← Back to homepage
Knowledge Center

Answers to the questions our clients ask most often.

Last updated 08/2026
Area
Business Updated 05/2026

What is corporate due diligence and how long does it typically take?

Quick answer

Due diligence is a structured investigation of a target company before acquisition — legal, financial, tax, and potentially technical. For mid-sized Czech companies, legal DD typically takes 3–6 weeks and produces a report that informs pricing and SPA terms.

Due diligence (DD) is at the heart of every acquisition. The buyer needs to know what they are actually buying: not just what the seller's presentation says. Legal DD typically covers the following areas:

  • Corporate: ownership structure, commercial register entries, articles of association, governing body resolutions, capital changes, share transfers
  • Contracts: key customers, suppliers, partnership and distribution agreements, change of control clauses
  • Real estate: ownership rights, leases, pledges, easements, building and use permits
  • IP and IT: trademarks, patents, software licenses, open source compliance, data
  • Employees: employment contracts of key people, bonus plans, ESOP, severance, collective agreements
  • Regulation: licenses, permits, GDPR, sector regulation (AML, financial services, healthcare)
  • Disputes and liabilities: ongoing disputes, fines, tax audits, potential claims

The output is a DD report, which describes risks at three levels: red flags (dealbreakers), yellow flags (resolvable but with an impact on price or structure), and green zones (standard, no further action needed). DD findings are then reflected in the SPA, typically in representations and warranties, indemnities (compensation for specific known issues), price adjustments, or conditions precedent (what must be satisfied before closing).

For smaller deals (up to about CZK 50 million in transaction value), DD is now compressed using AI tools: parallel analysis of hundreds of contracts, clause extraction, identifying deviations from standard. The time gained goes into the depth of analysis, not into another engagement.

Business Updated 05/2026

Locked-box vs. completion accounts — which pricing mechanism to choose?

Quick answer

Locked-box fixes the price at a historical date and the buyer takes over the company from that day onward: faster and simpler, but requires reliable financials. Completion accounts adjust the price after closing based on actual numbers — fairer, but longer and more conflict-prone. The choice depends on deal size, quality of data, and timeline.

Locked-box is now the more common choice in Europe and increasingly in the Czech Republic. The mechanism works as follows: the price is fixed at a specific historical date (typically the last audited year-end or half-year), and from this locked-box date the buyer economically holds the company, taking gains and losses, even though formal closing happens weeks or months later.

The buyer's protection is the leakage clause: the seller undertakes that nothing left the company outside the ordinary course between the locked-box date and closing (dividends, bonuses, payments to related parties, etc.). Permitted leakage typically includes ordinary salaries, contractual compensation under documents disclosed in DD, and specifically listed items.

Completion accounts by contrast, calculate the price live: a completion balance sheet is drawn up at closing date and the purchase price is adjusted accordingly. Typical line items are net debt, working capital, and cash. This mechanism is theoretically fairer, but in practice opens another round of negotiation over numbers po closing, when money is already flowing, and disputes over completion accounts are one of the most common post-closing friction points.

Simplified decision rule: locked-box for smaller and mid-sized deals with clean audited financials and a tight timeline; completion accounts for large complex transactions where the balance sheet swings significantly over time (seasonal business, project companies) or where there's not full trust in historical numbers between the parties.

Business Updated 05/2026

What's the difference between a contractual penalty and late payment interest?

Quick answer

A contractual penalty is a sanction agreed in a contract for breach of any obligation — the amount is a matter of agreement, but a court can moderate it. Late payment interest is compensation for an unpaid monetary obligation; its rate is either set by the contract or is statutory (CNB repo + 8%). They only run alongside each other if explicitly agreed.

A contractual penalty (§§ 2048–2052 of the Czech Civil Code) is a legal tool by which the parties pre-agree a fixed sanction for breach of a specific obligation. It can cover breach of any obligation — monetary or non-monetary, primary or ancillary. Its strength lies in two things: 1) the creditor doesn't have to prove that damage was caused or its amount, mere breach is enough; 2) the penalty amount can be significantly higher than actual damages, so it also has a preventive effect.

Limits: a contractual penalty must be agreed in writing (under § 2051 and case law), and the court has moderating power — if the penalty is disproportionate, the court will reduce it (but not below the actual damage incurred).

Late payment interest (§ 1970 of the Civil Code), by contrast, is a statutory creditor's claim that arises by the mere fact of default on a monetary obligation. The rate may be modified by contract (typically agreed in B2B), while statutory limits apply to consumers. The statutory late-interest rate is set by government regulation and tracks the CNB repo rate in effect on the first day of the half-year, plus 8 percentage points.

Combining both instruments is often a source of misunderstanding. The general rule: if the parties agree on a contractual penalty for default in a monetary obligation, this penalty this penalty also covers late-payment interest also covers the late-payment interest, unless the contract expressly provides that both apply. For non-monetary obligations (e.g. contractual penalty for late delivery of work) this conflict doesn't arise: the penalty can run alongside late-payment interest on other monetary obligations.

Practical recommendation: in B2B contracts always explicitly formulate the relationship between penalty and late-payment interest. Otherwise, in a dispute, the contract text must be interpreted against case law, which adds uncertainty.

Business Updated 05/2026

When does a company need terms and conditions, and what must they include?

Quick answer

Terms and conditions (T&Cs) make sense wherever a company repeatedly enters into similar contracts — typically e-commerce, SaaS, and B2B services. They must be available to the other party before the contract is concluded, otherwise they are not part of the contract. Key provisions: identification of parties, subject matter, price and payment, liability, dispute resolution, termination.

Terms and conditions (T&Cs) are the basic tool by which a company standardizes the contractual relationship with each customer. Instead of negotiating the full text of a contract with everyone, the company refers to the T&Cs in the contract or order, making them part of the contractual relationship. The Czech Civil Code (§ 1751) expressly enables this mechanism on the condition that the other party had an opportunity to review the T&Cs and agreed to them.

