CRA Compliance in Czech Republic

NUKIB serves as the Czech Republic's national competent authority for the CRA, building on its established mandate under the Zákon o kybernetické bezpečnosti (Act No. 181/2014 Sb., Cybersecurity Act) as updated by NUKIB's NIS2 transposition. The Czech Trade Inspection Authority (ČOI) coordinates market surveillance for consumer products and CE marking enforcement, and will partner with NUKIB on CRA market surveillance activities. The Czech Republic has been a proactive voice in EU cybersecurity policy, and NUKIB's technical capacity — including its IACS security expertise — positions it as an engaged and technically credible CRA enforcement authority.

Czech manufacturers submit Article 14 notifications to CSIRT.CZ (for private sector manufacturers) or GovCERT.CZ (for public sector supply chains) through NUKIB's incident reporting system. NUKIB maintains 24/7 incident response capability. The Article 14 obligation requires an early warning within 24 hours of detecting active exploitation and a full notification within 72 hours. Czech NIS2 transposition through the amended Zákon o kybernetické bezpečnosti created an incident reporting framework administered by NUKIB, and CRA notifications will integrate with this existing channel. CSIRT.CZ participates in the EU CSIRTs network and relays reports to ENISA.

Market surveillance for CRA products in the Czech Republic is coordinated between NUKIB and the Czech Trade Inspection Authority (ČOI). The full CRA penalty regime applies: up to €15 million or 2.5% of global annual turnover for violations of essential cybersecurity requirements. ČOI has active market surveillance operations and has conducted product safety enforcement actions across multiple EU product safety regulations. Czech manufacturers should expect NUKIB to take a technical and evidence-based approach to enforcement, consistent with its reputation as a technically sophisticated authority.

NUKIB publishes free cybersecurity guidance in Czech, including security recommendations and implementation guides aligned with international standards. NUKIB operates NÚKIB Academy, providing cybersecurity training and awareness programmes for businesses. The Czech Agency for Standardisation (ÚNMZ) publishes national adoptions of IEC and ETSI standards relevant to CRA compliance. CzechInvest and the Czech-Moravian Confederation of Trade Unions provide SME support including subsidised cybersecurity advisory services through European Structural Funds. The Association for Information Technology Security (AFCEA Czech) engages manufacturing industry on CRA implementation.