An essential service operator must verify the effectiveness of its security measures by a cybersecurity audit within two years of the date of entry in the register; the audit is carried out by a certified auditor and the final report must be submitted to the authority within 30 days. Apart from the transitional rules running until the end of 2026, only an operator that does not operate a critical essential service may replace the audit with a self-assessment through the unified information system, and even that operator must undergo an audit within five years of registration. The audit is also repeated after every change with a significant effect on the security measures.
After registration with the National Security Authority, companies tend to concentrate on security measures and documentation. Act No. 69/2018 Coll. on Cybersecurity also expects someone to verify their effectiveness independently. Whether that must be an external audit, or whether a self-assessment will do, depends on whether you operate a critical essential service.
The basic rule: an audit within two years
Under the Act, a cybersecurity audit is a verification of compliance with duties and an assessment of whether the security measures adopted meet the requirements of the Act and related regulations. The period is fixed:
An essential service operator must verify the effectiveness of the security measures adopted and compliance with the requirements laid down by this Act by carrying out a cybersecurity audit within two years of the date on which the essential service operator was entered in the register of essential service operators.
— Section 29(1) of Act No. 69/2018 Coll. (unofficial English translation)
A single audit does not discharge the duty. The audit must be repeated after every change with a significant effect on the security measures implemented, and at the interval set by the authority’s implementing regulation (Section 29(2)). It is carried out by a certified cybersecurity auditor (Section 29(3)); an ordinary internal review by the IT department is no substitute. The operator bears the cost.
When a self-assessment is enough
An operator that does not operate a critical essential service may replace the audit within that period with a self-assessment through the unified cybersecurity information system. The self-assessment is carried out by the cybersecurity manager, that is, a person independent of the management of IT operations and development (Section 20(4)(a) and Section 29(8)). Even this route does not avoid an external audit entirely. Such an operator must undergo an audit within five years of entry in the register and thereafter at the interval set by the implementing regulation.
A critical essential service includes, for example, an activity in a sector under Annex 1 to the Act other than the public administration sector, where carried on by a company exceeding the medium-sized enterprise thresholds, as well as a DNS service or a qualified trust service (Section 18(1)). An operator of such a service must notify the authority and cannot rely on a self-assessment. Before deciding which route to take, therefore, check how you are entered in the register.
The final report and what happens to it
Within 30 days of completing the audit, you submit the final report to the authority together with remedial measures and deadlines for removing the shortcomings (Section 29(5)). The latest final report is also a mandatory part of the security documentation (Section 4(1)(g) of Decree No. 227/2025 Coll.). The authority may at any time carry out its own audit or ask a certified auditor to do so, at its own expense (Section 29(6) and (7)). If the authority identifies shortcomings, it may require you to carry out an audit and implement its recommendations within a specified period (Section 29j(1)(a)).
Transitional period until the end of 2026
Companies that were essential service operators before 1 January 2025 and that the Act now treats as operators of a critical essential service may, until 31 December 2026, carry out the audit under the rules in force until the end of 2024 (Section 34b(7)). For the first and second categories of networks and information systems, the Act allows an audit falling due in 2025 and 2026 to be replaced by a self-assessment (Section 34b(8)). After that date, only the new rules apply.
The risks and our recommendation
Failing to carry out the audit or self-assessment, or failing to submit the final report, is an administrative offence carrying a fine of EUR 300 to EUR 500,000; the same applies to failing to implement remedial measures identified by the audit (Section 31(1)(f) and (g)). Note the audit date as soon as you are entered in the register, and expect the auditor to check that the documentation is up to date as well.
We assess whether a mandatory audit or a self-assessment applies to you and prepare the legal part of the documentation so that it withstands the auditor’s scrutiny, through our NIS2 and cybersecurity service. Whether you are an essential service operator at all is explained in does NIS2 apply to us, and the procedure following an incident in to whom and by when to report a cyberattack.
This answer provides general information on the law as at 12 September 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.