The key difference is between T&Cs for B2B (between businesses) and B2C (toward consumers). B2C is subject to strong consumer protection — certain provisions are void by law (prohibited clauses under §§ 1813 and 1814 of the Civil Code), information duties are extensive (§§ 1811 and 1820), and consumers have a 14-day right to withdraw from distance contracts. In B2B, contractual freedom is much broader and the parties can configure most matters.

T&Cs should at a minimum contain:

  • clear identification of the provider (name, ID number, registered office, contact)
  • definition of the service or goods and the ordering process
  • price and payment terms (due date, late interest, contractual penalty)
  • moment of contract formation and its termination
  • liability for defects, complaint deadlines
  • limitations of liability (cap, exclusion clauses) — broad freedom in B2B, limits in B2C
  • dispute resolution (governing law, court, arbitration clause where applicable)
  • handling of personal data (link to GDPR notice)

Practical pitfalls:

  • Availability: The T&Cs must be available to the other party BEFORE the contract is concluded. A footer link the client may not find is not enough. The standard e-commerce solution is a checkbox "I acknowledge the T&Cs" + a link to a PDF/page.
  • Changes to T&Cs: if the provider wants to unilaterally change the T&Cs, it must be explicitly agreed and the change must not be unreasonable (§ 1752 of the Civil Code). A silent change of T&Cs with a "current version on the website" reference is in practice often invalid.
  • Conflict with an individual contract: if there is a conflict between the T&Cs and an individually negotiated contract, the individual contract prevails.
  • Soulad s GDPR a ePrivacy: a personal data section in the T&Cs alone is not enough — it must comply with the information duty under Article 13 GDPR. Typically this is handled by a separate document (Privacy Policy) referenced from the T&Cs.

In B2B it pays to consider the provider's T&Cs taking precedence over the customer's T&Cs (the so-called battle of the forms). The Czech Civil Code addresses this in § 1740: if the parties did not clarify, what applies is what they expressly agreed plus the other terms that don't conflict with each other. For the provider to be sure their T&Cs prevail, this must be explicitly enforced in the contract or order.

Business Updated 05/2026

Loan agreements for business — what to address in a contract with a bank or investor?

Quick answer

Key areas of a loan agreement: loan purpose and drawdown conditions, interest and fees, repayment schedule, financial covenants (leverage ratios, EBITDA), security (pledges, guarantees), events of default with acceleration rights. Syndicated loans add an intercreditor agreement. Always review covenants before signing — if you breach them, the bank can call the entire loan immediately.

A loan agreement (facility agreement) is now a standard transactional document for most mid-sized companies — for operating finance, acquisition loans, refinancing, or growth investment. The price of the loan isn't just the interest — the agreement contains dozens of provisions that on breach can trigger acceleration (the bank's right to demand immediate repayment of the entire loan), margin step-up, or mandatory prepayment.

Loan purpose and drawdown. Banks typically tie the loan to a specific purpose (working capital, acquisition of company X, refinancing a loan with another bank). Use outside the agreed purpose is a breach. Drawdowns are split into tranches subject to conditions precedent — typically delivery of documents, meeting financial ratios, and signing security.

Financial covenants are the heart of the loan agreement. The bank sets ratios the company must meet for the entire term, typically:

  • Net debt / EBITDA: maximum leverage relative to generated profit
  • Interest coverage ratio (EBITDA / interest expense): debt service capacity
  • Equity ratio (equity / assets): minimum capitalization
  • Loan to value (loan / security value): for loans secured by real estate

Covenants are measured in reporting periods (typically quarterly), and a breach triggers an event of default unless the bank grants a waiver (typically for a fee or step-up margin).

Security. The bank typically requires a security package: real estate pledges, share pledges, receivable pledges, security assignment of key customer contracts, shareholder or parent company corporate guarantees, bank account security. For acquisition loans, target share pledges are standard.

Events of default define when the bank can accelerate the loan. Classic examples: missed payment, covenant breach, insolvency declaration, sale of significant assets, change of control, the so-called material adverse change (MAC) clause. The agreement typically contains deadlines pro remedy (grace period) for breaches that can be cured, but not for all of them.

For syndicated loans (multiple banks financing one transaction), an intercreditor agreement is also required, addressing the hierarchy of creditor satisfaction and voting mechanisms. For mezzanine structures, a subordination agreement between senior and junior creditors is important.

Real Estate Updated 05/2026

How does attorney escrow work when buying real estate, and when is it needed?

Quick answer

Attorney escrow holds the purchase price in a separate attorney's account until the buyer is registered in the land registry. Without escrow, you'd pay before you're certain that title actually transfers — for any transaction over several hundred thousand CZK we recommend it without exception.

The escrow mechanism works as follows: the buyer deposits the entire purchase price into the attorney's escrow account, typically at the moment the purchase agreement is signed. The money stays in the account out of either party's reach. The attorney is bound by an escrow agreement that precisely defines in advance under what conditions the money will be released and to whom.

In the typical scenario, a filing for registration with the land registry is made, and once the land registry office records the buyer's ownership, the attorney releases the money to the seller. If the registration fails for any reason (e.g. the land registry rejects the filing), the money is returned to the buyer — the buyer is never in the position of having paid without yet being the owner.

Alternatives are bank escrow or notary escrow. Attorney escrow is generally more flexible, faster to set up, and cheaper than bank escrow, and the attorney is usually also the drafter of the purchase agreement, so they have better oversight of the whole process. Attorney escrows are also insured, and the attorney is subject to oversight by the Czech Bar Association.

We don't skip escrow even for transfers between „friends" or within a family — the risks (enforcement, pledge, seller insolvency between signing and registration, a simple land-registry error) are the same regardless of the relationship between the parties.

Real Estate Updated 05/2026

What should a good real estate purchase agreement contain in the Czech Republic?

Quick answer

A good purchase agreement precisely identifies the property by land registry data, clearly handles the purchase price through escrow, addresses easements, pledges and leases, includes a handover protocol, seller's representations, and sanctions for breach. An internet template typically addresses none of these properly.

For real estate over a few million CZK, the purchase agreement is usually the most expensive document the buyer signs for a long time — and yet it's where people most often try to save in the wrong place. A good agreement covers at least the following seven areas:

1. Property identification: parcel, land registry title (LV), cadastral district, precise description of the unit including share in common parts of the building and land. For land also size and land type.

