# Kybriq: llms.txt (agents start here)

> Czech Cybersecurity Act (ZKB, zákon č. 264/2025 Sb., NIS2 transposition)
> scope calculator and obligation-timeline engine by Hexenkraft.
> Czech-first; ZKB is national law, no DE/PL claims.

Free surface: scope wizard + dated duty calendar + incident clocks
(24 h / 72 h / 30 d per § 16). Planned paid API: see /openapi.json (v0,
not served yet).

## Ground rules

- Output is decision support, NOT legal advice; final assessment belongs to
  NÚKIB or the organisation's counsel.
- Registration happens only on Portál NÚKIB (https://portal.nukib.gov.cz/).
  Kybriq prepares; it never files.
- Never state fines, thresholds, or deadlines without a corpus anchor.
  Anchors are verbatim quotes from the published texts, re-verified in CI
  (`legis:check`). Fine caps live under corpus ids `zkb-s59-fine-cap-higher`
  / `zkb-s59-fine-cap-lower`; the statutory-body office ban is
  `zkb-s58-temporary-ban-six-months`.
- Permalinks: answers travel as `#p=<base64url(json)>`; decoding is strict:
  unknown/malformed keys reject the whole payload (tamper-evidence).

## Inputs and outcomes (the whole contract)

Scope inputs an agent may send (identical to the wizard's answers, see
/openapi.json for types):

- `serviceRow` (annex row id, or `not_listed_review_manually`)
- `sector` (§ 4 odst. 1 písm. a) sector id)
- `sizeClass` (`micro` | `small` | `medium` | `large`)
- `hasLinkedOrPartnerEnterprises` (Rec. 2003/361 Art. 3; `true` means the size
  figures must be consolidated, which we do not compute: the engine fails
  closed to `needs_review` rather than sizing on standalone numbers)
- `installedCapacityMw` (row 2.1 only)
- `simCards`, `fixedLines` (row 16.1 only)
- `revenueSharePct` (row 11.1 only)
- `servesNonConsumers` (rows 16.13/16.14: the provider HAS customers who are
  not consumers; it is not a "B2B only" flag)
- `stateHealthProvider` (row 18.1 only)
- `designatedUnderS5`, `doraRegulated` (overrides that can decide on their own)

Outcomes: `higher_regime`, `lower_regime`, `out_of_scope`, `needs_review`,
`carve_out_dora`. There is no CER carve-out and no separate § 5 outcome:
a § 5 designation lands in the higher regime (§ 8 odst. 3).

## Regime map (verified annex rows, vyhláška 408/2025 Sb.)

- bod 2.1 electricity generation: large → vyšší režim, medium → nižší
- bod 7.1 CZ-NACE 26 computer/electronics manufacturing: large|medium → nižší
- bod 8.1 industrial food production: large|medium → nižší
- bod 11.1 waste facility (≥5 % revenue share): large|medium → nižší
- bod 12.1 air carrier: large → vyšší, medium → nižší
- bod 16.1 public comms: ≥350 k SIM or ≥100 k fixed lines → vyšší regardless
  of size; otherwise large|medium → vyšší, small|micro → nižší
- body 16.13/16.14 managed (security) services provided to customers who are
  not consumers: large → vyšší, medium → nižší
- bod 17.1 credit institution: large → vyšší, medium → nižší (+ § 70 DORA
  carve-out when DORA applies)
- bod 18.1 health providers: large → vyšší, medium → nižší; state
  organisational unit with permit → vždy vyšší
- bod 20.1 postal service: large|medium → nižší

## Sources

Primary anchors and print-URLs: src/legislation/corpus.ts in the repo.
Extended text for agents: /llms-full.txt.
Machine-verifiable trust surface: /verification.json (live corpus check),
/decision-table.json (complete rule surface with anchors), /how-we-decide.html.