NIS2 and the apps your company builds itself
If your company falls under the Czech Cyber Security Act (No. 264/2025 Coll., the Czech NIS2), or supplies one that does, the apps your people build count as development and maintenance (Decree 410/2025 Coll., Section 3(6)). If they relate to the regulated service, you have to set security requirements for them and enforce them, even in the lower regime.
For IT managers and leadership of mid-sized companies. This page covers the Czech law; other EU countries implement NIS2 through their own.
Updated 22 October 2026
Supplier contracts and development rules are mandatory.
Annex 2 of Decree 410/2025 Coll.
For the initial report (Section 16 of the act).
Does this apply to us?
Who falls under the act
Both must hold (Section 4(1)): you provide a service in one of 15 sectors, such as manufacturing, energy, transport, healthcare or digital infrastructure, and you are a medium-sized or large enterprise under Commission Recommendation 2003/361/EC. The exact services are listed in a decree of NÚKIB, the Czech cyber security agency.
You notify the service within 60 days (Section 6(1)). NÚKIB can also register a smaller provider, such as a critical infrastructure entity (Section 5).
Lower or higher regime?
The higher regime is for providers highly significant for the Czech Republic (Section 8), as set by a NÚKIB decree, and follows Decree 409/2025 Coll. Everyone else is in the lower regime under Decree 410/2025 Coll., which this guide follows.
Measures and incident reporting start no later than one year after the registration decision is delivered (Sections 13(4) and 15(4)).
You're not covered, but you supply someone who is
A regulated customer has to put security requirements into supplier contracts (Section 13(5)). In the lower regime that means the relevant points of Annex 2 of Decree 410, even in contracts already signed (explanatory memorandum to Section 3(5)).
In the higher regime, significant suppliers are told so in writing and their contracts cover Annex 5 of Decree 409 (Section 9). If your apps are part of the delivery, expect questions about who changes them.
Internal apps count too
The act covers assets related to the regulated service, which the company identifies, assesses and records (Section 12). An app you haven't assessed yet counts as in scope (Section 12(4)).
What does the law ask of the apps you build?
The mandatory minimum always applies (Decree 410/2025 Coll., Section 3(1)(b)). Other measures you can leave out for now, but you justify that in your overview of security measures, with a date, a priority and a responsible person (Section 3(2) and the explanatory memorandum).
The mandatory minimum
Security requirements for development and maintenance
Rules for how apps are made and changed, enforced. On Fabrika the platform enforces sign-in, permissions, keys and deployment, and we review every change.
Supplier contracts
With whoever builds or runs your apps. Breakdown below.
Rules for using technical assets
How technical assets, apps included, are used and handled.
Business continuity and backups
Recovery order and regular backups. See below.
Handling incidents
Assess incidents by a set method and report the significant ones. See below.
Leadership, policy and training
A person responsible for cyber security, the security policy, and training for leadership and staff.
Measures you either put in place or justify leaving out
Sections 7–9 and 11–13. These are the ones that concern apps.
| Measure | What the decree asks | On Fabrika |
|---|---|---|
| Section 7 Access control | What the decree asks Only the permissions the job needs. Remove or change access without delay when someone changes role or leaves. | On Fabrika Roles per app, assigned by you. People sign in with their company account, so you remove access in one place. |
| Section 8 Identity management | What the decree asks Multi-factor authentication. Until then keys or certificates, and only then a password of at least 12 characters for users, 17 for administrators. | On Fabrika Company account through your identity provider (OIDC), with multi-factor authentication as your company has it set up. |
| Section 9 Event logging | What the decree asks Date and time with time zone, type of activity, asset, account and result. You set the retention period yourself. | On Fabrika Sign-ins, changes to access and roles, and every deployment are recorded. We check together whether that covers your needs. |
| Section 11 Network security | What the decree asks Segment the network and limit perimeter traffic to what the service needs. | On Fabrika Apps have no public address; the only way in is through the platform. Test and production are separate environments. |
| Section 12 Application security | What the decree asks Apply security updates without delay, record unsupported assets, scan for vulnerabilities regularly. | On Fabrika We patch the platform continuously. Regular vulnerability scanning isn't part of Fabrika; if you run it, include the apps. |
What the higher regime adds
Under Decree 409/2025 Coll., among other things: change management with testing before going live and a way back to the original state (Section 11(2)), separate production, backup, development and test environments (Section 12(1)(e)), and penetration tests based on the risk assessment (Section 24(5)).
What has to be in the contract with a supplier?