2. Purchase price and payment: price amount, allocation between property, fixtures and other components (important for tax), payment mechanism via attorney escrow, conditions for release of funds.

3. Legal stav: seller's representations that the property has no defects, no third-party rights (easements, pledges, enforcement, pre-emption rights), no leases the buyer would inherit (unless they want them).

4. Physical condition and handover: handover date, handover protocol, utility meter readings, transfer of supplier contracts, optionally vacancy-related sanctions.

5. Land registry process: land registry filing, powers of attorney, deadlines, party cooperation, what happens if the land registry rejects or suspends the filing.

6. Liability for defects: what constitutes a defect, deadlines for claims, buyer's remedies (discount, repair, withdrawal).

7. Sanctions and dispute resolution: contractual penalties for specific breaches, late-payment interest, choice of court/arbitration.

For developer projects, commercial real estate, or SPV transactions, requirements are further complicated: there you typically add representations and warranties, indemnities, a disclosure letter, and conditions precedent.

Real Estate Updated 05/2026

Real estate due diligence — why do it even for „small" transactions?

Quick answer

Real estate DD means checking the land registry (LV, lists B/C/D), zoning status, easements and pledges, plus verifying the seller (insolvency, enforcement). For an apartment worth CZK 8 million, DD typically costs CZK 10,000–30,000 and pays for itself with the first issue found — an undisclosed enforcement, an unrecorded structure, or a missing condominium consent.

The myth that due diligence (DD) is only for big developer projects and commercial real estate costs many buyers hundreds of thousands every year. Real-world DD on a typical apartment or land transaction takes a few days and costs in the tens of thousands of CZK — significantly less than any issue it uncovers would cost.

Kontrola katastru is the first and most important. The title deed (LV) has four key sections:

  • List A: owner(s) and ownership share
  • List B: description of properties (parcel, unit, area, type, use)
  • List C: easements, pledges, pre-emption rights, third-party rights in rem
  • List D: notes and marked disputes (seals, legal defects)

Pay special attention to the C-list — an easement for a right of way over the land or a pledge that the seller „forgot" to mention dramatically changes the property value.

What else to check:

  • Zoning and building permits: especially for newly built structures. Without a final-use permit or building permit, the property can be legally problematic.
  • Energy performance certificate (PENB): mandatory for sales since 2013. A missing energy certificate (PENB) doesn't block the sale but breaches the seller's obligation.
  • Lease relationships: who uses the property? Lease agreements pass to the buyer by operation of law. An unrecorded long-term lease can significantly limit use.
  • Condominium bylaws and meeting minutes: for an apartment, check the seller's debt to the condominium association, planned investments, and legal disputes.

Verifying the seller:

  • Insolvency register (isir.justice.cz) — if insolvency proceedings are open against the seller, the sale may be contested (the insolvency administrator has standing to object).
  • Central register of enforcements (CEE) — enforcements can lead to pledges or forced sale of the property.
  • AML kontrola for larger transactions: sanctions lists, politically exposed persons.

Tax aspekty: personal income tax on real estate sale (exempt after 10 years of ownership for properties acquired from 2021); VAT on commercial sale by VAT payer (first 5 years from final-use permit). Real estate transfer tax was abolished in 2020.

Co DD doesn't catch: the property's physical condition (hidden defects, structural integrity), quality of neighbors and surroundings. For that there's a structural-technical inspection (a different expert), which DD does not replace.

Simplified rule: u nemovitosti over CZK 3 million legal DD practically always pays off. For smaller transactions it's worth at least running a land registry check (which you can do yourself via cuzk.cz) and verifying the seller in the insolvency register.

Real Estate Updated 05/2026

Commercial lease — clauses that matter

Quick answer

For a commercial lease (office, retail, warehouse) you can't afford a simple contract. Key items: lease term and extension options, termination grounds and notice periods (different from residential), rent and indexation (CPI), service charge handling, fit-out (who pays and who keeps it), security deposit. The Civil Code allows broad contractual freedom for non-residential leases — use it.

Commercial (non-residential) leases in the Czech Republic are governed by § 2302 et seq. of the Civil Code, which provides significantly less tenant protection than residential leases. Good news for landlords — and the reason tenants must pay attention to the contract terms: they can't rely on statutory protections.

Lease term and renewal. A commercial lease typically uses a fixed term (3, 5, or 7 years is the retail/office standard). Key points to address:

  • automatic renewal (rollover) if no party gives notice
  • tenant's option to extend
  • right of first refusal if the landlord sells the property

Termination grounds and notice periods. Under the Czech Civil Code, a fixed-term commercial lease cannot be terminated without cause — the parties are bound until the end of the term. Grounds are exhaustively listed (§ 2308) and typically involve a material breach of obligations. For an indefinite termination is possible for any reason s 6-month notice period (§ 2312). The contract can broaden termination grounds for fixed terms, and often does.

Rent and operating costs.

  • Base rent: either fixed (CZK/m²/month), or base + variable (% of revenue) for retail
  • Indexace: typically tied to CPI (Czech Statistical Office consumer price index) once a year. The clause should precisely specify the index, calculation method, and when it applies.
  • Operating costs (service charge): energy, water, cleaning, common-area maintenance, security, real estate tax. For smaller buildings these are typically flat-rate; for larger ones they are reconciled annually based on actuals.
  • DPH: a VAT-payer landlord can invoice rent with VAT (if the tenant is also a VAT payer). Without VAT, a VAT-payer landlord cannot deduct input VAT on investments.

Tenant improvements (fit-out). Who pays for the build-out — landlord, tenant, or split? And who keeps it at the end of the lease? Three standard approaches:

  • Landlord pays, landlord owns: typically standard office leases, tenant pays only for special customizations
  • Tenant pays, leaves it for the landlord: without compensation, in exchange for a longer term or better rate
  • Tenant pays, depreciates/removes: returns the space in its original condition

Depozit a jistota: typically 3–6 months of rent. May be deposited in an account, by bank guarantee, or by unconditional on-first-demand bank guarantee (important distinction: bank guarantee works faster than a deposit-return dispute).

