Updated on 21 October 2026 to reflect the Czech, German and Polish implementing legislation.
For the better part of two decades, background screening in European organisations occupied an ambiguous middle ground. It was widely understood to be good practice. It was recommended in ISO 27001 and various sector-specific codes of conduct. It was common in financial services and aviation, where regulators had long imposed personnel integrity requirements. But for the broad majority of European employers, including those operating critical infrastructure, it was optional.
That changed with the NIS2 Directive. In the Czech Republic, it changed further through two national acts: the Cybersecurity Act (Act No. 264/2025 Coll., ZKB), which transposes NIS2, and the Critical Infrastructure Act (Act No. 266/2025 Coll., ZKI), which transposes the EU Critical Entities Resilience (CER) Directive. For critical infrastructure entities the ZKI makes identity and criminal record verification an explicit statutory duty.
What NIS2 actually requires
NIS2, officially Directive (EU) 2022/2555, entered into force on 16 January 2023. Member States were required to transpose it by 17 October 2024 and to apply its measures from 18 October 2024. It replaced the original NIS Directive (EU) 2016/1148 and covers a substantially wider range of sectors.
Annex I of the Directive lists sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space. Annex II lists other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing of critical products, digital providers and research. Whether an entity is classed as essential or important depends on both its sector and its size. Entities identified as critical entities under the CER Directive are treated as essential entities.
Article 21 requires essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage cybersecurity risks. Article 21(2)(i) names human resources security, access control policies and asset management among the minimum measures. Recital 79 confirms that entities are to address human resources security as part of their cybersecurity risk-management measures.
For a defined group of digital providers, the requirement is more specific. Commission Implementing Regulation (EU) 2024/2690 applies to DNS service providers, TLD name registries, cloud computing and data centre service providers, content delivery network providers, managed and managed security service providers, online marketplaces, online search engines, social networking platforms and trust service providers. Point 10.2 of its Annex requires these entities to verify, to the extent feasible, the background of their employees and, where applicable, of direct suppliers and service providers, where the role, responsibilities and authorisations require it.
Personnel security is therefore a required element of NIS2 compliance. Supervisory authorities are empowered to inspect it, require evidence of it and sanction failures.
The Czech framework: two acts, two regulators
The Cybersecurity Act (ZKB), Act No. 264/2025 Coll., transposes NIS2 and has been in force since 1 November 2025. It applies to providers of regulated services and is supervised by the National Cyber and Information Security Agency (NÚKIB). NÚKIB estimated that around 6,000 organisations fall within the Act’s scope, and the original impact studies put the figure at 6,000 to 10,000. Its security measures decrees, Nos. 409/2025 and 410/2025 Coll., require human resources security focused on security awareness, training and enforcement of security rules for users, administrators and security roles.
The Critical Infrastructure Act (ZKI), Act No. 266/2025 Coll., transposes the CER Directive (EU) 2022/2557 and has been in force since 19 August 2025. It is administered by the Ministry of the Interior through the General Directorate of the Fire Rescue Service, together with sectoral authorities. Government Regulation No. 127/2026 Coll. defines the essential services and significance criteria, and Decree No. 122/2026 Coll. sets out the resilience measures. The ZKI applies to providers of essential services that the Ministry of the Interior enters on the list of critical infrastructure entities. These entities are also subject to the ZKB.
ZKI § 17: an explicit screening duty
Section 17 of the ZKI requires a critical infrastructure entity to verify the reliability of its workers, including job applicants. This applies to workers involved in providing the essential service and to any person entrusted with direct or remote access to the entity’s premises, information or control systems.
From each such person, the entity must require proof of identity and an extract from the Czech Criminal Records Register. For non-Czech nationals, it must also require an equivalent document from the state of citizenship. The same applies to any state in which the person stayed continuously for more than three months in the last three years. A Czech extract with an annex containing the foreign record is an accepted alternative.
The critical infrastructure manager must in addition meet the conditions for performing a sensitive activity under the Act on the Protection of Classified Information. The verification duty also covers anyone entrusted with direct or remote access, including the staff of suppliers and contractors.
Deadlines
Under the ZKB, an entity must notify NÚKIB of its regulated service within 60 days of meeting the registration criteria. For entities in scope on 1 November 2025, that period ended on 31 December 2025. Obligations to implement security measures apply one year after registration.
