Czech Republic — ÚOOÚ + EU AI Act + Czech AI Strategy: AI Compliance Requirements
Czech Republic's Úřad pro ochranu osobních údajů (ÚOOÚ — Office for Personal Data Protection) enforces GDPR and has published AI-specific guidance on automated decision-making and profiling. The Czech Republic published its "Národní strategie umělé inteligence ČR 2019-2025" (National AI Strategy). The Ministry of Industry and Trade coordinates EU AI Act implementation. Czech Republic is fully subject to the EU AI Act and is active in the European AI Board.
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
January 1, 2021
August 2, 2026
GDPR (ÚOOÚ): up to €20M or 4% global turnover. EU AI Act: €35M or 7% global turnover.
What Your Business Must Do
3 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
EU AI Act Compliance (Mandatory)
CriticalCzech Republic is subject to the EU AI Act. Classify AI systems by risk. The Czech Office for Standards, Metrology and Testing (ÚNMZ) serves as a notified conformity body. High-risk AI in Czech banking (ČNB oversight), healthcare (SÚKL oversight), and public administration requires conformity assessment. Czech ÚOOÚ coordinates with European AI enforcement. NOTE: the EU AI Act high-risk (Annex III) conformity-assessment deadline was deferred EU-wide from 2026-08-02 to 2027-12-02 by the "Digital Omnibus" amendment, Regulation (EU) 2026/1744 (in force 2026-07-27) -- Article 50 transparency obligations still apply from 2026-08-02, but conformity assessment/technical documentation/registration for stand-alone high-risk systems is not due until 2027-12-02 (2028-08-02 for Annex I product-embedded high-risk systems).
Deadline: December 2, 2027
EU AI Act Art. 6, Annex III (high-risk classification); Art. 16 (provider obligations); Art. 43 (conformity assessment); Art. 26 (deployer obligations)ÚOOÚ AI and GDPR Guidance
High PriorityÚOOÚ requires documentation of legal basis for AI data processing, DPIA for high-risk AI profiling, and individual rights fulfilment (access, erasure, objection to automated decisions) within 30 days. ÚOOÚ has issued specific guidance on employee AI monitoring and AI-assisted recruitment.
Czech National AI Strategy 2019-2025
Lower PriorityOrganizations participating in Czech public procurement for AI systems must demonstrate compliance with the Czech National AI Strategy principles: transparency, human oversight, fairness, and data minimisation. Voluntary CZECHINNO AI audit available for market credibility.
Who Does This Apply To?
Applies to: any organisation established in the Czech Republic, and any organisation outside it processing the personal data of Czech residents through AI systems — GDPR applies with extraterritorial reach (Art. 3), obligations attaching to the processing activity rather than company size, with no general small-business exemption. As an EU member state, the Czech Republic is fully subject to the EU AI Act, with the Office for Standards, Metrology and Testing (ÚNMZ) as a notified conformity body: AI systems must be risk-classified, and high-risk AI in banking (ČNB oversight), healthcare (SÚKL oversight) and public administration requires conformity assessment. The Úřad pro ochranu osobních údajů (ÚOOÚ) requires a documented lawful basis for AI data processing, a DPIA for high-risk AI profiling, fulfilment of individual rights within 30 days, and — for AI used in hiring (CV screening, video-interview analysis, social-media checks) — valid consent or documented basis, a DPIA, candidate notice, and human review of adverse AI decisions under Article 22. Penalties reach €20M / 4% of global turnover under GDPR and €35M / 7% under the EU AI Act.
Recent Enforcement Actions
Against:
Recent Regulatory Guidance
ÚOOÚ AI Employment Guidance — GDPR Art. 22 in Recruitment
ÚOOÚ has confirmed that AI systems used in Czech hiring (CV screening, video interview analysis, social media background checks) trigger GDPR Art. 22 when they produce scores or rankings that materially influence hiring decisions. Employers must: (1) obtain valid consent or document legal basis; (2) conduct a DPIA; (3) inform candidates that AI is used; (4) offer human review of adverse AI decisions. ÚOOÚ has also been designated the fundamental-rights oversight authority for Annex III high-risk AI systems deployed in the Czech Republic.
Frequently Asked Questions
Does Czech Republic — ÚOOÚ + EU AI Act + Czech AI Strategy apply to my business?
Czech Republic's Úřad pro ochranu osobních údajů (ÚOOÚ — Office for Personal Data Protection) enforces GDPR and has published AI-specific guidance on automated decision-making and profiling. The Czech Republic published its "Národní strategie umělé… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under Czech Republic — ÚOOÚ + EU AI Act + Czech AI Strategy is: GDPR (ÚOOÚ): up to €20M or 4% global turnover. EU AI Act: €35M or 7% global turnover.. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with Czech Republic — ÚOOÚ + EU AI Act + Czech AI Strategy?
The 3 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://www.uoou.cz/en/vismo/zobraz_dok.asp?id_ktg=3Last updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan