NIS2 Directive: Does It Apply in Serbia?

NIS2 Directive: Does It Apply to Businesses in Serbia?

NIS2 is a European Union directive (2022/2555) and does not apply directly to businesses in Serbia, because Serbia is not an EU member. It still affects you in two ways: Serbia has a new Law on Information Security (Sl. glasnik RS, no. 91/2025) that follows NIS2, and businesses working for EU clients receive security requirements through their contracts.

NIS2 was adopted on 14 December 2022, and member states had until 17 October 2024 to transpose it into national law. As a rule, the obligations apply to medium-sized and large businesses in the sectors listed in the directive that operate in the EU.

The Serbian law entered into force on 31 October 2025. Part of the obligations depends on bylaws, so many businesses do not yet know whether they are covered. Below is what the law says, what is still pending and what a business can do right now.

This is not legal advice. Whether your business is an operator of an ICT system of special importance is a question for a lawyer. We help with the technical side: system inventory, security measures and documentation.

ServiceIT support for businesses

NIS2 and the Serbian Law in Brief

01NIS2

EU Directive 2022/2555. It covers medium-sized and large businesses in the sectors of its annexes that provide services or operate in the EU.

02Serbian law

The Law on Information Security, Sl. glasnik RS, no. 91/2025. It splits ICT systems of special importance into priority and important ones.

03Supply chain

Both NIS2 and the Serbian law require a business to arrange security with those it entrusts with work on its ICT systems.

Who the New Serbian Law on Information Security Covers

The law distinguishes operators of priority and operators of important ICT systems (Articles 5 and 6). Priority operators include, among others, businesses in energy and mining, transport, banking and financial markets, health, water supply, digital infrastructure and electronic communications, as well as providers of managed IT services to those operators.

Important operators include postal services, waste management, chemicals, wholesale and industrial food production and processing, manufacturing of computers, electronics, electrical equipment, machinery, vehicles and medical devices, research institutions and information society services as defined by the e-commerce law.

The list of activities is not the whole story. The conditions and criteria for designating operators, including company size, are set by a government bylaw (Article 6). According to an overview by the law firm BDB dated 20 September 2026, that bylaw had not been published by then, so check the Official Gazette before concluding it does not concern you.

Once the register bylaw is adopted, covered businesses have 90 days to submit their data for registration (Article 9). They must adopt a risk assessment act and an ICT system security act within 18 months of the law entering into force (Article 55), which means by the end of April 2027.

ContactAsk us about the technical side

GuideIT support for businesses

Why NIS2 Matters to Businesses Working for EU Clients

NIS2 requires businesses in the EU to include supply chain security in their measures, including relationships with direct suppliers and service providers (Article 21(2)(d)).

Paragraph 3 of the same article goes further: a business in the EU must take into account the vulnerabilities of each direct supplier, the quality of its products and its cybersecurity practices, including secure development procedures.

If your Serbian business develops software, maintains IT systems, stores data or supplies parts to an EU client covered by NIS2, you are that direct supplier. The directive does not bind you, but your client has to show it has checked you.

That can arrive as a security questionnaire, a new contract clause or a request for evidence: how passwords are managed, whether two-step login is in place, how backups are made and how quickly you will notify the client of an incident.

What to Prepare Before the Questionnaire Arrives

Questionnaires differ from client to client, but they build on the measures in Article 21 of the directive: risk analysis, incident handling, business continuity and backups, supply chain security, access control, encryption, basic cyber hygiene with staff training and multi-factor authentication.

If you already have this written down, answering takes an hour. If not, the questionnaire is a good reason to build the basics: an inventory of systems and accounts, who has access to what, how backups are made and tested and who calls whom when something happens.

Do not accept an incident notice deadline in a contract that you cannot meet. If a client asks to be notified within 24 hours, you need someone who will notice and report an incident at weekends too.

The same work also covers the Serbian law if your business ends up in scope: the measures in Article 10 of the law largely overlap with what EU clients ask for.

Incident Reporting Deadlines: NIS2 and Serbia

The deadlines differ, so they are worth knowing if you work both in Serbia and for EU clients:

NIS2, early warning: without undue delay and within 24 hours of becoming aware of a significant incident (Article 23).
NIS2, incident notification: within 72 hours of becoming aware, with an initial assessment of severity and impact.
NIS2, final report: no later than one month after the notification.
Serbia: notice of an incident that may significantly affect information security without delay, and within 24 hours of becoming aware at the latest (Article 13, Law on Information Security).
Serbia, personal data: notice to the Commissioner without undue delay, where feasible within 72 hours (Article 52, Law on Personal Data Protection).

GuideWhat is ransomware

What a Business Can Do Right Now

You do not need to wait for the bylaws to do what both the law and clients ask for. Build an inventory of systems, equipment and accounts, switch on two-step login for email and remote access, and check that data actually restores from your backup.

Write down who reports an incident to whom and by when, and rehearse it once. Review contracts with whoever maintains your systems: do they say what is done, how you are notified and what you get back if you end the contract.

If you supply an EU business, ask the client for its questionnaire or list of requirements in advance, so you are not answering under deadline pressure.

GuideData backup and the 3-2-1 rule

PlansIT support plans

Frequently Asked Questions About NIS2 and Serbia

Does NIS2 apply in Serbia?

Not directly. NIS2 binds EU member states and businesses operating in the EU. Serbia has its own Law on Information Security (Sl. glasnik RS, no. 91/2025), which sets similar obligations for operators of ICT systems of special importance.

How do I know whether the Serbian law covers my business?

Check whether your activity is listed in Articles 5 and 6 of the law, then the criteria, including company size, that the government sets in a bylaw. According to an overview from September 2026, that bylaw had not been published yet. Make the final call with a lawyer.

What if I work for an EU client?

The directive does not bind you, but your client must assess the security of its direct suppliers (Article 21 of NIS2). Expect questionnaires, contract clauses on security measures and deadlines for incident notification.

How large are the fines?

NIS2 requires member states to set maximum fines of at least EUR 10 million or 2% of turnover for essential entities and EUR 7 million or 1.4% for important ones. The Serbian law sets misdemeanour fines for a legal entity of up to RSD 2,000,000 for priority and up to RSD 1,000,000 for important operators.

Who is the National CERT in Serbia?

Until 1 January 2027 RATEL performs the National CERT role, after which the Information Security Office takes over (Article 56 of the law). Incidents are reported through the cert.rs website.