According to the National Security Authority's interpretation, generally not, because the branch forms part of the Czech company, which falls within the jurisdiction of the state in which it is established and therefore under the Czech Cybersecurity Act. However, the authority's interpretation is not binding. The recitals to the NIS2 Directive envisage concurrent jurisdiction over an entity established in several states. It is therefore sensible to assess a branch with its own operations under Slovak law as well. Exceptions apply to providers of public electronic communications networks and services, which fall under the state where they provide services, and to certain digital services, for which the location where cybersecurity decisions are taken is decisive. A Slovak subsidiary, by contrast, is a Slovak entity.
According to the National Security Authority’s interpretation, a Czech company with a branch in Slovakia generally does not have to comply with the Slovak Cybersecurity Act in respect of that branch. The branch is not a separate legal person and is therefore assessed together with the company by reference to the state in which the company is established. However, Slovak legislation may apply to telecommunications and certain digital services. A Slovak subsidiary, by contrast, is assessed under Slovak law.
The company’s place of establishment is decisive
Directive (EU) 2022/2555 (NIS2) places entities within its scope under the jurisdiction of the Member State in which they are established (Article 26(1) of Directive (EU) 2022/2555). In response to a question from a Czech joint-stock company with a branch in Slovakia, the National Security Authority stated that the branch has no legal personality and is therefore subject to the law of the Czech Republic, where the business that established it is itself established (NBÚ’s opinion on branches). The authority also cautions that its answers are not legally binding interpretations. Furthermore, the Directive states in its recitals that an entity providing services or established in more than one Member State should fall under the concurrent jurisdiction of each of them, and that their authorities should cooperate (recital 113). If the branch has its own operations and services in Slovakia, it is therefore sensible to assess it under Slovak law as well.
In Czechia, Act No. 264/2025 Sb. on Cybersecurity (Cybersecurity Act) has been in force since 1 November 2025. It applies to persons established in the Czech Republic and, regardless of their place of establishment, to those providing electronic communications networks or services there (Section 1(2) of Act No. 264/2025 Sb.). Whether your service meets the conditions for registration with the Czech authority NÚKIB is determined by Sections 4 and 5 of that Act and the authority’s implementing decree (Section 4(2)).
When Slovak law applies
The Directive provides exceptions to the establishment rule that may also affect a Czech company. Providers of public electronic communications networks and publicly available electronic communications services fall under the state in which they provide their services (Article 26(1), letter a)). If you provide public electronic communications services in Slovakia through your Slovak branch, you therefore fall within Slovak jurisdiction to that extent. Act No. 69/2018 Z. z. on Cybersecurity provides for such an undertaking to be entered in the register of operators of essential services regardless of its size (Section 17(1), letter c), point 1). For the specified digital services, the main establishment in the Union is decisive (letter b)), and the Slovak Act incorporates this as follows:
The following quotation is reproduced in its original language:
Ak ide o osobu, ktorá poskytuje službu DNS, službu registrácie názvu domény, službu cloud computingu, službu dátového centra, sieť na sprístupňovanie obsahu, riadenú službu, bezpečnostnú službu, službu online trhu, službu internetového vyhľadávača alebo platformu služieb sociálnej siete, možno ju zapísať do registra prevádzkovateľov základnej služby a tento zákon sa na ňu vzťahuje aj vtedy, ak nemá trvalý pobyt, miesto podnikania alebo sídlo na území Slovenskej republiky, a) má trvalý pobyt, miesto podnikania alebo sídlo v členskom štáte Európskej únie alebo štáte, ktorý je zmluvnou stranou Dohody o Európskom hospodárskom priestore […] a na území Slovenskej republiky 1. najčastejšie prijíma rozhodnutia týkajúce sa bezpečnostných opatrení na riadenie rizík, […]
If a Czech company provides, for example, cloud, data centre or managed IT services, and cybersecurity decisions are most often taken at its Slovak branch, Slovak law may apply to it. If that location cannot be determined, the relevant state is the one where cybersecurity operations are carried out and, ultimately, the state in which the establishment with the largest number of employees in the Union is located (Article 26(2)). If an operator of an essential service also provides a service in another Member State, NBÚ, in cooperation with that state’s authority, decides which state’s criteria will be used to identify it (Section 19(5)).
Rules for subsidiaries and Slovak customers
If you operate in Slovakia through a subsidiary, it is established in Slovakia and its obligations are assessed under Slovak law. Partner and linked enterprises within the group are also taken into account when determining its size, as explained in the question does NIS2 apply to us?.
Even if you fall outside the Slovak Act, Slovak customers that are operators of essential services must enter into a contract with you to ensure compliance with security measures and notification obligations where your activities directly relate to the security of their networks and information systems (Section 19(2) of Act No. 69/2018 Z. z.). Exceptions apply where such activities pose a low risk or where the supplier is itself entered in the Slovak register of operators of essential services (Section 19(3) and Section 3(2)). The article on NIS2 in supplier contracts explains what such a contract should contain.
We will assess which state’s jurisdiction applies to your company and its services. If Slovak law applies to you, we will prepare your registration with NBÚ and help put compliance arrangements in place as part of our NIS2 and cybersecurity service.
This answer provides general information on the law as at 3 October 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.
