Over the past five years a company website has picked up eleven legal duties. They arrived one at a time, each by a different route and none of them with a warning, so most companies are unaware of half of them. The most recent one took effect on 2 August 2026, a few days ago, and it applies to anybody running a chatbot or generating product descriptions.
This article is a checklist, not an analysis. For each duty you get who it applies to, who enforces it, what is at stake and how to check in a few minutes whether you meet it. It is not legal advice and does not replace a lawyer; on a disputed point an hour with one pays for itself.
Short answer
- Even a one page site run by a sole trader has four duties. An online shop has twelve.
- The one most often missing is the cheapest: company ID, registered office and register entry on the site itself. It is one line in the footer.
- Accessibility has applied to private companies since 28 June 2025, but micro enterprises are exempt for services. Check whether it applies to you at all before paying for an audit.
- Since 2 August 2026 a chatbot has to identify itself as a machine and artificially generated content has to be marked in machine readable form.
- The heaviest routinely enforced fines are not on cookies but on commercial communications, up to 10 million crowns.
- None of this is solved by buying a plugin. Most of it is five lines of text and one decision.
How to read the list
The duties fall into three layers and they must not be mixed. That is the main reason the usual articles on this subject leave nobody any wiser: they throw the rules for an online shop, a town hall and a sole trader into one bag.
- Layer A applies to anybody who is in business and has a website. Six items, two of them conditional on the size of the company.
- Layer B applies on top of that to anybody selling to consumers. Six more, and this is where the expensive mistakes are.
- Layer C applies to the public sector. Municipalities, schools, state funded organisations. A different act, a stricter standard and a mandatory statement.
Every item has a date. On this subject the date matters more than the rule itself, because half of what you will read about website obligations describes the position before 2022.
How many duties apply to which website
Identification, privacy information, cookies, commercial communications
Plus accessibility, and whistleblowing above 50 employees
Its own act, a stricter standard, a mandatory statement
The most duties and the most expensive mistakes
| Label | Value |
|---|---|
| Micro business brochure site | 4 |
| Larger company website | 6 |
| Municipality or school | 6 |
| Online shop | 12 |
Layer A: what every company website must have
1. Who stands behind the site
Applies to: every business. Since: long ago. Under Section 435 of the Czech Civil Code a business must state its name and registered office not only on business documents but also in information made available to the public by remote access. That is the legal wording for a website. Anybody entered in the commercial register also states the entry including section and file number, and anybody with a company ID states that too.
It is the most frequently missing duty of all and at the same time the cheapest to meet: it belongs in the footer and it is one line. A joint stock company must have a website by law; other forms need not, but once they have one the same rules apply.
2. Privacy information
Applies to: anybody collecting any personal data. Since: 25 May 2018. A contact form is a collection of personal data. Under Article 13 of the GDPR, at the moment somebody fills it in they must know who processes the data, why, for how long and what rights they have. You meet this with a privacy page linked next to the form, not with a consent tick box: replying to an enquiry does not require consent, and forcing one is closer to a mistake than to caution.
3. Cookies and analytics
Applies to: anybody storing more than the technical minimum. Since: 1 January 2022. An amendment to Act No. 127/2005 turned the rule into prior consent. Strictly technical cookies without which the site cannot work are exempt. Everything else, meaning third party analytics, advertising pixels and embedded video, needs consent before it is stored. The data protection authority enforces it.
Watch out for the inverse mistake: the banner is not mandatory, the consent is. A site that sends data to nobody and measures its own traffic on its own server does not need a banner at all.
4. Newsletters and commercial communications
Applies to: anybody sending promotional email. Since: 2004, but enforced now. Act No. 480/2004 allows a commercial communication to be sent either to somebody who consented or to your own customer who was given the chance to refuse. The message must be clearly marked as a commercial communication and every single message must carry a simple and free way out.
The data protection authority enforces it and the fine reaches ten million crowns. It is one of the highest ceilings on the whole list, and the one companies worry about least, because nobody sees it on the website.
