_gmt":"2025-12-12T10:08:38","slug":"amendment-to-the-cybersecurity-act","status":"publish","type":"post","link":"https:\/\/m2apartners.cz\/en\/amendment-to-the-cybersecurity-act\/","title":{"rendered":"Amendment to the Cybersecurity Act"},"content":{"rendered":"\n

<\/p>\n\n

Since 1 November, a new law on cyber security has been in force, which implements the changes introduced by the NIS Directive2. <\/p>\n\n

Who is affected by the law<\/strong><\/p>\n\n

The legislation will affect entities that provide any of the regulated services. A list of these services and other criteria is set out in the Annex to the Regulated Services Ordinance<\/a>. If you provide any of the listed services and meet the necessary criteria, you are a regulated service provider and are subject to the obligations under the Cybersecurity Act and the relevant regime. <\/p>\n\n

The law further distinguishes special entities to which it adds some special obligations. These are entities providing domain registration services and providers of strategically important services (services whose disruption could have a serious impact on the security of the Czech Republic or internal order). The strategically important services will be defined by a government decree. <\/p>\n\n

Two modes of obligation<\/strong><\/p>\n\n

The law distinguishes two regimes of obligations: 1. the regime of higher obligations and 2. the regime of lower obligations. The criteria for inclusion in the scheme are also set out in the Annex to the Regulated Services Ordinance. The basic criterion is the size of the undertaking, but other factors may also apply. <\/p>\n\n

\"\"<\/figure>\n\n

However, the Act lists providers who will always be in the higher duty regime. These are: <\/p>\n\n