Section: All

New Cybersecurity Act and NIS2: Top management bears direct responsibility

In recent days, the President of the Czech Republic, Petr Pavel, signed a new law on cybersecurity, which implements the European directive NIS2 (Network and Information Security Directive 2). This law significantly changes the approach to cybersecurity management in the Czech Republic and affects both state institutions and the private sector.

Main changes and impacts of the new legislation

1. Binding personal liability of top management
   
   • The law shifts responsibility for cybersecurity directly to the top management of organizations, especially to members of statutory bodies, such as members of the board of directors, executives, members of the supervisory board, or the general director (CEO).
   • Responsibility is non-transferable, it cannot be delegated to lower management or external suppliers.
   • Risks for non-compliance with obligations can be of the nature of either: financial (fines up to 2% of turnover or hundreds of millions of CZK), So personal (e.g. ban on holding office for up to 5 years).
2. Expansion of the scope of the law
   
   • The law will affect 6 to 000 entities throughout the Czech Republic, across all sectors, including not only state organizations, but also hospitals, entities from the energy, transport, food, pharmaceuticals, digital infrastructure, research organizations, and medium-sized and large enterprises.
   • The entities are divided into significant a important according to the nature of the services provided and the extent of the impact of their potential failure.
3. New requirements for security management (ISMS)
   
   • Organizations will need to have comprehensive information security management systems (ISMS) in place, which will include:
     
     • Assessing risks and implementing appropriate measures to manage them (e.g. data encryption, multi-factor authentication, network segmentation).
     • Supply chain security management (e.g. partner verification, contractual security commitments).
     • Incident response plan – i.e. specific scenarios of procedures in the event of an attack or threat to the system.
     • Regular audits, security tests and record keeping of management activities in the area of ​​security.
4. Cybersecurity as part of strategic management
   
   • ISMS now falls under the responsibility of the organization's strategic management, similar to financial management or legal compliance.
   • Cybersecurity governance must be regularly discussed at board level and documented. These records can be key evidence in assessing responsibility in the event of an incident.
5. Deadlines and effectiveness
   
   • The law was approved by the Chamber of Deputies and, after being signed by the President of the Czech Republic on June 26, 2025, is to be published in the Collection of Laws in August 2025.
   • It is to take effect from 1 November 2025, with a transition period of 12 months for the implementation of the necessary measures.

 Practical recommendations for organizations

záver

Cybersecurity law is no longer an IT department issue – it is becoming part of top management risk management. In addition to protecting against real threats such as ransomware attacks, data loss or threats to operational infrastructure, it is also a matter of reputation, legal liability and competitiveness.

Recommended and verified sources

• NUKIB: NIS2 Directive pages

For more information or to prepare your own organization for new responsibilities, you can contact us at sales.

GEM System successfully passed extensive ISO recertification

Quality, security and reliability are key in IT – and we confirm this not only through our work, but also through international certifications. In 2025, we successfully recertified all of our key ISO standards, which guarantee that our solutions meet the highest standards for B2B and B2G segments.

✅ ISO 9001 – Quality Management: We provide efficient and consistent services with an emphasis on continuous improvement.
✅ ISO 27001 – Information Security: We protect sensitive data and meet strict cybersecurity requirements.
✅ ISO 20000-1 – Service Management: We guarantee professional and reliable IT service management according to international standards.
✅ ISO 10006 – Quality in projects: Our IT project management is structured, efficient and minimizes risks. TISAX and ISO 14001 are still valid and confirm our responsibility to safety and the environment.

🔍 Why does it matter? In the field of B2B and B2G IT solutions, trust is key. Our customers – from corporations to government institutions – demand stability, security and a high standard of service. Thanks to these certifications, they have the confidence that:
💡 Their data is protected at a top level.
💡 Our services comply with best international practices.
💡 Working with us means minimizing risks and maximizing efficiency.

We are proud to be constantly improving and innovating. Thank you to our team and partners for supporting us on this journey! 🚀

#GEMSystem #ISO #TISAX #Quality #Security #ITSolutions #B2B #B2G #Recertification

Detailed information about ISO can be found here. <a href="https://cdn.shopify.com/s/files/1/1932/8043/files/Odstoupeni_od_smlouvy_EN.pdf?v=1595420299" data-gt-href-en="https://en.notsofunnyany.com/">HERE</a>.