Almost anyone can build a website now. You describe what you want and an AI tool generates the pages, the contact form and the shopping cart. Responsibility for what runs on the site stays with its owner, though. A fine from the Czech Trade Inspection Authority (ČOI) or the Office for Personal Data Protection (ÚOOÚ) goes to the company that runs the website.

AI-generated code is also less secure than it looks. In 2025, Veracode tested more than 100 large language models on 80 coding tasks. In 45% of the tasks, the generated code contained a security flaw from the OWASP Top 10. For Java, the models failed in more than 70% of cases, and they failed to protect against cross-site scripting (XSS) in 86% of cases.

This overview is for owners of websites and e-shops in the Czech Republic who built their site themselves (often with AI) or haven't updated it in a while. Each section ends with a short "What to check" list. The exact settings and fixes differ from site to site, so we cover those in a consultation.

Google announced that with Chrome 154 (October 2026) it will turn on "Always Use Secure Connections" by default for all users. When someone opens a public website without HTTPS, Chrome first warns them that the connection isn't secure and asks whether they want to continue. Users with Enhanced Safe Browsing have had this behaviour since Chrome 147 in April 2026.

For an e-shop, this means some customers will see a warning before they see your products. On a site without HTTPS, form data (name, e-mail, password) also travels over the network unencrypted.

A common problem is a site that only runs on HTTPS halfway. The homepage is fine, but the blog subdomain, an old image or a script still loads over http://.

AI-generated websites share a recurring weakness: API keys and passwords written directly into the code. Anything in the JavaScript sent to the browser can be read by any visitor through "View page source" or the developer tools. That includes keys for the payment gateway, the e-mail service, the database or a paid AI API. If your AI API key leaks, you pay for someone else's usage.

A public GitHub repository carries the same risk. A key you deleted in a later version is still in the commit history.

Forms are the second weak spot. Bots use an unprotected contact form to send spam and a registration form to create fake accounts. Validation that only runs in the browser's JavaScript won't stop an attacker, because they can send the request to the server directly.

A backup is only worth something if you can actually restore the site from it, and the only way to know is a test restore. Many site owners find out after an outage that the files were backed up but the order database wasn't, or that the last working backup is six months old.

The second point is a test environment. Plugin updates, a new theme or code changes from AI should be tried on a copy of the site first, not on the live e-shop on a Friday evening.

We cover backups in more detail in a separate article.

Since 1 January 2022, cookies in the Czech Republic have been opt-in (amendment to Section 89(3) of Act No. 127/2005 Coll. on Electronic Communications). You may only store analytics and marketing cookies after the visitor consents. Without consent, only strictly necessary cookies are allowed, for example for the cart or login.

Consent has to be freely given, so rejecting must be as easy as accepting. In its Planet49 judgment (C-673/17, 2019), the Court of Justice of the EU confirmed that a pre-ticked checkbox is not valid consent.

The ÚOOÚ does enforce this. In an order dated 18 July 2023 it fined a website operator CZK 602,000. The office found that non-technical cookies with a lifetime of years (one of them up to ten years) were stored before the visitor made any choice. Some cookies had no stated purpose, and their descriptions weren't in Czech. At the first inspection in 2022, the "Reject" option sat only in the second layer of the banner, which the office described as a breach of the freely-given-consent condition. The operator later changed the banner, but cookies were still being stored before consent.

Every form that collects a name, e-mail or phone number processes personal data. Under Article 13 GDPR, at the moment someone enters their data you have to tell them who the controller is and how to contact them, the purpose and legal basis of the processing, who receives the data, how long you keep it and what rights they have.

In practice, a short sentence next to the "Send" button with a link to your privacy policy is enough. A consent checkbox is often unnecessary: when someone asks you for a quote, you process their data to handle their request. A newsletter or marketing is a different situation.

With AI-built websites it's often unclear where the form data actually goes. It might be an e-mail inbox, a database, an external form service or a CRM. Each of these services is a processor, and you should have a data processing agreement with each one (large services usually include it in their terms).

