Czech Republic Act No. 266/2025 Sb. — Critical Infrastructure Resilience Act (CER Directive transposition)

Mechanism

Act No. 266/2025 Sb. is the Czech Republic's transposition of EU Directive 2022/2557 of 14 December 2022 on the resilience of critical entities (the CER Directive — the physical-resilience counterpart to NIS2, which Czechia transposes via the separate new Zákon o kybernetické bezpečnosti). The statute removes critical-infrastructure regulation from the older crisis-management law (Zákon č. 240/2000 Sb. o krizovém řízení) and consolidates it into a dedicated, cross-sectoral framework.

Core mechanics:

• Sectoral scope (11 CER sectors) — energy; transport (air, rail,

water, road); banking; financial-market infrastructure; health; drinking water; wastewater; digital infrastructure; public administration; space; and food production, processing, and distribution.

• Conceptual shift — moves away from the older approach of the state

designating individual "elements of critical infrastructure" toward designating critical infrastructure entities (essential-service providers), which then identify the assets they themselves consider critical for delivering those services. Mirrors the CER Directive's outcome-oriented model.

• Operator obligations — designated entities must (a) conduct a

documented risk analysis covering natural, technical, human, and hybrid threats; (b) implement technical, organisational, and personnel-security measures (perimeter security, redundancy, business-continuity, supply-chain controls, personnel vetting); (c) report significant incidents to the relevant sector-competent authority without undue delay; (d) submit to inspection by the Ministry of Interior (MV ČR) / Hasičský záchranný sbor ČR (HZS ČR) and sector regulators.

• Sector-competent authorities — distributed across ministries

(MV ČR for general coordination + HZS ČR as enforcement, MPO for energy, MD for transport, ČNB for banking/financial-market infrastructure, MZ for health, MZe for food/water, MPSV-relevant departments for public administration). Operators of "particular European significance" (essential services to ≥6 Member States) are notified to the European Commission per Art. 17 CER Directive.

• Timeline — in force 19 August 2025; designated operators must

fulfil the initial information / registration obligation by 1 March 2026; full operator-level risk-management measures phase in through 2026-2027 per implementing decrees.

Act 266/2025 sits alongside the new Czech Cybersecurity Act (transposing NIS2) and the Czech investment-screening regime (Zákon č. 34/2021 Sb. o prověřování zahraničních investic) to give Czechia a complete cyber-physical-FDI economic-security architecture aligned with the EU baseline.

Downstream implications

• First binding standalone Czech statute on cross-sectoral physical

resilience — replaces the older patchwork in the crisis-management law and voluntary HZS ČR guidance. Raises compliance cost for major Czech operators in energy (ČEZ, ČEPS, Net4Gas, MERO ČR, NET4GAS, ORLEN Unipetrol refineries), transport (ČD, SŽ, Letiště Praha, ŘSD), banking (ČSOB, Česká spořitelna, KB, Moneta), and ICT/data-centre operators above sectoral thresholds.

• Closes the EU CER-Directive transposition cohort for the IPTM

register's Central-European cluster: Germany filed (2026-03-17-germany-kritis-dachgesetz); Czechia now filed; Spain, Italy, France, Poland transpositions still outstanding as of 2026-05-11.

• First CZ filing in the IPTM register — fills the Czech Republic =

0 country-coverage gap despite Czechia being an EU CRMA Strategic- Project host country with four approved projects (Cinovec lithium + manganese mining/processing). Provides the regulatory anchor for future CZ filings on FDI screening, cybersecurity, and CRMA-project state aid.

• Investment-screening overlap: entities designated under Act

266/2025 fall within the cross-sector investment-review trigger of Zákon č. 34/2021 Sb. — strengthens FDI control over Czech critical infrastructure, particularly relevant for Chinese-owned data-centre and energy-storage assets in the Czech market.

• Procurement implications: designated critical-infrastructure entities

will increasingly require resilience-relevant suppliers to evidence compliance, raising barriers for non-EU/non-NATO-aligned vendors in Czech CI procurement (telecoms, perimeter security, redundant power, industrial control systems).

Open questions

• Final list of designated critical-infrastructure entities once the

implementing decrees and sector-competent-authority notifications complete (expected through H1 2026).

• Sectoral thresholds (e.g., minimum customers served, generation

capacity, transaction volume) for triggering operator designation — set by ministerial decree.

• Coordination between MV ČR/HZS ČR (physical-resilience supervisor)

and NÚKIB (cyber-resilience supervisor under the new Zákon o kybernetické bezpečnosti) for entities falling under both regimes.

• Enforcement capacity: HZS ČR and sector regulators historically

under-resourced for cross-sectoral inspections vs the volume of newly- regulated operators.

• Whether the Czech FDI-screening authority will use Act 266/2025

designations as a presumptive trigger for mandatory review of foreign acquisitions of Czech critical-infrastructure assets.