Annex 2 of Decree 410/2025 Coll. lists 14 areas. The contract covers those relevant to the relationship (Section 3(5)).
| Annex 2 point | On Fabrika |
|---|---|
| a) Information security | Your own installation, one gate, company sign-in, keys held by the cloud provider. Non-disclosure is in the contract. |
| b) e) h) Supplier audit, penalties, confidentiality of the relationship | Set in the contract, not promised here in advance. |
| c) Chain of suppliers | One supplier: us. The cloud account (Zerops, or AWS if you need it) is in your company's name, the AI runs on your own plan, and any developer or agency you hire yourself. |
| d) Exit strategy | The code is yours, data and domains are in your account. The system keeps running without us and the next person picks it up from Git. |
| f) Right to use data | We access the data only as needed for review, deployment and patches. Nothing is trained on it. |
| g) Code authorship and licences | The apps' code is yours. The platform is open source under the MIT licence; the service is covered by the contract. |
| i) Your security policies | Send us your supplier rules before signing. We'll say which we meet and how they go into the contract. |
| j) Change management | Every change goes through Git with author, time and description, a person on our side reviews it, and you get a report of what was deployed. |
| k) Incidents related to the contract | Error alerts and our help with the investigation (see incidents). The deadline for informing you is in the contract. |
| l) Business continuity | Backups and recovery as our service (see backups). |
| m) SLA and level of security measures | Operations and change review come with an SLA; the parameters are in the contract. |
| n) Secure development | Building with AI works on the brief and the code, not on production data. The platform's rules and our review apply the same when your developer or agency builds. |
In the higher regime
Significant suppliers fall under Annex 5 of Decree 409/2025 Coll. (18 points). It adds, for example, notice of a change of the supplier's ownership, of a foreign authority requesting data, or of the people who handle your confidential information. We go through them with your lawyer.
Who backs up the apps' data?
The company “makes regular backups of the information, data, configurations and settings of technical assets needed in particular to restore the regulated service in the event of a cyber security incident.”
What we do
We set up backups and recovery with you: what, how often, how long and how fast it must be back. It's our service, agreed at setup; the platform doesn't do it on its own.
In the higher regime
You also set a recovery time and recovery point and test recovery plans regularly (Decree 409/2025 Coll., Section 15). Bring the numbers and we'll match the backups.
When and to whom do you report an incident?
In the lower regime you report to the National CERT an incident within the regulated service that originated in cyberspace, has a significant impact and where intent can't be ruled out (Section 15(2) of the act). In the higher regime you report to NÚKIB even without significant impact (Section 15(1)).
Significant impact means serious operational disruption, financial loss or considerable harm to others (Section 15(3)); in the lower regime you set the threshold yourself (Decree 410/2025 Coll., Section 14).
- 24 h
Initial report
Without undue delay, no later than 24 hours after detection (Section 16(1)).
- 72 h
Notification
For an incident with significant impact: initial assessment, impact and indicators of compromise if you have them (Section 16(3)(a)).
- 30 days
Final report
Within 30 days of the notification. If it's still ongoing, a progress report, and the final one within 30 days of resolving it (Section 16(3)(c)).
Reports go through the NÚKIB portal (Section 16(4)).
What Fabrika does
The platform collects errors from all apps and alerts on a new error or a sudden spike. We help find the cause, fix it and prepare documents for the report you file.
What stays with you?
Compliance is your company's duty and Fabrika won't take it over; a cyber security consultant or auditor helps with the documentation. Besides the mandatory minimum above, this is yours:
- Sections 6, 9, 11 of the act Notify the service and report changes to NÚKIB.
- Section 12 of the act Identify, assess and keep a record of your assets, including the apps.
- Section 3(2) Keep an overview of security measures and update it at least once a year.
- Section 4(f), Section 6(a) and (b) Decide which apps are restored first, in what order, and who is responsible.
- Section 7 Decide who gets which role in which app.
- Section 10, Section 16 of the act Assess an incident and file the report.
What we give you for it
Technical groundwork on sign-in, roles, records, changes and backups for your overview of security measures. We'll also fill in your security questionnaire.
When is Fabrika not for you?
A supplier certification is a condition
If you need ISO 27001 or SOC 2 from a supplier, ask about it at the start of the first call, so nobody wastes time.
You need penetration tests and rollback as part of the service
The higher regime asks for penetration tests (Decree 409, Section 24) and a way back to the original state (Section 11). Fabrika doesn't promise either today.
What people ask about NIS2 and apps
What are the fines?
In the lower regime up to CZK 175 million or 1.4 % of worldwide annual turnover, whichever is higher; in the higher regime up to CZK 250 million or 2 %. That includes not putting security measures in place and supplier contracts without the security requirements (Section 59 of the act). NÚKIB can first order corrective measures (Section 56).
Can leadership be banned from office?
Only in the higher regime: NÚKIB can ban a member of the statutory body for at least six months if they repeatedly or seriously breached their duties during a corrective measure and so frustrated it (Section 58). In the lower regime leadership still has duties: training, resources, keeping up with the measures (Decree 410, Section 4).
Where does the data live?
In a cloud account in your company's name, usually on Zerops, a Czech company with a data centre in Prague, or on AWS on request, in a region that fits your requirements. Each company has its own installation and shares it with no one.
Go through it with our engineer.
Bring your overview of security measures or your supplier questionnaire. In half an hour we'll go through what concerns the apps and what Fabrika handles.
Sources
Not legal advice. The guide summarises the act and the decrees as they stood on 28 September 2026. How they apply to you is best assessed with your lawyer or auditor; we'll give them the technical details.