The Cybersecurity Act after NIS2 implementation

Amendment No. 366/2024 Coll. widened the circle of regulated companies; incidents are reported within 24 and 72 hours.

AWhat changed

Act No. 366/2024 Coll. amended Act No. 69/2018 Coll. on cybersecurity and transposed the NIS2 Directive. It widened the circle of operators of essential services, introduced registration with the National Security Authority (Národný bezpečnostný úrad, NBÚ), mandatory security measures and stricter incident reporting.

BWhen

In force from 1 January 2025.

CWho it affects

Medium-sized and large enterprises in the defined sectors (energy, transport, finance, health, digital infrastructure, ICT services, food, digital providers and others).
Certain entities regardless of size (e.g. DNS providers or trust service providers).

DWhat to do

Assess whether your company falls under the Act (the NBÚ provides a guidance tool).
A newly regulated entity must register within 60 days of starting the activity (Section 17(2)).
Security measures must be adopted within 12 months of entry in the register (Section 19(1)).
Set up an incident reporting process: early warning within 24 hours, notification within 72 hours, final report within one month (Section 24).

Explanation

The Act leaves it to the company itself to assess whether it falls within scope. The deciding factors are sector and size under Commission Recommendation 2003/361/EC.

Sources

Last checked: 12 October 2026 · How we correct errors