Legal News for Businesses in the Czech Republic: August 2026

Undeclared Chatbots: Fines of up to €15 Million from August 2

On August 2, 2026, Article 50 of Regulation (EU) 2024/1689 (the AI Act) became applicable. The first step is not to purchase technology, but to determine your own role: the obligations under paragraphs 1 and 2 apply to the provider of the system, while paragraphs 3 and 4 apply to the deployer, i.e., the company using the system. Those who use their own system fulfill both roles — a point explicitly highlighted by the Czech Telecommunication Office in its press release of July 31, 2026.

In practice, this means four things. A system intended for direct interaction with people must be designed so that the person is aware they are interacting with an AI. The provider of a generative system must ensure machine-readable labelling of outputs. The deployer must label deepfakes and AI-generated text published on matters of public interest — however, for text, this obligation does not apply if the content has undergone human or editorial review and a specific person bears editorial responsibility for the publication. And anyone using emotion recognition or biometric categorisation systems must inform the affected persons.

The penalties are not symbolic: according to Art. 99(4)(g), they can be up to €15 million or 3% of global turnover, whichever is higher for a typical business. However, Art. 99(6) imposes the lower of the two values for small and medium-sized enterprises, including startups. An important detail: the Czech adaptation act for the AI Act has not yet been adopted, so supervisory authorities and procedural rules for imposing penalties are still missing in Czech law. This does not change the obligations.

High-Risk Systems Get a Postponement. Transparency Does Not.

Regulation (EU) 2026/1744 (the Digital Omnibus) of July 24 postponed the obligations for high-risk systems — standalone systems under Annex III, typically AI in recruitment or scoring, to December 2, 2027, and for systems embedded in regulated products to August 2, 2028. For transparency, there is only one transitional period: machine-readable labelling for outputs of systems placed on the market before August 2, 2026, must be added by December 2, 2026.

But there is no time to wait. Most prohibitions on unacceptable practices will apply from February 2, 2025, and from the same day, Article 4 will also apply, which imposes the adoption of measures to promote AI literacy for persons working with AI systems — regardless of the company's size. A practical way to meet this obligation is through team training and internal rules for using AI.

Food Packaging with PFAS Is Now Banned from the Market

Regulation (EU) 2025/40 (PPWR) applies directly from August 12, 2026, without transposition. Article 5 has the most severe immediate impact: packaging intended for direct contact with food must not contain PFAS above the specified threshold values. In addition, rules for conformity assessment, technical documentation, the EU declaration of conformity, and rules for environmental claims under Article 14 will apply. Most technical requirements for recyclability and recycled content will be phased in gradually, mainly from 2030.

The scope of obligations varies depending on whether the company acts as a manufacturer, importer, distributor, or producer for the purposes of extended producer responsibility — these are legally distinct roles. Moreover, the PPWR further harmonises extended producer responsibility but does not create it anew: it has long existed in the Czech Republic, and registration and record-keeping under Act No. 477/2001 Coll., on Packaging, and Act No. 541/2020 Coll., on Waste, continue to apply. The first step is not to change packaging, but to conduct an inventory: what packaging the company uses, what it is made of, in what role it places it on the market, and whether it has supporting documents from suppliers to prove it.

Critical Infrastructure: You Can No Longer Postpone Your Self-Assessment

Act No. 266/2025 Coll., on the Resilience of Critical Infrastructure Entities, effective from August 19, 2025, transposed the CER Directive and separated this agenda from the Crisis Act. However, implementing regulations were missing, and without them, it was impossible to reliably determine who falls under the regime. Government Regulation No. 127/2026 Coll., effective from July 18, 2026, defines essential services and significance criteria, and Decree No. 122/2026 Coll., effective from August 1, 2026, sets out the structure of the resilience plan, the risk assessment methodology, measures to ensure resilience, and rules for incident reporting. On the same day, the Critical Infrastructure Portal was launched for fulfilling information obligations, including the reporting obligation under Section 9 of the Act.

One distinction is crucial for management: this is not NIS2. The criteria, mandatory roles, and supervisory authorities differ, and a company can fall under both regimes simultaneously. Therefore, it makes sense to conduct a self-assessment even where the cybersecurity agenda is considered resolved.

An Advertising Invoice Won't Save Your VAT Deduction

In its judgment of August 4, 2026, file no. 10 Afs 204/2025-51, the Supreme Administrative Court (NSS) dismissed a company's cassation complaint after the tax administrator had disallowed a VAT deduction for advertising services. The company provided documents, purchase orders, and handover protocols, and proved that it had received the service — but failed to prove its extent. Under Sections 72 and 73 of the VAT Act, this is a separate substantive condition for the deduction. The court turned the argument that the content of the services changed continuously according to seasonal developments against the complainant: the less predictable the cooperation, the more meticulous the records the parties should have kept.

The judgment has a second useful conclusion. The conducting of seven control procedures by five different tax administrators concerning the same suppliers was deemed by the court to be a disproportionate exercise of so-called "selected competence." Although in this case it did not affect the legality of the decision, it gives an argument to companies under parallel audits. The primary defence remains an action against unlawful interference, not an action against the tax assessment decision itself.

Wage Confidentiality Clauses Can Cost You Up to CZK 400,000

The transposition deadline for Directive (EU) 2023/970 on pay transparency expired on June 7, 2026, without action, and the amendment to the Labour Code is still in the legislative process with a proposed effective date of January 1, 2027. Therefore, no new obligations from the transposition have arisen yet — but this does not mean that Czech law is silent on the matter. Since June 1, 2025, Section 346a of the Labour Code has prohibited restricting employees from using information about the amount and structure of their own salary; a violation can be fined up to CZK 400,000 under Section 24(1)(e) of the Act on Labour Inspection. Therefore, wage confidentiality clauses should be removed from contracts today.

We also remind you of the second stage of Act No. 323/2025 Coll.: from July 1, 2026, the employee must be registered in the records no later than the moment they start work, and the employer themselves, 2 working days before the first employee starts. The fine is up to CZK 100,000.

Deadlines in August That Can't Wait

What to Do Now

August 2026 marks a shift that Czech companies are not used to: two of the three main changes this month come not from the Collection of Laws, but from the Official Journal of the EU, and apply regardless of whether the corresponding Czech legislation is missing or still being amended. There is no adaptation act for the AI Act, and the Packaging Act is only now being amended for the PPWR — yet the obligations have been in effect since August 2 and 12, respectively.

The recommendation is therefore simple and applies to both the AI Act and the PPWR: first clarify your role, then address the measures. Provider, deployer, manufacturer, importer, distributor — each role has a different set of obligations. Companies that skip this step usually end up doing either too much or the wrong thing. The August judgment from the NSS is a reminder that in tax matters, the provability of the process is what counts, not the existence of an invoice.

The law firm ARROWS combines AI and IT compliance, product and packaging regulation, security regulation, tax disputes, and labour law into a single perspective — so that the client receives not several separate opinions, but one decision with business sense. We can provide role classification under the AI Act and PPWR, self-assessment according to the Critical Infrastructure Act, review of supplier contracts, internal policies and team training, and representation during inspections. Thanks to the ARROWS International network, we also coordinate cases with a cross-border element; for professional liability purposes, the law firm ARROWS is insured with a limit of CZK 350,000,000. Write to us at consultation@arws.cz and we will go through your company's specific situation with you.