Law No. 08/L-173 on Cyber Security, Incident Reporting and Enforcement

Law No. 08/L-173 on Cyber Security, Arts. 6, 8 and 24

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 14 March 2023.

A vulnerability and incident reporting rule binding public and private bodies.

As of 18 September 2026.

What it requires

This duty reaches you if you hold Kosovo-designated national critical infrastructure as an operator of essential services, or if you provide an online marketplace, an online search engine, or a cloud computing service to users in Kosovo as a digital service provider.
As an operator of essential services, notify the Agency for Cyber Security immediately, and no later than 24 hours after becoming aware, of a cyber incident with a significant impact on system security or service continuity, and notify affected persons or the public within a reasonable time where individual notice is impractical.
As a digital service provider, notify the Agency for Cyber Security immediately upon becoming aware of a cyber incident with a significant impact on the digital service you provide.
Expect the notification procedure and the content of the incident report to be set by a further sub-legal act of the Ministry of Internal Affairs rather than by this law directly.

Who enforces it

Enforcement body

Agjencia për Siguri Kibernetike (Cyber Security Agency, ASK)

Settledness

The legal-entity fine tier, EUR 15,000 to EUR 30,000, is stated identically in the draft's Albanian and Serbian text and is not part of this open question.

As of: 18 September 2026
Open questions: Does the enacted Official Gazette text of Law No. 08/L-173, published 27 February 2023, carry the responsible-individual fine of EUR 1,000 to EUR 1,500 stated in the government-approved draft's Albanian text, or the EUR 10,000 to EUR 15,000 stated in the same draft's Serbian text, given the Gazette's own document viewer serves only a JavaScript shell?

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

An operator of essential services must inform the Agency for Cyber Security of a cyber incident immediately, and no later than twenty-four hours after becoming aware of it, where the incident has a significant impact on system security or service continuity, or where such an impact cannot be ruled out reasonably.

A digital service provider carries a parallel duty to notify the Agency of a cyber incident with a significant impact on its digital service, immediately upon becoming aware of it, without the essential-service operator's explicit twenty-four-hour figure attached to it.

For failing to carry out the Agency's ordered corrective measures after a written warning, the government-approved draft that preceded Assembly adoption set an administrative fine of EUR 15,000 to EUR 30,000 on the non-complying legal entity, a figure stated identically in the draft's Albanian and Serbian text. The fine on the responsible individual within that entity is stated as EUR 1,000 to EUR 1,500 in the draft's Albanian text.

The same provision's Serbian text states EUR 10,000 to EUR 15,000 instead, a discrepancy not resolved against the enacted Official Gazette publication.

When LexLint raises it

operates_social_platform

Read the law

Official Gazette of the Republic of Kosovo, act detail page
primary text corroborated against the government-approved draft that preceded Assembly adoption

Back to the example · Lint your app