The new Act No. 266/2025 Coll., on the Resilience of Critical Infrastructure Entities (the Critical Infrastructure Act), transposes Directive (EU) 2022/2557 on the resilience of critical entities (the CER – Critical Entities Resilience Directive). The Act entered into force on 19 August 2025.
The system of critical infrastructure is not a new concept; it has been embedded in the Czech legal framework since 2010, specifically in the Crisis Management Act.
Previously, the legislation focused on elements of critical infrastructure, i.e. assets, buildings, facilities, or networks designated by the competent authorities.
Under the new approach, the focus has shifted to the provision of an essential service by a given operator. Instead of identifying “elements of critical infrastructure,” the law now designates “critical infrastructure entities,” which subsequently define for themselves the critical infrastructure necessary for the provision of the essential service.
The new Act defines what constitutes an essential service, including, for example, energy supply, healthcare, transport, water management, digital infrastructure, or the functioning of public administration.
An essential service provider is any entity that provides such a service within the territory of the Czech Republic and at the same time meets at least one of the significance criteria, such as the number of users, market share, or the dependence of other sectors on the service.
An essential service provider that commenced the provision of an essential service no later than 30 November 2025 is required to submit relevant information to the competent authorities by 1 March 2026. However, the implementing legislation has not yet been adopted, namely:
- a Government Regulation on essential services and significance criteria,
- a decree on the requirements for and processing of the resilience plan, risk assessment, and the content of measures to ensure the resilience of critical infrastructure entities,
- a decree specifying the details of incident reporting in relation to critical infrastructure entities, and
- a decree on the Critical Infrastructure Portal.
Digital Legal Update 01/2026 here.