Practical tips:

  • Future contract (pactum de contrahendo) is common for planned developer projects, negotiated about a year ahead
  • Tenant change-of-control clause: the landlord can require approval of the lease transfer along with sale of the company
  • Subletting clause: typically requires landlord consent
  • Force majeure: post-COVID, review how rent moratorium works and who bears the risk of premises closure due to force majeure
AI & GDPR Updated 05/2026

AI Act — who does it apply to, when does it take effect, and what does it mean for Czech companies?

Quick answer

The AI Act applies to both providers and deployers of AI systems in the EU. Prohibitions apply from February 2025, obligations for general-purpose models from August 2025, obligations for high-risk systems from August 2026, full application from August 2027. Any company using or providing AI must first determine its risk category.

The EU Regulation on Artificial Intelligence (AI Act, Regulation 2024/1689) is the world's first comprehensive legal framework for AI. It doesn't classify by technology, but by risk category:

  • Unacceptable risk (prohibited) — government social scoring, emotion recognition in school/workplace, manipulative techniques, biometric categorization of sensitive attributes
  • High risk: HR (recruitment, evaluation), education, access to essential services, law enforcement, migration, justice, critical infrastructure, regulated products
  • Limited risk: transparency obligations (chatbots, deepfakes, generated content)
  • Minimal risk: no specific obligations (most AI applications)

For most Czech companies the key question is whether they are a provider (developing and placing the AI system on the market) or a deployer (using the AI system in their operations) — there are obligations in both cases, but different ones. A provider of a high-risk system must maintain a risk management system, technical documentation, logging, transparency, human oversight, accuracy & robustness, and undergo conformity assessment. A deployer must operate per instructions, ensure human oversight, inform affected individuals, and retain logs.

For general-purpose AI models (GPAI): typically large language models — a separate layer of obligations applies from August 2025: technical documentation, respecting copyright in training, summary of training data used. For the most powerful models (systemic risk), additional obligations apply for safety evaluations, incident reporting, and cybersecurity.

The first and most important step for a company: inventory of AI systems the company uses or provides, classification by risk category, and only then a targeted compliance plan. Starting an internal AI policy before this step is a waste of time.

AI & GDPR Updated 08/2026

AI content labelling under Article 50 of the AI Act — which duties actually apply to your company?

Quick answer

Article 50 of Regulation (EU) 2024/1689 does not impose a single duty to “label AI”. It imposes five separate obligations on different actors. Two fall on providers (disclose that the user is interacting with AI; mark synthetic output in a machine-readable way), three on deployers (emotion recognition and biometric categorisation, deep fakes, and text on matters of public interest). They apply from 2 August 2026; for systems placed on the market earlier, machine-readable marking is deferred to 2 December 2026. Fines under Article 99(4)(g) reach EUR 15 million or 3 % of worldwide annual turnover.

The shorthand doing the rounds on LinkedIn — “from August, AI content must be labelled” — is imprecise enough that you cannot build a compliance programme on it. Article 50 works with two roles (provider and deployer, meaning whoever uses an AI system in the course of a professional activity), four content modalities, and a set of exceptions that decide the outcome more often than the rule itself. The practical question is therefore not “must we label?” but “in which role are we, what output is created, who receives it, and what risk of deception does it create?”

The block below is built so you can find the answer yourself: first the timeline, then a guide by role, an overview of all five obligations, and finally a practical test on borderline cases.

01 — When

Application timeline

2 Aug 2026 In force

Article 50 becomes applicable (Article 113 of the Regulation). All transparency obligations apply, including deep fake labelling and chatbot disclosure. Content both generated and published earlier is not labelled retroactively.

2 Dec 2026

End of the transitional period for machine-readable marking under Article 50(2) for AI systems placed on the market before 2 August 2026. Introduced by Regulation (EU) 2026/1744.

2 Feb 2027

The date by which signatories of the Code of Practice committed to make interoperable watermark detection available. This is not a deadline arising directly from the Regulation.

02 — Who

Guide: what applies to you

Two steps. The answer is indicative and does not replace an assessment of the specific system.

Step
In which role do you act in relation to the AI system?
The role is assessed system by system. You may be a deployer of one tool and a provider of your own product.
What does your system do?
Choose by the main function a natural person will encounter.
What do you do with the AI output?
What matters is what reaches natural persons outside your company.

Obligation 1 applies to you

  • Disclosure of interaction with an AI system Art. 50(1)The system must be designed so that the user knows they are interacting with an AI system. The disclosure must be clear and distinguishable, at the latest at the time of the first interaction. Hidden text in the terms of service or technical documentation is not enough.
  • Watch out forThe “obvious” exception is read narrowly in the Commission guidelines. General public awareness that chatbots exist is not sufficient, especially for avatars and human-like systems.

Obligation 2 applies to you

  • Machine-readable marking of output Art. 50(2)Synthetic output must carry a marking in a machine-readable format and be detectable as artificially generated or manipulated. Marking without a way to detect it is not enough, and neither is the reverse.
  • DeadlineIf the system was placed on the market before 2 August 2026, comply by 2 December 2026 at the latest. For newer systems the duty applies without deferral.

Obligations 1 and 2 apply to you

  • Disclosure of interaction Art. 50(1)A clear disclosure at the latest at the first interaction. In higher-risk contexts (finance, health, legal advice, vulnerable users) plan for repeated, context-sensitive reminders.
  • Machine-readable marking Art. 50(2)Typically a combination of digitally signed metadata and an invisible watermark, plus a detection method. Older systems benefit from the deferral to 2 December 2026.

Article 50 most likely does not apply to you

  • Mind the rest of the RegulationArticle 50 is only one layer. The system may be high-risk under Annex III (typically HR, access to services, education) or fall among the prohibited practices in Article 5. Do not address transparency before you have classified the risk.

