UkraineLaw on Critical Infrastructure, Operator Duty to Inform Authorities of Physical and Cyber Security Incidents
Закон України "Про критичну інфраструктуру" № 1882-IX від 16.11.2021, ст. 21(1)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://zakon.rada.gov.ua/laws/show/1882-20In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds a critical infrastructure operator, meaning a legal entity or individual entrepreneur that manages a critical infrastructure object entered in the Register, in a sector such as energy, water, health, electronic communications, financial services or transport (arts. 1, 9 and 21; reached by declaring that you operate an essential service).
- Inform the authorized critical infrastructure protection body, the National Police, the Security Service of Ukraine and other state bodies immediately of incidents connected with violations of physical security and cybersecurity systems; the Law states no numeric clock (art. 21(1)(9)).
- Protect your critical infrastructure objects, including by an effective system of physical security, operating-systems security and cybersecurity (art. 21(1)(1)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
- Open questions
- Which sanctions does Ukrainian law attach to a critical infrastructure operator's breach of article 21, given that article 29 refers only to liability according to the law?
- Does the separate cybersecurity law that article 3(3) of this Law contemplates displace the cyber part of article 21?
What this law does
Article 21(1)(9) of the Law on Critical Infrastructure requires a critical infrastructure operator to inform the authorized critical infrastructure protection body, the National Police, the Security Service and other state bodies immediately of incidents connected with violations of physical security and cybersecurity systems. Article 21(1)(1) separately lists protecting critical infrastructure objects, including cybersecurity, among the operator's main tasks.
Article 29 provides that persons guilty of violating the legislation bear liability according to the law, without stating a penalty of its own.
When LexLint raises it
When your app profile says your app runs an essential service.