Section 34b of Act 69/2018 Coll. is headed “transitional provisions to the amendments effective from 1 January 2025”. It gave existing entities two years to carry on under the earlier rules. Those two years end on 31 December 2026 — from mid-October 2026 that is under three months.
What exactly ends on 31 December 2026
Section 34b names that date in paragraphs 2, 4, 5 and 7. Paragraph 8 does not mention it and is tied to audits falling in 2025 and 2026 instead. All of them sit in the version of the act in force since 30 April 2026:
- An operator of an essential service under paragraph 1 may until then adopt and implement security measures under the rules in force until 31 December 2024 (paragraph 5).
- The same group may until then run the cybersecurity audit under those earlier rules (paragraph 7).
- For category I and II networks and information systems, an audit obligation falling in 2025 and 2026 can be met by self-assessment in the unified cybersecurity information system (paragraph 8). It does not cover an audit falling in 2027.
- The NBÚ may until then decide, on its own initiative, that an entity is not an operator of a critical essential service, or of an essential service, because it fails the conditions in section 18(1) or 17(1) (paragraphs 2 and 4).
A status change that happened automatically
The most overlooked part of section 34b is its opening. Anyone who was an operator of an essential service under the wording in force until 31 December 2024 is treated, from 1 January 2025, as an operator of a critical essential service. A digital service provider under that wording becomes an operator of an essential service.
No decision was issued and nobody applied for it. The difference is not cosmetic. For the same breaches the act sets fines of 300 to 7,000,000 euros or 1.4 % of worldwide annual turnover for the previous accounting period for an operator of an essential service (section 31(2)), and 500 to 10,000,000 euros or 2 % of that turnover for a critical one (section 31(3)). The higher amount applies.
So it is worth knowing whether the authority ruled in your case under paragraph 2. After 31 December 2026 the provision no longer offers that option.
Self-assessment under two different regimes
Self-assessment appears twice in the act and the conditions differ. The permanent regime in section 29(8) is open only to an operator of an essential service that is not a critical one, and an audit still falls due within five years of entry in the register. The transitional regime in section 34b(8) carries no such limit — it is tied to categories I and II and to audits falling in 2025 and 2026.
The cybersecurity manager carries out the self-assessment and the result goes to the authority without delay. If an audit for 2025 or 2026 is still outstanding, that is a question for your auditor or the authority now, not January.
What to settle before the year ends
- Check the register entry — whether you are listed as a critical essential service operator and whether the recorded scope matches reality.
- Compare the security documentation against decree 227/2025 Coll., which replaced decree 362/2018 Coll. on 1 September 2025.
- Fix the audit start date in writing if it straddles the year end.
- Confirm the cybersecurity manager role is filled. Without it there is nobody to run a self-assessment.
- Finish the asset register. The risk analysis behind the section 20 measures rests on it.
The deadline for adopting measures is 12 months from entry in the register (section 19(1)). For entities registered before 2025 it expired long ago; section 34b(5) only let them meet it with the old rules. From January 2027 that option is gone.