Obligation 4 applies to you

  • Deep fake disclosure Art. 50(4)You must disclose that the content has been artificially generated or manipulated, clearly and distinguishably, at the latest at the time of first exposure. Where visual labelling is impossible, as with audio, the information is conveyed audibly.
  • Impression matters, intent does notA deep fake arises even without intent to deceive. The test is whether the content could appear authentic to a reasonable recipient, taking into account the composition of the foreseeable audience.
  • Creative exceptionFor evidently artistic, creative, satirical or fictional work, an appropriate disclosure of the existence of AI content that does not hamper the enjoyment of the work is sufficient — typically in credits or in the description.

Obligation 5 applies to you

  • Labelling of public-interest text Art. 50(4)Text published to inform the public on matters of public interest must be disclosed as artificially generated or manipulated.
  • Editorial exceptionThe duty falls away where the text has undergone human review or editorial control and a specific person holds editorial responsibility for publication. Proof-reading, or the mere existence of an editorial policy, is not enough. If AI touches the text after approval, the exception no longer applies.
  • Outside scopeAdvertising copy, product descriptions and fiction are typically not “informing the public on matters of public interest”.

Obligation 3 applies to you

  • Informing exposed persons Art. 50(3)Persons exposed to an emotion recognition or biometric categorisation system must be informed of its operation, whether it runs in real time or analyses a recording after the fact.
  • Disclosure does not make the use lawfulEmotion recognition in the workplace and in education, and certain forms of biometric categorisation, are prohibited practices under Article 5. GDPR duties run in parallel, including the legal basis and, where relevant, a DPIA.

Nothing under Article 50 applies to you right now

  • That can change quicklyThe moment you start publishing output externally, obligations 4 or 5 kick in. With high-risk systems you may also move into the provider role under Article 25 — for example if you place the system under your own trademark or substantially modify its intended purpose.

This guide is an orientation tool, not a legal assessment. The Regulation uses its own legal definitions, which often differ from everyday meaning — who counts as a “provider” and who as a “deployer”, what qualifies as “synthetic content”, and when something is a “deep fake” are judged against criteria that are not obvious at first sight. The same activity can land differently for two companies depending on role, context of use and audience. Before you build internal procedures on the outcome, talk it through with us: email us or book a consultation. The first 15 minutes are always free.

03 — What

The five obligations of Article 50

1 People must know they are talking to an AI system ProviderArt. 50(1)

An AI system intended to interact directly with natural persons must be designed and developed so that the person concerned is informed that they are interacting with an AI system. The duty falls on the provider, that is, whoever places the system on the market under their own name or trademark.

The interaction must be conversational or reactive. Passive data collection, or a system that merely recommends content, is outside scope. For AI agents, the Commission guidelines take the view that the agent should identify itself not only as AI but also state on whose behalf it acts, at key steps and at each new interaction.

Exception
Unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. The guidelines read this narrowly: general awareness of AI is not enough.
Form
No specific wording or icon is prescribed. A multi-channel approach is recommended: a text label and an opening message, and for voice, a spoken notice at the start of the call.
Not sufficient
Information buried in the terms of service, in technical documentation, or in metadata the user never sees.
2 Synthetic output must be machine-marked and detectable ProviderArt. 50(2)

Providers of AI systems generating synthetic audio, image, video or text, including general-purpose models, must ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. This is a technical layer, not a visible icon on every output — that is what obligations 4 and 5 address.

The duty has two inseparable parts: marking and detection. Marking content without any way to read the mark is as inadequate as promising detection without a technical mark. Solutions must be effective, interoperable, robust and reliable as far as technically feasible and in line with the state of the art.

Techniques
Digitally signed metadata, invisible watermarks, and supplementary fingerprinting and logging. The Code of Practice recommends combining several layers.
Outside scope
Mere reproduction or arrangement of existing content, machine-to-machine output, source code, short character sequences, internal technical output.
Editing
Assistive standard editing functions that do not substantially alter the input data or its semantics — proof-reading, compression, noise removal, minor image correction. Summarising, meaning-changing paraphrase, or inserting and removing objects do fall within scope.
Deadline
For systems placed on the market before 2 August 2026, the duty applies from 2 December 2026.
3 Informing people about emotion recognition and biometric categorisation DeployerArt. 50(3)

A deployer of an emotion recognition system or a biometric categorisation system must inform the natural persons exposed to it of its operation. The duty applies whether the system runs in real time or analyses a recording after the fact.

Emotion recognition means identifying or inferring emotions or intentions on the basis of biometric data; biometric categorisation means assigning persons to categories on the basis of the same data, typically from facial images or voice.

Overlap
The duty does not displace the GDPR or the high-risk and prohibited-practice regimes. Emotion recognition in the workplace and in education is a prohibited practice under Article 5.
Form
A visible notice, an icon, an oral statement or a combination — always at the latest at the time of first exposure.
4 Deep fake disclosure DeployerArt. 50(4)

A deployer who generates or manipulates image, audio or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated. The Regulation defines a deep fake as content resembling existing persons, objects, places, entities or events that would falsely appear to a person to be authentic or truthful.

Crucially, intent is irrelevant, and the assessment takes the reasonably foreseeable audience into account, including children, older people and those with lower digital literacy. Under the final Commission guidelines the notion of “existing” is read broadly and covers photorealistic portraits of people who never existed.

Exception
Evidently artistic, creative, satirical or fictional work. The existence of AI content is disclosed in an appropriate manner that does not hamper the display or enjoyment of the work — typically in credits, in the description, or at the entrance.
Audio
Where visual labelling is not possible, the information is conveyed audibly, usually as a notice at the start.
Not sufficient
A statement hidden in the terms of service, in metadata, or in a menu.
5 Labelling AI text on matters of public interest DeployerArt. 50(4)

A deployer who publishes artificially generated or manipulated text for the purpose of informing the public on matters of public interest must disclose that the text has been artificially generated or manipulated.

Matters of public interest are topics concerning society as a whole that merit public debate or scrutiny: politics, public administration, justice, fundamental rights, public safety and health, the environment, consumer protection, and economic, scientific and cultural development. The list is open-ended.

Exception
The text has undergone human review or editorial control and a specific person holds editorial responsibility for publication. Review means substantive assessment by someone with the necessary knowledge — not superficial proof-reading and not automated revision.
Outside scope
Advertising copy, product descriptions, fiction. Internal communication is usually outside scope too, because there is no publication to an indeterminate readership.