Under the ZKI, providers of essential services meeting the criteria in Government Regulation No. 127/2026 Coll. submit the required information through the Critical Infrastructure Portal, fully operational since 16 September 2026. The Ministry of the Interior then decides on entry in the list. The § 17 screening duty applies from entry in the list. The risk assessment, resilience plan and appointment of a critical infrastructure manager follow within periods counted from that decision.
Who is affected, and the scale of exposure
In the Czech Republic, more than 4,500 organisations registered under the ZKB in the first two months, against NÚKIB’s estimate of around 6,000 in scope and other estimates of up to 10,000. Critical infrastructure entities under the ZKI form a smaller group with the most specific screening obligations.
In Germany, the NIS2 Implementation Act (NIS2UmsuCG) entered into force on 6 December 2025 without a transition period. It revises the BSI Act and extends the regulated population from about 4,500 to about 29,500 entities, supervised by the Federal Office for Information Security (BSI).
In Poland, the amended Act on the National Cybersecurity System (KSC Act) entered into force on 3 April 2026. Essential and important entities had to register by 3 October 2026. Supervision sits with sector-specific competent authorities. Administrative fines generally cannot be imposed until two years after entry into force. The President has asked the Constitutional Tribunal to review the provisions on high-risk ICT vendors and emergency security orders (case K 19/26, pending).
Penalties
Article 34 of NIS2 requires Member States to provide for administrative fines with a maximum of at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher, for essential entities, and a maximum of at least EUR 7 million or 1.4% for important entities. These are minimum ceilings: national law may set higher maxima, and the fine in each case is set by the authority.
Under the ZKB, fines reach up to CZK 250 million or 2% of worldwide annual turnover in the higher-obligation regime, and up to CZK 175 million or 1.4% in the lower-obligation regime.
Under the ZKI, fines reach up to CZK 25 million or 0.3% of net annual turnover, whichever is higher, rising to CZK 50 million or 1.5% for repeated breaches.
Fines are not the only instrument. Supervisory authorities can issue binding instructions, order remediation within a set deadline, appoint a monitoring officer and order aspects of non-compliance to be made public.
The gap between obligation and practice
In our experience, many organisations subject to NIS2 and the ZKI have not yet implemented systematic screening processes. Some are still mapping their compliance obligations and have not reached the personnel security workstream. Others assume that existing pre-employment reference checking meets the requirement, which for ZKI entities it does not. Others are waiting to see whether authorities prioritise this area.
GDPR offers a relevant parallel. When GDPR began to apply in May 2018, many organisations adopted a wait-and-see approach. In our view, enforcement was initially slow, then accelerated, starting with the most visible failures and moving to systematic scrutiny of organisational practices.
We see early signs of the same pattern under NIS2. NÚKIB has begun contacting organisations it considers to be in scope of the ZKB but which have not registered.
What a compliant screening programme looks like
A compliant personnel security programme does not need to be elaborate. It needs to be proportionate, documented and consistently applied.
For ZKI entities, the statutory minimum is identity verification and criminal record checks covering the countries of citizenship and recent residence. Under NIS2 and the ZKB, the depth of checks follows the entity’s own risk assessment.
Scaut recommends the following as a defensible standard for employees and contractors with access to sensitive systems or data: identity verification, criminal record checks appropriate to the individual’s nationality and countries of residence, and verification of the employment history the individual has declared. For roles with privileged access, such as system administrators, security personnel and those with access to personal data at scale, enhanced checks including adverse media screening and, where relevant, financial probity checks are appropriate. For generation, distribution and storage sites, the roles in scope are set out under background checks in the energy sector.
The programme must be documented. An organisation that has conducted screening but cannot demonstrate what it did, when and for whom is in a weak position before a regulator seeking evidence of compliance. The screening process should generate records that can be produced on request.
The programme must also extend beyond permanent employees. The ZKI covers workers and anyone entrusted with direct or remote access to premises, information or control systems, including the staff of suppliers and contractors. In our reading, temporary staff and agency workers with that access are in scope regardless of how they are engaged.
The window for proactive compliance
Organisations that have not yet implemented structured screening can still approach this proactively rather than reactively. Establishing a screening programme now, with clear documentation of what is covered, at what standard, and how results are recorded and acted upon, creates a defensible position against regulatory scrutiny.
The alternative, waiting until an inspection reveals a gap, is a significantly less attractive option. Fines are only part of the exposure: remediation orders, monitoring and public disclosure carry operational and reputational consequences of their own.
For critical infrastructure entities in the Czech Republic, background screening is now the law. For NIS2 entities across Europe, it is part of the personnel security they must be able to evidence.