Under Section 435 of the Czech Civil Code, every business must state on its website its name or company name, registered office, company ID (IČO) and, for registered entities, the entry in the public register including the section and file number. A contact where customers can reach you belongs there too.

An e-shop has more obligations. Before the contract is concluded, the customer must know the price including taxes, delivery costs, payment method and the conditions for withdrawal (Section 1820 of the Civil Code). The Consumer Protection Act also requires information on how and where to make a complaint about a defective product (Section 13), usually covered by a complaints policy (reklamační řád), and information on out-of-court dispute resolution, which ČOI handles for ordinary e-shops (Section 14).

Section 12a of the Czech Consumer Protection Act has applied since 6 January 2023. When you announce a discount, you must state the lowest price at which you offered the product in the 30 days before the discount, and calculate the discount from that price. You can't strike through an "original" price the product was never sold at.

ČOI checks this systematically. In 2025 it carried out 1,432 inspections of discounts and found violations in 734 of them, which is 51%. It found unfair commercial practices in 368 cases and breaches of Section 12a itself in 324 cases. Over the year, 380 fines totalling CZK 38,661,500 became final.

The inspectors also watch for workarounds. According to ČOI, retailers increasingly avoid the word "discount" and use coloured price tags and slogans such as "Save 50%", "SUPER price", "app price" or "manufacturer's recommended price" instead. ČOI also points out that a product "on sale" for several months in a row is no longer a real discount.

Act No. 159/2026 Coll., published on 2 September 2026, adds a new Section 1830a to the Czech Civil Code. From 1 January 2027, anyone who concludes contracts with consumers through a website or app must let them withdraw from the contract with a button. This covers the sale of goods, services and digital content, except for contracts where the consumer has no right of withdrawal (Section 1840).

The law sets out the process precisely:

The explanatory memorandum allows the button to be on the site permanently, without being tied to the deadline of a specific order, and says this may be easier for businesses. Failing to provide the button or the confirmation is an administrative offence under the Consumer Protection Act. You also have to add information about the button and where to find it to your pre-contractual information, meaning your terms and conditions (Section 1820(1)(i)).

Act No. 424/2023 Coll. on accessibility requirements for products and services has been in force since 28 June 2025. It is the Czech implementation of the European Accessibility Act. The services it covers include e-commerce services for consumers, meaning e-shops.

Microenterprises are exempt: businesses with fewer than 10 employees and an annual turnover or balance sheet total of up to EUR 2 million. If you don't fall into this category, your e-shop has to be usable by people with visual, hearing or motor impairments. In practice, the benchmark is the harmonised standard EN 301 549, which refers to WCAG 2.1 level AA. ČOI supervises e-shops, and the most serious breaches can lead to a fine of up to CZK 10 million.

Typical problems on websites built in a hurry: low text contrast, images without alternative text, form fields without labels, elements that can't be operated with a keyboard, and error messages that screen readers can't interpret.

Since 2 August 2026, the transparency obligations in Article 50 of the EU Artificial Intelligence Act (AI Act) have applied. A system that interacts directly with people must be designed so that they know they are talking to AI. The exception only covers situations where this is obvious from the circumstances, and according to its guidelines, the European Commission reads that exception narrowly. General public awareness that chatbots exist is not enough. Breaching Article 50 can lead to a fine of up to EUR 15 million or 3% of worldwide annual turnover.

Labelling aside, there is the question of who is responsible for what the bot says. In 2024, a Canadian tribunal ruled on a complaint from a customer whose Air Canada chatbot wrongly promised a partial refund of a ticket. The airline argued it wasn't responsible for information from the chatbot. The tribunal rejected the argument and ordered it to pay the price difference, about CAD 812 in total including interest and fees. In its view, a company is responsible for all information on its website, whether a person or a chatbot wrote it.

That is why it pays to set limits for the bot: what it may answer, when it must point to the terms and conditions, and when it hands the conversation over to a person.

This list tells you what to check. How exactly to set up the cookie banner, consent mode or database access rights depends on the technology your site runs on. We go through that together in a consultation.