A common rule runs across all five obligations, in Article 50(5): the information must be provided in a clear and distinguishable manner at the latest at the time of the first interaction or exposure, and must conform to the applicable accessibility requirements.

04 — Borderline cases

Test: is this a deep fake?

Six situations from everyday corporate practice. Take a guess, then read the reasoning. Every assessment is indicative; context and the foreseeable audience decide.

Not answered yet · 0 / 6

1. A furniture e-shop photographs a real sofa and AI places it into a generated living room. Dimensions, material and colour match reality.

Typically no
The customer reads the scene as an ordinary product visualisation, not as a record of a specific existing interior, and the product's characteristics are accurate. Watch the overlap with unfair commercial practices rules, though — those are assessed separately.

2. A news portal publishes a photograph of a flood into which additional flooded houses have been generatively added so the shot “lands better”.

Yes
With a news photograph the audience expects a record of a real event. The manipulated content resembles an existing place and event and may appear authentic. Disclosure is required, regardless of it being “only” a touch-up.

3. A company generates its managing director's voice from older recordings and has it narrate a new year video for staff and for social media.

Yes
A synthetic voice of a specific existing person is a textbook deep fake. The director's consent does not remove the duty, because the protected party is also the viewer. The information is conveyed audibly, typically as a notice at the start.

4. Marketing produces an animated explainer with stylised cartoon characters that resemble no one in particular.

No
Evidently unrealistic animation cannot create an impression of an authentic recording in a reasonable viewer, so the second element of the definition is missing. The provider's separate duty under Article 50(2) to mark the output at machine level is unaffected.

5. A law firm illustrates its article with a photorealistic portrait of a “client” who does not exist and was generated in full.

Most likely yes
Under the final Commission guidelines, “existing person” is read broadly and includes photorealistic portraits of invented people, because the reader has no way of telling the person is not real. This is also the case most often overlooked in marketing.

6. A podcast team uses an AI tool to remove noise and normalise track loudness. The content of the conversation is unchanged.

No
This is an assistive standard editing function that does not substantially alter the input data or its semantics. If the tool were to speak a sentence the guest never said, the analysis flips.
Legal framework: Articles 50 and 99(4)(g) of Regulation (EU) 2024/1689 of the European Parliament and of the Council on artificial intelligence; application under Article 113; the transitional period for Article 50(2) under Regulation (EU) 2026/1744. See also the European Commission guidelines on transparency obligations of 20 July 2026 and the Code of Practice on Transparency of AI-Generated Content. We recommend verifying the cited provisions against the current consolidated text.

Penalties. A breach of Article 50 falls under Article 99(4)(g): fines of up to EUR 15,000,000 or, for an undertaking, up to 3 % of total worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs including start-ups, Article 99(6) applies the lower of the two instead. Enforcement sits with national market surveillance authorities; in the Czech Republic the institutional set-up is a matter of implementing legislation that we recommend monitoring.

Code of Practice. The Code of Practice on transparency of AI-generated content is voluntary and creates no new obligations. Its value is evidential: signatories can point to the measures the Code describes when demonstrating compliance, and gain a more predictable enforcement approach across Member States. It is not a safe harbour — supervisory authorities may still assess whether a signatory's specific measures actually work. Non-signatories must demonstrate the adequacy of their own solutions independently.

What to do in practice. A four-step approach that a smaller company can complete in a matter of days:

  • Inventory. List the AI systems you use or offer and determine your role for each. With a white-labelled product from a supplier, the provider role may well be yours.
  • Output map. For each system, determine what leaves it, who receives it and in what modality. This is where it is decided whether any obligation arises at all.
  • Draft the disclosure. Write the actual wording, icon or audio notice and fix the moment it appears. Record why you chose that form — that record is your evidence in an inspection.
  • Contractual cover. Have suppliers of generative tools confirm how they meet Article 50(2) and whether and by when they will provide a detection mechanism. Handle it in the SLA or a contract schedule, not during an incident.

Article 50 is not there to slow AI down. It is there to preserve trust where the line between human communication, synthetic content and reality blurs. Companies that solve labelling as part of product design end up with a marketing argument as well. Those that leave it to legal after launch will be retrofitting under time pressure.

AI & GDPR Updated 05/2026

When does a company need to perform a DPIA (Data Protection Impact Assessment)?

Quick answer

A DPIA is required for processing that poses a high risk to the rights of natural persons — typically large-scale monitoring, profiling, sensitive data, new technologies (AI, biometrics), or children's data. The Czech data-protection authority (ÚOOÚ) has published a list of mandatory casees. A DPIA is performed before processing begins.

DPIA (Data Protection Impact Assessment) is mandatory under Article 35 GDPR whenever personal data processing is likely to result in a high risk to the rights and freedoms of natural persons. It's not a paper formality — it's a structured analysis that typically shapes the product or process design.

The Regulation directly names three cases where a DPIA is always required: systematic and extensive evaluation of personal aspects based on automated processing including profiling, large-scale processing of special categories of data (health, biometric, political opinions, etc.) or personal data relating to criminal convictions, and systematic large-scale monitoring of publicly accessible areas.

Beyond this, the Czech data-protection authority (ÚOOÚ) has issued a list of operations where DPIA is always required. This includes, among others:

  • Large-scale profiling for automated decision-making with legal effects
  • Large-scale processing of biometric data for identification purposes
  • Combining data sets from different sources (data matching)
  • Large-scale processing of children's data
  • Use of AI for decisions about natural persons
  • Tracking employee location

A DPIA has four pillars: description of processing (what, how, why, who, where), assessment of necessity and proportionality (do we have a legal basis? is it excessive?), risk identification for data subjects, and mitigation measures. If high residual risk remains even after mitigation, prior consultation with ÚOOÚ is required.

In practice DPIAs are most often done for HR analytics, CCTV systems, new digital products with profiling, AI models making decisions about customers, and integrations with large data platforms.

AI & GDPR Updated 05/2026

Cookies and consent — what does a website really need, and when does it risk a fine from ÚOOÚ?