5. Accessibility
Applies to: businesses providing listed services. Since: 28 June 2025. Exempt: micro enterprises. Act No. 424/2023 brought the European Accessibility Act into Czech law. It mainly covers e-commerce, banking, transport and electronic communications, not every company website. For services there is an exemption for micro enterprises, meaning fewer than ten people and annual turnover or balance sheet total up to two million euros.
Most small companies therefore have no duty here, and it is fair to say so before somebody buys a fifty thousand crown audit. That does not mean accessibility is not worth it: an inaccessible site cuts off part of your customers whatever the law says.
6. Internal whistleblowing channel
Applies to: employers with more than 50 employees and public contracting authorities. Since: 1 August 2023. Act No. 171/2023 on the protection of whistleblowers requires an internal reporting system and requires information about it to be published in a way that allows remote access. In practice that means a page on the website saying who the designated person is and how to reach them.
It is a duty that lands on the website almost by accident, so HR ticks it off in an internal policy and nobody puts it on the site. Yet the public part is the easiest of all to check.
Layer B: online shops and selling to consumers
This is where the expensive mistakes live, because they do not only mean a fine, they reach the validity of the contracts you have concluded.
| Duty | Since | What is at stake |
|---|---|---|
| An order button reading “Order with an obligation to pay” or equally unambiguous | 6 Jan 2023 | The consumer can invoke invalidity of the contract, so the consequence is commercial, not merely administrative |
| For a discount, state the lowest price in the 30 days before and calculate the discount from it | 6 Jan 2023 | A misleading commercial practice. The EU Court of Justice confirmed the discount runs from that price |
| For reviews, state how you verify they come from real customers | 6 Jan 2023 | A misleading commercial practice, checked by the Czech Trade Inspection Authority |
| Information on out of court dispute resolution including the web address | long standing | A fine up to one million crowns. The competent body is the Czech Trade Inspection Authority |
| For each product, the manufacturer and address, product identification and warnings | 13 Dec 2024 | The GPSR regulation. For imports from outside the EU a responsible person inside the EU is required |
| Pre contract information, the 14 day withdrawal notice and the model form | long standing | Without the notice the withdrawal period is extended. That hurts more than a fine |
Layer C: municipalities, schools and public bodies
In force since: 2019, though inspections came later. The public sector has its own Act No. 99/2019, which brought the European directive on the accessibility of public sector websites and mobile applications into Czech law. It must not be confused with accessibility for private companies: it is older, stricter and has no exemption for small bodies.
- The measure is WCAG 2.1, or rather the European standard EN 301 549 that refers to it.
- A mandatory accessibility statement on the website, in a prescribed structure, including what is not accessible and why.
- It covers documents too, meaning PDFs of decrees, minutes and forms. A scanned image of council minutes will not pass.
- It also covers mobile applications where the body runs any.
For a web supplier this has one practical consequence: accessibility here is not a line in the quote, it is a condition of acceptance. And because the client is a public contracting authority, it tends to be a condition of the tender as well.
New since 2 August 2026: artificial intelligence on the site
This is the freshest item on the list and most companies do not know about it yet. Article 50 of the European AI Act became applicable on 2 August 2026 and imposes transparency duties that reach an ordinary company website in two situations.
- A chatbot has to identify itself as a machine. The notice must come at the latest at the first interaction, that is before the person starts typing. The only exception is where it is obvious from the circumstances.
- Artificially generated content has to be marked in machine readable form. That covers images, audio, video and text, so generated photos in articles and generated product descriptions are included.
- For text on matters of public interest there is an additional duty to disclose it plainly. It does not apply where the content went through human editorial review and somebody bears responsibility for publishing it. That review has to be real, not a rubber stamp.
The ceilings are high: up to 15 million euros or 3 % of worldwide turnover, whichever is higher. For a small company what matters more is that compliance costs one sentence in the chat window and one field in the image metadata.
