NIS2 obligations in Serbia

Competent authority & CSIRT Legal ref: Art. 26, 27, 28, 31, 34

• The Ministry of Information and Telecommunication serves as the Competent Authority, proposes legislation in the field of information security, maintains records of entities, and supervises implementation. The Coordination of Information Security Affairs body has a multisectoral representation and coordinates tasks linked to enhancing information security. The Information Security Office is responsible for the prevention and protection against security risks and incidents in ICT systems. It serves as the Single Point of Contact and national CERT. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 5,6

• Sectors and subsectors in addition to NIS2: ecs-org.eu · 28 Oct 2026 · secondary source
• Mining (added to the energy sector). ecs-org.eu · 28 Oct 2026 · secondary source
• Banking and financial market infrastructures (merged into a single sector). ecs-org.eu · 28 Oct 2026 · secondary source
• Nuclear industry (added as a subsector in ‘other’ essential sectors). ecs-org.eu · 28 Oct 2026 · secondary source
• Production, trade and transport of weapons and military equipment (added to important sectors). ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 9, 37

• The Ministry of Information and Telecommunication establishes and maintains records of essential and important entities. Entities are required to submit the requested information no later than 90 days from the date of adoption of the regulation and notify the Ministry of any information changes within 15 days. The Ministry will make records available to the Information Security Office to implement provisions linked to the collection and exchange of information on threats, vulnerabilities, and incidents, and provide support, warning, and advice to entities. The Registry will be marked as classified in accordance with the Law on Classified Information. Organisations authorised to manage the registry of top-level domains and provide DNS services are required to collect, store, and maintain accurate and complete registration databases, conduct due diligence, and comply with personal data protection regulations. The respective organisations are obliged to provide access to specific domain registration data based on lawful and reasoned requests from authorised persons or authorities. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 13,14

• In the event of a significant incident, entities are obliged to submit an incident report, during the duration of the incident, with a description of the measures taken to resolve it and per the established requirements for incident reporting: ecs-org.eu · 28 Oct 2026 · secondary source
• Report every three days in the case of medium-level incidents. ecs-org.eu · 28 Oct 2026 · secondary source
• Report every 24 hours in the case of high-level and very high-level incidents. ecs-org.eu · 28 Oct 2026 · secondary source
• Report at the request of the Information Security Office. ecs-org.eu · 28 Oct 2026 · secondary source
• Where applicable, the cross-border impact of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Final incident report within 15 days of the incident’s resolution, describing the type of incident and threat that led to the incident, the timing and duration, the severity and impact, information on a possible cross-border impact and the activities undertaken to handle the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• After the end of the incident, the Information Security Office prepares recommendations and advice for protection against potential risks, based on the analysis of the incident. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 50-53

• From 50,000 to 2,000,000 RSD for failing to implement risk assessment measures, comply with inspections and information requests from authorities or notify authorities and users of incidents. (essential entities) . ecs-org.eu · 28 Oct 2026 · secondary source
• From 50,000 to 1,000,000 for failing to implement risk assessment measures, comply with inspections and information requests from authorities or notify authorities and users of incidents. (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Natural persons (registered operators) face fines from 10,000 to 500,000 RSD (essential entities) and 10,000 to 250,000 RSD. (important entities). Responsible individuals face fines from 5,000 to 50,000 RSD (essential and important entities). Financial institutions that fail to notify incidents must comply with penalties imposed by the National Bank of Serbia. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 30

• The Information Security Office will monitor and assess the use of international regulations and standards. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final Text

What changed recently

1. 30 Oct 2025
   National NIS2 law enters into force (per tracker) ecs-org.eu needs verification