Registration
Assess whether the municipality or its organisations provide a regulated service, and report it to the Authority via the NÚKIB Portal within 60 days of meeting the conditions (Section 6(1)).
FOR MUNICIPALITIES
The cyber act reaches municipalities too. What decides is the service, not the size of the office.
Act No. 264/2025 Coll. transposes the NIS2 directive into Czech law and also covers municipalities and subsidised organisations. Ten questions and two minutes will tell you whether it likely covers you too. Below is what the Act requires of municipalities, within which deadlines, and how to comply without an extra binder. The test itself is in Czech.
Four duties. None of them just for IT.
This is not just a job for the IT administrator. The Act wants management accountability, incident procedures, and records showing the municipality actually manages risk.
Security measures
Within one year of delivery of the registration decision, put organisational and technical measures in place. Section 14 of the Act lists them; a decree sets out their content (Section 13(4)).
Incident reporting
Cyber incidents are reported to the Authority within the time limits of Section 16: an early warning within 24 hours of detection, a notification within 72 hours of detection, and a final report within 30 days of the notification.
Management responsibility
Management of the organisation is responsible for compliance, not just the IT administrator.
Five places where municipal offices struggle.
- Outdated websites and unpatched systems
- Shared passwords and missing multi-factor authentication
- Email without SPF, DKIM and DMARC
- Backups that would not survive ransomware
- AI tools deployed without rules or oversight
Snapshot, training, plan. In this order.
CIAD Snapshot
An initial assessment without access to municipal systems. The output is a score of 0 to 100 and a remediation plan with an owner and a deadline. Priced by scope, quoted on request.
Training for the office
From safe AI use to a programme for management. Practical training for clerks, IT administrators and leadership.
Measure plan and verification
We help prioritise steps under Section 14, assign owners, and verify after implementation that the measures actually work.
A process that produces no binder.
The goal is not a folder of documents. The goal is concrete risks, a name behind every measure, and verification that the measures really work.
Indicative classification
The municipality or its subsidised organisation takes a short NIS2 test to find out whether registering with NÚKIB makes sense.
Snapshot of the current state
CIAD checks publicly visible exposure, the website, email, basic AI rules and incident readiness.
Remediation plan
The output is a prioritised list of steps with an owner, a deadline and an explanation municipal leadership can understand.
Training and prevention
Training for the office and ongoing verification follow the fixes, so the changes last through staff and system changes.
What municipalities ask before they call us.
Does the Act apply to our municipality?
+
What matters is the type of service provided, not the size of the office. Under Section 7(b), municipalities and their organisations are not considered an enterprise, so the size test does not apply to them. What decides is whether the municipality or its organisation provides a regulated service under Decree No. 408/2025 Coll. The test at /nis2-test/ gives an indicative answer; registration with NÚKIB is binding.
By when must we comply?
+
The Act is effective from 1 November 2025. A regulated service must be reported within 60 days of meeting the conditions, and the one-year period for putting measures in place runs from delivery of the registration decision. The sooner a municipality finds out whether it falls under the regulation, the calmer the schedule.
How much does it cost?
+
We quote on request. The scope of the Snapshot and of further steps depends on the size of the office, the number of organisations, and whether the municipality provides a regulated service.
FIRST STEP
Take the NIS2 test.
Ten questions will show whether the municipality should deal with NÚKIB registration or whether basic cyber hygiene is enough for now. The test is in Czech. If you are unsure, write to office@ciad.cz.