The shop footer says only “Copyright 2019”, the button says “Submit”, discounts show a struck through price with no explanation and the chatbot pretends to be Petra from customer service. A customer notices none of it. A competitor notices and files a complaint.
The footer carries the company, its registered office, company ID and register entry. The button says the order commits you to pay. The discount states which price it is calculated from. The chatbot introduces itself as an automated assistant in its first sentence and offers a human. Together, an afternoon of work.
A twenty minute check
Anybody in the company who can open a browser can do this. You need neither a supplier nor a lawyer, and the result is a list that lets you talk to both of them in specifics.
- 1Scroll to the footer of the home page and look for the company name, registered office, company ID and register entry. If any of it is missing, you have your first item, and it is the cheapest one there is.
- 2Open the site in a private window and watch what happens before you click anything. If third party analytics or an embedded video load before your consent, the consent is worthless at that point.
- 3Find the link to the privacy notice and check it sits next to the contact form, not only in the footer. And that the text describes what actually happens rather than a template pulled off the internet.
- 4Open the last newsletter you sent. Is it marked as a commercial communication and does it carry a working unsubscribe? Actually click that unsubscribe, because half the time it does not work.
- 5On a shop, walk an order right up to the final button without sending it. Read what the button says. Then look at any discount and search for the sentence about the lowest price in the last thirty days.
- 6Do you run a chatbot? Read its first message. If it is not apparent that this is a machine, you have had a problem since August 2026 that one sentence will fix.
- 7More than fifty employees? Try to find the whistleblowing information on your own site. If you cannot find it, neither can a whistleblower, which is exactly what that act is about.
| When | What started to apply | Who it applies to |
|---|---|---|
| 1 Jan 2022 | Cookies only with prior consent | Any site storing more than the technical minimum |
| 6 Jan 2023 | Payment button, discount rules, review verification | Online shops and selling to consumers |
| 1 Aug 2023 | Internal whistleblowing channel and publishing it | Employers above 50 employees |
| 13 Dec 2024 | Manufacturer and safety details in the product listing | Shops selling physical goods |
| 28 Jun 2025 | Accessibility for the private sector | Listed services, micro enterprises exempt |
| 2 Aug 2026 | Artificial intelligence transparency | Chatbots and generated content |
How we handle it
This is the one subject on the whole blog where a supplier does not have to praise itself, because it can simply be shown.
- This website has no cookie banner and that is a decision rather than an oversight: it sends data to no third party and measures its own traffic on its own server, so there is no consent to collect.
- Accessibility to WCAG 2.2 AA is a launch condition for us, not a paid extra. Contrast is calculated rather than guessed and keyboard operation is tested on every new screen.
- The mandatory details are part of delivery. Footer, privacy notice, the information beside the form, and on a shop the button and the discount wording too. It is not a list you receive to fill in, it is done.
- For the public sector we build in the accessibility statement and the fact that downloadable documents fall within the standard as well.
And the honest other side: we are not a law firm. We can build the site so the duties can be met and we know where things go wrong. The wording of a privacy notice or terms and conditions, and the judgment of whether you are a micro enterprise, belong with a lawyer. Anybody promising a website and legal certainty in one package is overselling.
Frequently asked questions
What details must a company website carry by law in the Czech Republic?
The name, the registered office and, where one has been assigned, the company ID. Anybody entered in the commercial register also states that entry including section and file number. It follows from Section 435 of the Civil Code, which covers business documents and information made available to the public by remote access, meaning the website. It belongs in the footer and it is one line.
Does every website need a cookie banner?
No. What is mandatory is consent before storing anything beyond the technical minimum, not a banner. A site that sends no data to third parties and measures its own traffic on its own server does not need to collect consent, so it needs no banner. The banner is only a way of obtaining consent where the site needs it.
Does accessibility apply to a small company?
Usually not. Act No. 424/2023, in force since 28 June 2025, targets listed services, mainly e-commerce, banking, transport and electronic communications, and for services it exempts micro enterprises, meaning fewer than ten people with turnover or balance sheet total up to two million euros. The public sector has its own Act No. 99/2019 and that one has no exemption for small bodies.
