Law on Information Security (Serbia, 2025)

Summary

The law replaces the 2016 law and aligns the Serbian framework with the EU NIS 2 Directive as part of the accession process. It divides ICT systems of special importance into priority and important systems, by sector (energy, transport, health, finance, digital infrastructure, public administration and others), and requires their operators to take protective measures, adopt a security act, assess risks and carry out regular checks. Incidents that may significantly affect security must be reported without delay and at the latest within 24 hours, followed by further reports and a final report. It establishes the Information Security Office (Kancelarija za informacionu bezbednost), which from 2027 acts as national CERT and single point of contact. Fines for legal entities can reach RSD 2 million.

Information

Jurisdiction

Serbia

Issuing body

Narodna skupština Republike Srbije

Type

Law

Available languages

Serbian

Topics

• Critical infrastructure
• Incident reporting
• Incident management / CSIRT
• Governance and coordination
• Digital public administration

Notes

Passed by the National Assembly on 22 October 2025, published in Službeni glasnik RS No. 91/2025 of 23 October 2025 and in force from the eighth day after publication (31 October 2025). It repeals the 2016 law (Službeni glasnik RS 6/16, 94/17 and 77/19), except for the duties of designated operators, which remained in force until 31 December 2025. Deadlines expressed in months (6, 12 and 18 months) run from entry into force and are given to the month. Until 1 January 2027 RATEL continues to act as national CERT. Alignment with NIS 2 is stated in the explanatory memorandum of the bill (23 June 2025). The link points to the adopted text published by the National Assembly.

Obligations compared

Cyber incident reporting Serbia

Narodna skupština Republike Srbije. (2025). Zakon o informacionoj bezbednosti (Službeni glasnik RS, br. 91/2025). https://www.parlament.gov.rs/upload/archive/files/lat/pdf/zakoni/14_saziv/1223-25%20-%20Lat..pdf

Narodna skupština Republike Srbije. "Zakon o informacionoj bezbednosti." 22 October 2025. https://www.parlament.gov.rs/upload/archive/files/lat/pdf/zakoni/14_saziv/1223-25%20-%20Lat..pdf.

@misc{rs_zakon_informaciona_bezbednost_2025,
  author       = {{Narodna skupština Republike Srbije}},
  title        = {{Zakon o informacionoj bezbednosti}},
  year         = {2025},
  note         = {Službeni glasnik RS, br. 91/2025},
  url          = {https://www.parlament.gov.rs/upload/archive/files/lat/pdf/zakoni/14_saziv/1223-25%20-%20Lat..pdf},
  urldate      = {2026-10-29}
}