Law No. 08/L-173 on Cyber Security, Security Measures

Law No. 08/L-173 on Cyber Security, Arts. 2, 3, 5 and 7

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 14 March 2023.

A sector security regimes rule binding public and private bodies.

As of 18 September 2026.

What it requires

This duty reaches you if you hold Kosovo-designated national critical infrastructure as an operator of essential services, or if you provide an online marketplace, an online search engine, or a cloud computing service to users in Kosovo as a digital service provider.
As a digital service provider, identify the risks to the security of your network and information systems, analyze them, and take adequate organizational and technical measures to manage that risk.
As an operator of essential services, permanently apply organizational, physical and information-technology security measures that prevent a cyber incident, resolve one, and prevent or mitigate its impact.
Expect the specific security measures required of your sector to be set by a sub-legal act of the Ministry of Internal Affairs rather than by this law directly.

If you get it wrong

Criminal exposureNo

Criminal exposure note

The draft law's own text characterizes non-compliance by an operator of essential services or a digital service provider as a kundërvajtje (administrative infraction), not as a vepër penale (criminal offense).

Who enforces it

Enforcement body

Agjencia për Siguri Kibernetike (Cyber Security Agency, ASK)

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Law No. 08/L-173 on Cyber Security requires an operator of essential services, a public or private entity that possesses Kosovo's designated national critical infrastructure, to permanently apply organizational, physical and information-technology security measures to prevent a cyber incident, resolve one, and prevent or mitigate its impact, with the sector-specific measures set by a sub-legal act of the Ministry of Internal Affairs.

A digital service provider, defined as the operator of an online marketplace, an online search engine, or a cloud computing service established or registered in Kosovo, carries a separate duty to identify the risks to its network and information system's security, analyze them, and take adequate organizational and technical measures to manage that risk.

Both duties, and the digital-service definition itself, track the equivalent provisions of the EU's original NIS Directive, (EU) 2016/1148, which the law's own preamble names as an instrument it aligns with. Non-compliance by either class of entity is an administrative infraction (kundërvajtje in the law's own term) rather than a criminal offense, and is enforced by the Agency for Cyber Security's own supervision of compliance.

When LexLint raises it

operates_social_platform

Read the law

Official Gazette of the Republic of Kosovo, act detail page
primary text corroborated against the government-approved draft that preceded Assembly adoption

Back to the example · Lint your app