What changed for websites on 2 August 2026?
The transparency duties in Article 50 of the European AI Act became applicable. A chatbot must be recognisable as a machine at the latest at the first interaction and artificially generated content must be marked in machine readable form. For text on matters of public interest there is a further duty to disclose it plainly, unless the content went through genuine human editorial review.
How must an order button be labelled?
With the words “Order with an obligation to pay” or an equally unambiguous formulation, under Section 1826a of the Civil Code. Wording such as “Submit” or “Complete order” does not qualify. It matters because a breach lets the consumer invoke invalidity of the contract, so the consequence goes beyond an administrative fine.
What has to be shown with a discount?
The lowest price at which the goods were sold in the thirty days before the discount, and the discount is calculated from that price. It follows from Section 12a of the Consumer Protection Act and the EU Court of Justice confirmed it in case C-330/23. The figure has to be prominent, not a footnote in small print.
Who enforces all this?
It is split between authorities. Personal data, cookies and commercial communications sit with the data protection authority, consumer rules and private sector accessibility with the Czech Trade Inspection Authority, public sector accessibility with the state through the interior ministry. In practice enforcement usually starts with a complaint from a customer or a competitor rather than a sweep.
Can I solve it by buying a plugin or a terms generator?
Partly, and it is the most common source of false comfort. A generator produces the text of a privacy notice but changes nothing about what the site actually does: if the analytics script fires before consent, no wording fixes that. Most items on this list are a matter of how the site is set up, not of a document on the site.
Summary
- Four duties apply even to a one page brochure site, twelve to an online shop, and the public sector has its own act.
- The item most often missing is the company identification in the footer, which is also the cheapest on the list.
- A cookie banner is not mandatory, consent is. A site without third party scripts needs neither.
- Private sector accessibility exempts micro enterprises. Check that before paying for an audit.
- The highest routinely enforced ceiling is not on cookies but on commercial communications, meaning your newsletter.
- Since 2 August 2026 a chatbot must identify itself as a machine and generated content must carry machine readable marking.
- Most items are a matter of how the site is set up, not of a document on the site. A terms generator will not fix them.
Want to know what you are missing
Send us the address of the site and one sentence about what the company does and who it sells to. We will walk the twelve points and send back what is missing, ordered by what is cheapest to fix. No invoice, and no need for us to build you a new site to do it.
Sources
Checked in August 2026. Statutes are cited as in force; for new rules the date of application is given.
- Act No. 89/2012 Coll., the Czech Civil Code, Sections 435 and 1826a
- Act No. 127/2005 Coll., on electronic communications, Section 89(3), as in force from 1 January 2022
- Act No. 480/2004 Coll., on certain information society services, Section 7, with the guidance of the Czech data protection authority
- Act No. 634/1992 Coll., on consumer protection, Sections 12a and 14, with the ministry of industry guidance on discounts and judgment C-330/23 of the Court of Justice of the EU
- Act No. 424/2023 Coll. on accessibility requirements, in force from 28 June 2025 (European Accessibility Act, Directive (EU) 2019/882)
- Act No. 99/2019 Coll. on the accessibility of websites and mobile applications (Directive (EU) 2016/2102), WCAG 2.1 and EN 301 549
- Act No. 171/2023 Coll. on the protection of whistleblowers
- Regulation (EU) 2023/988 on general product safety, applicable from 13 December 2024
- Regulation (EU) 2024/1689, the AI Act, Article 50, applicable from 2 August 2026, with the European Commission explanation of the transparency obligations
- Regulation (EU) 2016/679 (GDPR), Article 13
- Digital Omnibus: European Commission proposal of November 2025, not adopted at the time of writing
This article is a checklist, not a legal opinion. It describes what to check and does not replace an assessment of your own case. On a disputed question, above all whether you are a micro enterprise and whether your service falls under the accessibility act, an hour with a technology lawyer pays for itself before anything gets rebuilt.