Legislative Monitoring – Czech Republic: August 2026

Chatbot Without a Warning: Fines of up to 15 Million Euros from 2 August

On 2 August 2026, Article 50 of Regulation (EU) 2024/1689 (the AI Act) became applicable. The first step is not to purchase technology, but to determine your own role: the obligations under paragraphs 1 and 2 apply to the provider of the system, while those under paragraphs 3 and 4 apply to the deployer, i.e., the company using the system. A company using its own system fulfils both roles — a point explicitly highlighted by the Czech Telecommunication Office in its press release of 31 July 2026.

In practice, this involves four things. A system intended for direct interaction with people must be designed so that the person knows they are interacting with AI. The provider of a generative system must ensure that outputs are labelled in a machine-readable format. The deployer must label deepfakes and AI-generated text published on matters of public interest — however, for text, this obligation does not apply if the content has undergone human or editorial review and a specific person bears editorial responsibility for its publication. And anyone using emotion recognition or biometric categorisation systems must inform the affected persons.

The sanctions are not symbolic: according to Art. 99(4)(g), they can be up to EUR 15 million or 3% of the total worldwide annual turnover, whichever is higher for a standard enterprise. However, for small and medium-sized enterprises, including startups, Art. 99(6) imposes the lower of the two values. An important detail: the Czech adaptation act for the AI Act has not yet been adopted, so the supervisory authorities and procedural rules for imposing sanctions are currently missing from Czech law. This does not change the obligations.

High-Risk Systems Get a Postponement. Transparency Does Not.

Regulation (EU) 2026/1744 (the Digital Omnibus) of 24 July postponed the obligations for high-risk systems — standalone systems under Annex III, typically AI in recruitment or scoring, to 2 December 2027, and systems embedded in regulated products to 2 August 2028. For transparency, there is only one transitional period: machine-readable labelling of outputs for systems placed on the market before 2 August 2026 must be added by 2 December 2026.

But there is no time to wait. Most prohibitions of unacceptable practices will apply from 2 February 2025, and from the same date, Art. 4 will also apply, which requires measures to be taken to promote the AI literacy of persons working with AI systems — regardless of the size of the company. A practical way to fulfil this obligation is through team training and internal rules for the use of AI.

Food Packaging with PFAS No Longer Belongs on the Market

Regulation (EU) 2025/40 (PPWR) applies directly from 12 August 2026, without transposition. The harshest immediate impact comes from Art. 5: packaging intended for direct contact with food must not contain PFAS above the specified threshold values. In addition, rules for conformity assessment, technical documentation, the EU declaration of conformity, and rules for environmental claims under Art. 14 will apply. Most technical requirements for recyclability and recycled content will be phased in gradually, mainly from 2030.

The scope of obligations differs depending on whether the company acts as a manufacturer, importer, distributor, or producer for the purposes of extended producer responsibility — these are legally distinct roles. Moreover, the PPWR further harmonises extended producer responsibility but does not create it anew: it has long existed in the Czech Republic, and the evidence and registration requirements under Act No. 477/2001 Coll., on Packaging, and Act No. 541/2020 Coll., on Waste, continue to apply. The first step is not to change the packaging, but to conduct an inventory — what packaging the company uses, what it is made of, in what role it is placed on the market, and whether it has the necessary documentation from suppliers to prove it.

Critical Infrastructure: You Can No Longer Postpone Your Self-Assessment

Act No. 266/2025 Coll., on the Resilience of Critical Infrastructure Entities, effective from 19 August 2025, transposed the CER Directive and separated this agenda from the Crisis Act. However, the implementing regulations were missing — and without them, it was impossible to reliably determine who falls under the regime. Government Regulation No. 127/2026 Coll., effective from 18 July 2026, defines essential services and significance criteria, and Decree No. 122/2026 Coll., effective from 1 August 2026, sets out the structure of the resilience plan, the risk assessment methodology, resilience measures, and rules for incident reporting. On the same date, the Critical Infrastructure Portal was launched for fulfilling information obligations, including the reporting obligation under Section 9 of the Act.

One distinction is crucial for management: this is not NIS2. The criteria, mandatory roles, and supervisory authorities are different, and a company may fall under both regimes simultaneously. Therefore, it makes sense to carry out a self-assessment even where the cybersecurity agenda is considered resolved.

An Advertising Invoice Won't Save Your VAT Deduction

In its judgment of 4 August 2026, ref. no. 10 Afs 204/2025-51, the Supreme Administrative Court (NSS) dismissed the cassation complaint of a company whose VAT deduction for advertising services was disallowed by the tax administrator. The company provided documents, orders, and handover protocols and proved that it had received the service — but it failed to prove its scope. According to Sections 72 and 73 of the VAT Act, this is a separate substantive condition for the deduction. The court turned the argument that the content of the services changed continuously according to the season's development against the complainant: the less predictable the cooperation, the more meticulous the records the parties should have kept.

The judgment also has a second useful conclusion. The court described the conduct of seven control procedures by five different tax administrators concerning the same suppliers as a disproportionate exercise of so-called selected competence. While this did not affect the legality of the decision in this case, it gives an argument to companies under parallel audits. The primary defence remains an action against unlawful interference, not an action against the tax assessment decision itself.

A Salary Confidentiality Clause Can Cost You Up to CZK 400,000

The transposition deadline for Directive (EU) 2023/970 on pay transparency expired on 7 June 2026 without action, and the amendment to the Labour Code is still in the legislative process with a proposed effective date of 1 January 2027. Therefore, no new obligations from the transposition have arisen yet — but this does not mean that Czech law is silent on this matter. Since 1 June 2025, Section 346a of the Labour Code has prohibited restricting employees from using information about the amount and structure of their own salary; a violation can result in a fine of up to CZK 400,000 under Section 24(1)(e) of the Act on Labour Inspection. Therefore, salary confidentiality clauses should be removed from contracts today.

We also remind you of the second stage of Act No. 323/2025 Coll.: from 1 July 2026, an employee must be registered in the records no later than the moment they start work, and the employer must register themselves 2 working days before the first employee starts. The fine is up to CZK 100,000.

Deadlines in August That Can't Wait

What to Do Now

August 2026 shows a shift that Czech companies are not used to: two of the three main changes of the month come not from the Collection of Laws, but from the Official Journal of the EU, and they apply regardless of the fact that the follow-up Czech regulation is missing or is still being amended. There is no adaptation act for the AI Act, and the Packaging Act is only just being amended for the PPWR — yet the obligations have been in effect since 2 and 12 August, respectively.

Therefore, there is only one recommendation, and it applies to both the AI Act and the PPWR: first, clarify your role, and only then address the measures. Provider, deployer, manufacturer, importer, distributor — each role has a different scope of obligations. Companies that skip this step usually end up dealing with either too much or the wrong thing. The August judgment of the Supreme Administrative Court is then a reminder that in taxes, it is the provability of the process, not the existence of an invoice, that is decisive.

The law firm ARROWS combines AI and IT compliance, product and packaging regulation, security regulation, tax disputes, and labour law into a single perspective — so that the client receives not several separate opinions, but a single, commercially sensible decision. We will ensure the classification of roles under the AI Act and the PPWR, self-assessment under the Act on Critical Infrastructure, review of supplier contracts, internal policies and team training, and representation during inspections. Thanks to the ARROWS International network, we also coordinate cases with a cross-border element; for professional liability purposes, the law firm ARROWS is insured up to a limit of CZK 350,000,000. Write to us at consultation@arws.cz and we will go through your company's specific situation with you.