December 2025 – The Republic of Serbia
has adopted a new Law on Information Security (Zakon o
informacionoj bezbednosti) ("Serbian
NIS2"), marking a significant reform of the national
cybersecurity framework and alignment with the EU NIS2 Directive.
The Serbian NIS2 broadens the range of regulated entities,
strengthens institutional coordination, and introduces clearer
obligations for organisations operating ICT systems of special
importance. Secondary legislation is expected in 2025–2026,
and the previous law remains partially applicable until the end of
2025 to secure continuity during the transition period.
This article provides an overview of the key novelties
introduced by the Serbian NIS2, together with an outline of the
regulatory framework, the obligations imposed on operators, and the
institutional mechanisms established for incident management and
oversight.
