Does your foreign company provide services in the Czech Republic through a branch? Then you should pay close attention. The new Cybersecurity Act (nZKB), which transposes the European NIS2 Directive into Czech law, is taking foreign groups by surprise, as they assess their size solely based on the parameters of their Czech branch. Below, we explain why this approach exposes companies to unnecessary regulatory risk and how to correctly determine the size of an undertaking.
Act No. 264/2025 Sb. on cybersecurity regulates rights and obligations in the field of cybersecurity. For most regulated sectors, the legislation uses the “size of the undertaking” as the basic input criterion for regulation.
The size of an undertaking as the gateway to regulation
The conditions for registering a regulated service are met, inter alia, where the service provider is a medium-sized or large enterprise (within the meaning of Commission Recommendation 2003/361/EC), or where it is significant for the safeguarding of important social or economic activities of the state.
A medium-sized enterprise is understood to mean an enterprise with fewer than 250 employees, whose annual turnover does not exceed EUR 50 million or whose annual balance sheet total does not exceed EUR 43 million. A small enterprise is an enterprise with fewer than 50 employees and a turnover or balance sheet total of up to EUR 10 million.
The following applies to determining the resulting size category:
- Exceeding the employee threshold automatically changes the size category regardless of financial values.
- Reclassification into a higher size category based on financial criteria occurs only if both turnover and balance sheet total are exceeded simultaneously (while the number of employees remains the same). Exceeding only one of the financial indicators does not in itself change the size category. The number of employees is expressed in annual work units (AWU); this does not include persons working for the enterprise under a contract for work or other contracts outside an employment relationship (e.g. sole contractors).
Whilst this assessment tends to be relatively straightforward for purely “local” Czech entities, interpretative ambiguities arise in practice in the case of foreign entities operating in the Czech Republic solely through a branch.
Why is an assessment based solely on the Czech branch insufficient?
Common reasoning by foreign clients is: “Our Czech branch has only 10 employees and a low turnover – we are not a medium-sized enterprise, so the NIS2 regulation does not apply to us.”
This conclusion is incorrect from a legal perspective. Indeed, a branch is not a separate legal entity. It is merely an organisational unit of its parent company. The holder of rights and obligations is the foreign company – and it is precisely this company that constitutes the “enterprise” for the purposes of assessing size.
An enterprise is understood to mean an entity carrying out economic activities, regardless of its legal form. It may be a single company, but it may also be an entire group of companies affiliated in terms of property or personnel.
NÚKIB methodology: The entire group is decisive
As is also evident from NÚKIB’s official supporting material “Calculating the Size of an Enterprise”, the following key rules apply:
1. Affiliation in terms of property and personnel
- Up to 25% (independent enterprises): Size is not aggregated.
- 25% to 50% (partner enterprises): Size is added proportionally according to the shareholding.
- Over 50% (affiliated enterprises): Size is aggregated to 100%.
- Aggregation also applies in the case of personnel links (e.g. a common owner holding over 50% and operating in the same market).
2. Exception regarding the separation of technical assets
Notwithstanding the general European rules, an important exception applies for the purposes of nZKB: entities whose IT assets are completely separated from those used to provide a regulated service in the Czech Republic are not considered affiliated/partner undertakings. However, the exception does not apply if the undertakings share IT administration, remote access, or software licences.
Regulatory implications for foreign entities in practice
The size test does not take into account the parameters of the Czech branch, but rather the global figures for the entire group. The implications of this approach are significant:
- Regulation even with a minimal local presence: If the global group is a large enterprise, this status applies to its activities in the Czech Republic even if it has only a handful of employees here.
- Risk of late notification: The deadline for notifying the service expired at the end of last year. Entities that incorrectly assessed their size as at 1 November 2025 and have not yet notified the authorities are in default.
- Classification under the stricter regime: Large enterprises often automatically fall under the stricter regime of enhanced obligations (with the exception of specific digital services).
- Penalties based on global turnover: Failure to comply with the registration duty may result in a fine of up to CZK 250 million or 2% of the group’s total annual global turnover.
- Local representative: Providers of selected digital services outside the EU/EEA must appoint a representative in the Czech Republic.
Recommended procedure: A 4-step compliance audit
We recommend that foreign entities and their local management carry out an urgent review in accordance with the following steps:
- Service Identification: Determine whether you are in fact providing a regulated service in the Czech Republic (pursuant to Decree No. 408/2025 Sb.).
- Global Size Test: Map the group’s ownership structure and calculate the consolidated size of the enterprise, taking into account any exemptions for separated IT assets where applicable.
- Registration: If you fall within the scope of the regulation, immediately submit a notification via the NÚKIB Portal.
- Implementation: Begin preparations for the implementation of security measures. You have one year from the date of receipt of the NÚKIB’s registration decision to fully implement them.
How we can help
Determining the size of an enterprise within complex multinational structures is tricky. If you suspect that your group has incorrectly assessed its size solely from the perspective of a local branch, we recommend addressing the situation without delay. At HAVEL & PARTNERS, we are ready to assist you immediately.
