Critical Infrastructure, Resilience and New Obligations Across the Supply Chain

Critical Infrastructure, Resilience and New Obligations Across the Supply Chain

Critically Connected | Are You Sure This Does Not Affect You Too? 

Seminar with EY | 5 October 2026 | The Dome, AHK Czech Republic, Prague | Language: English | Afternoon, in person

What it's about

Are you sure this does not affect you too? For most companies, that is exactly where the issue begins. In 2025/2026, the Czech Republic fundamentally overhauled its regulation of critical infrastructure through two parallel regimes: the new Cybersecurity Act (ZoKB, Act No. 264/2025 Coll., implementing NIS2) and the Critical Infrastructure Resilience Act (ZoKI, Act No. 266/2025 Coll., implementing CER). Germany is regulating in parallel. The deadlines are already running, penalties may amount to as much as CZK 250 million or EUR 10 million, and responsibility rests explicitly with company management — not with IT.

Two groups are affected at the same time: directly regulated operators and critical entities — and suppliers who are not regulated themselves, but whose customers pass the requirements down through the supply chain. That is exactly where the title comes from: if you are critically connected, you are affected — even without operating critical infrastructure yourself. There is no official notification "from above"; every company must assess for itself whether it is affected. Together with EY, AHK Czech Republic brings companies up to speed in a single afternoon. The key message: being affected does not end at the power plant — it runs through the entire value chain. The format is deliberately compact: clear language and orientation for management, rather than a detailed compliance training.

Why attend this seminar
 

• Two regulatory regimes at once: the Czech Republic (ZoKB, Act No. 264/2025 Coll., and ZoKI, Act No. 266/2025 Coll.) and Germany (NIS2UmsuCG, in force since 6 December 2025) — cross-border companies are affected from both sides
• You have to identify yourself: there is no official notification "from above"; companies that do not check often do not realise they are already within scope — while the deadlines continue to run
• The scope is far wider than before: the obligations reach deep into the mid-market — as a rule of thumb, a regulated sector plus roughly 50 employees or more than EUR 10 million in turnover
• The supply chain is drawn in too: the new concepts of "critical supplier" and "critical employee" mean that, through customer requirements, companies below the thresholds are also captured
• A matter for management, with personal liability: measures must be approved and overseen by company management — "IT will handle it" will not hold up with the regulator

Agenda (afternoon)

Programme subject to change.

Target group

The seminar is intended for companies such as critical infrastructure operators, industrial and energy businesses, suppliers in the automotive and mechanical engineering sectors, as well as IT, security and compliance leaders and company management.

Registration & fee

Places are limited, so we recommend registering early.

Standard registration fee: CZK 2,500 per person

• AHK Czech Republic members: 40% discount (CZK 1,500)
• Second participant from the same company: 50% discount
• Discounts can be combined — the second participant from an AHK member company therefore pays CZK 750.

All prices are exclusive of VAT. The seminar will be held in English.