In June we set out how NIS2 and the Czech Critical Infrastructure Act (ZKI) made personnel security a legal requirement. Since then, the timetable has started to run. Between December 2026 and the summer of 2027, the first substantive NIS2 deadlines and ZKI deadlines fall due in the Czech Republic, and the rest of the region is moving in the same direction.
Background: NIS2 and ZKI: When Background Screening Became a Legal Obligation
Critical Infrastructure Portal (Ministry of the Interior)
Cybersecurity Act (ZKB): year one ends in December
The ZKB has applied since 1 November 2025. Providers of regulated services had 60 days to register with NÚKIB, so most organisations in scope registered by 31 December 2025. Twelve months after registration, the obligations to implement security measures and to report cybersecurity incidents take effect. For most registrants, that point is the end of 2026.
NÚKIB is pursuing organisations that have not registered. By early October 2026 it had contacted more than 4,400 organisations, through around 3,600 data box messages and over 800 emails, and recorded more than 1,000 new registrations since the campaign began in March. Operating a regulated service without registration carries fines of up to CZK 250 million or 2% of worldwide annual turnover.
Readiness is uneven. Václav Svátek, director of ČMIS, estimates that around half of Czech firms do not address cybersecurity at all and that only 10 to 15% are at a solid level.
For entities in the higher-obligation regime, Decree No. 409/2025 Coll. defines what personnel security means in practice. It requires a security awareness plan, induction and regular training for users, administrators and security roles, records of who was trained and on what, checks on compliance with security policy, and procedures for breaches. Access rights must be limited to what each role strictly needs, removed without delay when a role or contract ends, and documented.
Critical Infrastructure Act (ZKI): listed entities are on the clock
The Critical Infrastructure Portal has been fully operational since 16 September 2026, and providers of essential services submit their information through it. The Ministry of the Interior decides on listing without undue delay after receiving the sectoral authority’s proposal. The list itself is not public.
Obligations apply from the day the listing decision is delivered. Reliability verification under § 17 has no separate deadline: from that day, the entity must verify the identity and criminal records of workers involved in providing the essential service and of anyone entrusted with direct or remote access to its premises, information or control systems. This covers existing workers, not only new hires.
The remaining obligations follow a fixed timetable. The risk assessment is due within nine months of delivery. The resilience plan, the designation of a critical infrastructure manager and of critical suppliers, and the start of incident reporting are due within ten months. For an entity whose decision is delivered in October 2026, that means July and August 2027. The manager must meet the conditions for a sensitive activity under the Act on the Protection of Classified Information, a process that can take months and should start immediately.
Suppliers: where the obligation travels
Both acts push personnel security into the supply chain. Under the ZKI, reliability verification covers anyone entrusted with direct or remote access to the entity’s premises, information or control systems, including the staff of suppliers and contractors. Under the ZKB, Decree No. 409/2025 Coll. requires contracts with significant suppliers to contain the relevant clauses. These include an obligation on the supplier to inform the entity about the individuals who come into contact with its confidential information, such as administrators, security role holders and penetration testers, and rules that bind subcontractors to the same terms.
In practice, an entity cannot evidence the screening of supplier personnel unless the contract gives it the information and the right to require it. Contracts signed or renewed in the coming months are the natural point to add these terms.
NIS2 deadlines across the region
In Poland, the self-registration deadline under the amended Act on the National Cybersecurity System (KSC Act) passed on 3 October 2026. The wider obligations, including risk management, incident handling, business continuity and supply chain security, apply from 3 April 2027. Administrative fines generally cannot be imposed before April 2028.
In Germany, the NIS2 Implementation Act (NIS2UmsuCG) has applied since 6 December 2025, without a transition period.
At EU level, the European Commission proposed targeted amendments to NIS2 on 20 January 2026, alongside a revised Cybersecurity Act. The proposal introduces a small mid-cap category, covering entities with fewer than 750 employees and annual turnover below EUR 150 million, which would generally be treated as important entities. It also narrows parts of the scope and extends ransomware reporting. The proposal is still in the legislative process and would require a further transposition period once adopted. It does not defer any obligation that applies today.
What to have ready
Supervisors will ask for evidence, not intentions. Scaut recommends having the following in place before the first deadline that applies to your organisation.
A written screening policy that names the roles in scope, the checks required for each and how often they are repeated. A register of screened individuals, covering employees and supplier personnel, with the date and result of each check and the documents relied on. For ZKI entities, Czech and foreign criminal record extracts for every person in scope, including existing staff. Supplier contracts that oblige suppliers to identify the personnel with access and to support their verification. Access records that show access was granted only after screening and removed when the role or contract ended.
For most Czech regulated entities, the first real test of personnel security falls within the next twelve months. The organisations that pass it will be those that can produce the records on request.