Quick answer

A website must obtain user consent before setting cookies that aren't strictly necessary — typically marketing, analytics, and tracking cookies. Consent must be freely given, specific, informed, and unambiguous (opt-in, not opt-out). Passive consent („by continuing to browse you consent“ is invalid in the Czech Republic. The Czech data-protection authority (ÚOOÚ) has already imposed fines for a wrong cookie banner v range hundreds of thousands až millions korun.

The rule is simple in theory, complicated in practice: cookies not strictly necessary for the website's operation require the user's prior consent. This obligation derives from the ePrivacy Directive and, in the Czech Republic, from § 89 of the Electronic Communications Act; GDPR applies to personal data. ÚOOÚ actively supervises this area: since 2022 it has issued several public statements and imposed fines.

Cookie categories:

  • Strictly necessary (technical): no consent required. Examples: session cookie for login, e-commerce cart, site language, CSRF protection
  • Functional: consent required. Examples: remembering user settings beyond the session, embedded videos, social buttons
  • Analytical: consent required. Examples: Google Analytics, Matomo (unless in server-side mode without identifiers)
  • Marketing / advertising: consent required. Examples: Facebook Pixel, Google Ads, retargeting

What consent is valid?

  • Prior consent: consent must be given BEFORE a cookie is set. Loading a tracker while the banner is showing is a breach.
  • Active choice (opt-in): the user must actively click. Pre-ticked checkboxes are invalid (CJEU Planet49 ruling).
  • Granular: the user must be able to choose categories separately, not just "accept all".
  • Symmetric buttons: "Accept all" and "Reject all" must be equally visible. A hidden "Reject" under "Settings" is a breach according to the Czech data-protection authority (ÚOOÚ).
  • Ability to withdraw consent: the user must have persistent access to settings (typically a footer icon or floating button).

What ÚOOÚ considers wrong from the webmaster's perspective: the banner shows only an „Accept" button (no Reject); the „Reject" button is hidden in the second layer; „by continuing to browse you consent" as the only mechanism; pre-ticked checkboxes in settings; tracking starts before consent is given. ÚOOÚ issued a 2023 methodology „Cookies and Similar Technologies" clarifying these requirements.

Practical postup pro web: 1) Cookie audit — list all cookies and trackers (first-party + third-party), classify them. 2) Cookie banner with a real choice (Accept all / Reject all / Settings), no pre-ticked checkboxes. 3) Cookie policy — a separate page describing each cookie, retention period, and recipients. 4) Consent withdrawal mechanism with persistent access to settings. 5) GDPR compliance — if cookies process personal data, provide information under Article 13 GDPR.

Off-the-shelf solutions vs. custom implementation. For most websites it pays to use a ready-made CMP (Consent Management Platform) — Cookiebot, OneTrust, or open-source Klaro. These tools handle technical compliance (blocking trackers until consent, logging consent, granularity) and typically respond to regulatory changes. A custom cookie banner is risky — implementation errors are often the cause of fines.

Disputes & Collection Updated 05/2026

Pre-litigation demand letter — when to send it and what must it contain?

Quick answer

Send a pre-litigation demand letter by registered mail at least 7 days before filing suit. Without it, the court will not award legal costs even if the creditor wins. The letter must clearly identify the debtor, quantify the claim, set a deadline for payment, and state that a court action will be filed after the deadline lapses. Practical reality: always send the letter, even when the debtor clearly won't pay.

A pre-litigation demand letter is a formality with major economic impact. Under § 142a of the Civil Procedure Code the court will not award legal costs to the plaintiff against a defendant debtor who has not paid by the filing date, unless the plaintiff sent a pre-litigation demand at least at least 7 days before filing the lawsuit. The rule applies in monetary proceedings and cannot be circumvented.

In practice: if the creditor sues without sending a demand letter first and wins, they bear their own costs (attorney, court fee, expert). For a CZK 500,000 dispute, that's CZK 60,000–100,000 in attorney tariff plus CZK 25,000 in court fees = approximately CZK 100,000 lost just because the demand letter was missing.

What the demand letter must contain:

  • clear identification of creditor and debtor (name, ID number, address)
  • description of the legal basis of the claim (contract, invoice, agreement) with references to specific documents
  • precise quantification of the claim (principal, late interest, contractual penalty)
  • deadline for payment (reasonable, typically 7–14 days)
  • explicit warning that a court action will be filed if the deadline passes without payment
  • date and signature

We also recommend adding a bank account for payment, a contact person, and an offer to negotiate installments (if the creditor is open to it).

How to send it. Formally, any provable form works (delivery slip). In practice:

  • Registered letter with delivery confirmation: standard and cheapest
  • Delivery via data box: if the debtor has a data box, delivery is provably guaranteed at the moment of delivery (10th day after dispatch, even without being opened)
  • Email with electronic signature or via data box — less common but valid

The creditor must be able to prove both dispatch and delivery in court, so email without an electronic signature or SMS are risky.

The 7-day period is the minimum between delivery of the demand letter and filing a lawsuit. If the debtor pays within this period, the creditor does not sue. Pokud won't pay, creditor can sue, a má right i na costs proceedings. Note: 7 days se is calculated od delivery of the letter, not from its sending.

Always send the pre-litigation demand, even when it's clear the debtor won't pay. Cost is minimal (postage), upside is large (ability to recover legal costs). Many debtors only respond to a pre-litigation demand — they ignore routine reminders.

Disputes & Collection Updated 05/2026

B2B debt collection — from reminder to lawsuit to enforcement

Quick answer

Effective collection is a sequence: 1) routine reminder, 2) pre-litigation demand letter, 3) filing the lawsuit (typically a payment order), 4) final and enforceable judgment, 5) enforcement. Speed is key — the longer you wait, the greater the risk the debtor will dissipate assets or end up in insolvency. For disputes over CZK 10,000, it pays to involve an attorney from the demand letter stage.

B2B debt collection in the Czech Republic has a standard escalation path that pays to follow — primarily because the court monitors whether the creditor acted with reasonable diligence. Skipping steps can lead the court to deny full costs, or give the debtor room to invoke defenses that could have been resolved out of court.

