+420 266 104 111 (8:00-16:30, Mo-Fr)
Order

We are a manufacturing company. Do NIS2 and the new Cybersecurity Act apply to us?

18. 7. 2025

Yes. If you are a manufacturing company, it is likely that the NIS2 directive and its Czech implementation (the new Cybersecurity Act) apply to you. These regulations target organizations operating critical or important infrastructure and may also affect manufacturers within key supply chains. We recommend conducting an assessment to determine whether your company falls under these rules and to prepare for any cybersecurity obligations.

Further information: NÚKIB Guide to the New Cybersecurity Act

Besides NIS2, it’s important to monitor other upcoming EU regulations that will significantly impact manufacturing firms:

  • RED: Effective August 1, 2025, the delegated act introduces cybersecurity requirements for all radio equipment connected directly or indirectly to the internet—ranging from industrial devices to consumer electronics.

  • Cyber Resilience Act (CRA): Effective December 11, 2027, with incident reporting obligations starting September 11, 2026. Applies to all products with digital elements and requires manufacturers to report major cybersecurity incidents and actively exploited vulnerabilities to ENISA or national authorities.

! Manufacturing companies should begin preparing for these regulations now—including assessing current products, implementing security measures, and ensuring compliance. Early preparation will help minimize risk and ensure a smooth transition to the new cybersecurity standards.