NIS2 Registration with NÚKIB: A Practical English-Language Guide

Published: 19 July 2026 | Author: Vít Vomáčko | NIS2OK.cz

Once you've established that your Czech entity is likely in scope for NIS2 (see our guide for foreign-owned companies), the next question is usually the same: what does registering with NÚKIB actually involve? There's surprisingly little English-language material walking through this in practical terms, so here's what to expect and how to prepare.

Registration is self-identification, not an invitation

Under the Czech Act on Cybersecurity (Act 264/2025 Sb., effective since 1 November 2025), NÚKIB - the Czech national cyber security agency - does not proactively identify and contact every organisation that falls under the law. The duty runs the other way: your organisation is expected to assess whether it meets the sector and size criteria, and if it does, to register itself. There is no waiting period during which it's reasonable to assume you simply haven't been noticed yet.

When the clock starts

Rather than quote a specific number of days here, the practical rule is this: the statutory period for registration runs from the point the Act starts applying to you - either from the date the law took effect, if you already met the criteria at that point, or from whenever your organisation later starts meeting them, for example through a new contract, a change of activity, or growth past a size threshold. Treat "as soon as you know you're in scope" as the working deadline, not a date you can quietly push back.

What to have ready before you start

• ✓Company identification details - your Czech legal entity's registration information, exactly as it appears in the Czech commercial register.
• ✓A clear description of the service or activity that puts you in scope - which sector you operate in, and what regulated service the Czech entity actually provides.
• ✓A named contact person for cybersecurity matters - someone NÚKIB can reach, and who can represent the organisation on registration and incident-reporting questions.
• ✓Internal clarity on which regime applies - whether your entity sits in the higher- or lower-obligation category, since this shapes the process you'll need to build afterwards.
• ✓A decision-maker who can sign off - registration is a formal act on behalf of the legal entity, so someone with authority needs to be looped in early, not after the fact.

What registration is not

Registering with NÚKIB is not the end of the process - it's closer to the start. It puts you on the regulator's radar as a named, registered entity, but the substantive work - security measures, governance, incident handling - still has to be built out separately, in line with whichever regime applies. Treat registration as the formality that makes everything that follows official, not as a compliance milestone in itself.

If you're not sure you're in scope yet

If you haven't yet confirmed whether your Czech entity is in scope at all, don't start with the registration paperwork - start with an assessment. Knowing your likely regime before you approach NÚKIB makes every conversation after that faster and better-informed.