Phase 1 — Routine reminder. After the invoice falls due (typically 14, 30, or 60 days), a reminder follows. Form is open (email, phone, letter). Standard commercial practice is 2-3 reminders at 7-14 day intervals. The point is to give the debtor a real chance to pay without escalation. If you have late-payment interest and a contractual penalty in the contract, they accrue automatically from the day of default, even without a reminder.

Phase 2 — Pre-litigation demand. At least 7 days before filing suit, by registered mail or via the data box, with precise quantification of the debt and a deadline for payment. Without it, the court won't award legal costs.

Phase 3 — Filing the lawsuit.

  • Order for payment (§ 172 of the Civil Procedure Code): fast track for uncontested claims (typically an unpaid invoice with delivery confirmation). The court issues the order without a hearing. The debtor has 15 days to object; if they don't, the order becomes final.
  • Electronic payment order (EPR): for claims up to CZK 1 million, lower court fee (4% instead of 5%), electronic form. Ideal for most B2B disputes.
  • Standard lawsuit: for complex claims or where the debtor contests. Full proceedings with hearing and witness examination.

The court fee is 5% of the claim (4% for electronic payment order), minimum CZK 1,000, maximum CZK 4,100,000. Payable upfront.

Phase 4 — Final enforceable judgment. After the judgment or payment order is issued and the appeal deadline lapses, the decision becomes final. The court certifies finality and enforceability. If the debtor still doesn't pay, the creditor proceeds with enforcement.

Phase 5 — Enforcement. The enforcement petition is filed with a bailiff (the creditor can choose — bailiffs compete for cases). The bailiff identifies the debtor's assets (banks, land registry, salaries, vehicles) and seizes them progressively. The debtor bears enforcement costs. Practical success depends on whether the debtor has any assets at all — for failing companies, often none.

Strategic consideration — when collection isn't worth it:

  • Claims under approximately CZK 30,000 — collection costs (court fee, attorney) may be disproportionate
  • The debtor is likely insolvent — collection will take time and won't be fully recovered
  • The claim is contested (service quality, contract interpretation) — higher risk of losing

In such cases consider: selling the receivable to a factoring company, assigning it at a discount, or writing it off and taking the tax loss.

Co do preventively. The risk of non-collection is reduced by: deposits or advance payments from new clients; contractual security (bank guarantee, suretyship, pledge); contractual penalty for default; confidentiality/data clauses (the receivable is reinforced if non-payment also means loss of access to the service); credit check before contracting.

Disputes & Collection Updated 05/2026

Length of court disputes and reimbursement of legal costs — what to realistically expect when collecting?

Quick answer

For a typical B2B dispute over an unpaid invoice, expect 12–24 months to a final judgment, plus another 6–12 months for enforcement. The court awards legal costs at the statutory attorney tariff, which is often significantly less than the creditor's actual outlay. Always model the economics of the entire dispute before filing — sometimes a settlement is cheaper than a win.

The ad-friendly phrase „we will quickly collect your receivable" should be taken with a grain of salt. Realistic timeframes in the Czech court system are:

  • Order for payment (EPR), uncontested cases: 2–4 months from filing to legal force, if the debtor does not object
  • Contested lawsuit or standard claim, first instance: 12–18 months
  • Appeal proceedings: another 6–12 months
  • Appeal to the Supreme Court (if permitted): another 12+ months
  • Enforcement following a final judgment: 6–18 months until first money received, longer if the debtor has complicated assets

Realistic estimate „from filing to money in your account“ u sporu, kde debtor bojuje: 24–36 months.

Court fee. Paid upfront by the creditor, refunded to the winning party as part of cost recovery: standard lawsuit 5% of dispute value (min CZK 1,000, max CZK 4,100,000); electronic payment order 4% (up to CZK 1 million); enforcement petition typically CZK 1,000. For a CZK 500,000 dispute this means approximately CZK 25,000 in court fees.

Legal representation costs. Soud does not reimburse creditori actual expenses za attorney, awards flat fee podle attorney tarifu (decree č. 177/1996 Sb.). Tarif is based z tariff hodnoty (=claims) a stanovuje fixed fee za jeden action. Actual hourly sazba quality office (cca 3 000–5 000 Kč/hod) significantly exceeds tarif u medium large disputes.

Example: a CZK 500,000 dispute lasting 18 months with a hearing: actual creditor's attorney costs CZK 80,000–150,000 (depending on the number of actions); court-awarded reimbursement around CZK 60,000–80,000 (5 actions × tariff + VAT). Actual loss creditore i in full win: CZK 20,000–70,000 in legal services that won't be reimbursed.

Contractual cost allocation. A B2B contract can pre-regulate: contractual default interest higher than the statutory rate (typically 0,05–0,1 % per day); contractual pokutu za delay (one-off nebo recurring se); reimbursement costs collection. Ne all tyto klauzule apply, ale often pomohou cover mezeru mezi awarded a actual reimbursement.

What the judge considers when ruling on costs:

  • Full success (§ 142 of the Civil Procedure Code): the winner receives full reimbursement of costs
  • Partial success (§ 142(2)): reimbursement proportional to the success
  • Reduction due to special circumstances (§ 150): the court may deny or reduce reimbursement if there are reasons worthy of special consideration
  • Upon settlement: typically each party bears its own costs, unless the parties have agreed otherwise

Strategic takeaways:

  • For claims under CZK 50,000, the economics are often unfavorable — fixed costs (court fee, attorney) are disproportionate
  • For claims above 200 000 Kč collection is usually worthwhile, if the debtor has assets
  • Mediation or settlement in the early phase of the dispute: 70% immediately is sometimes better than 100% in 3 years with the risk of being uncollectable
  • AI tools for faster lawsuit preparation and case monitoring reduce variable costs — an area where our model (AI + attorney) shows concrete benefit
Notice. This content is informational and does not constitute legal advice or an offer of legal services. Specific situations require individual assessment by an attorney — write to us at [email protected], your first 15 minutes of consultation are free.

Didn't find your question?

Send us your question. Your first 15 minutes of consultation are free.