Law / Kosovo

Law No. 08/L-173 on Cyber Security, Security Measures

Law No. 08/L-173 on Cyber Security, Arts. 2, 3, 5 and 7

In force since 14 Mar 2023.

A sector security regimes rule binding public and private bodies.

Enforcement body: Agjencia për Siguri Kibernetike (Cyber Security Agency, ASK)

What it requires

This duty reaches you if you hold Kosovo-designated national critical infrastructure as an operator of essential services, or if you provide an online marketplace, an online search engine, or a cloud computing service to users in Kosovo as a digital service provider.
As a digital service provider, identify the risks to the security of your network and information systems, analyze them, and take adequate organizational and technical measures to manage that risk.NIST CSF 2.0ID.RA-05
As an operator of essential services, permanently apply organizational, physical and information-technology security measures that prevent a cyber incident, resolve one, and prevent or mitigate its impact.NIST CSF 2.0PR.IR-03
Expect the specific security measures required of your sector to be set by a sub-legal act of the Ministry of Internal Affairs rather than by this law directly.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST CSF 2.0

ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

If you get it wrong

Criminal exposureNo

Criminal exposure note

The draft law's own text characterizes non-compliance by an operator of essential services or a digital service provider as a kundërvajtje (administrative infraction), not as a vepër penale (criminal offense).

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Law No. 08/L-173 on Cyber Security requires an operator of essential services, a public or private entity that possesses Kosovo's designated national critical infrastructure, to permanently apply organizational, physical and information-technology security measures to prevent a cyber incident, resolve one, and prevent or mitigate its impact, with the sector-specific measures set by a sub-legal act of the Ministry of Internal Affairs.

A digital service provider, defined as the operator of an online marketplace, an online search engine, or a cloud computing service established or registered in Kosovo, carries a separate duty to identify the risks to its network and information system's security, analyze them, and take adequate organizational and technical measures to manage that risk.

Both duties, and the digital-service definition itself, track the equivalent provisions of the EU's original NIS Directive, (EU) 2016/1148, which the law's own preamble names as an instrument it aligns with. Non-compliance by either class of entity is an administrative infraction (kundërvajtje in the law's own term) rather than a criminal offense, and is enforced by the Agency for Cyber Security's own supervision of compliance.

When LexLint raises it

When your app profile says your app runs an essential service or operates a social platform.

Back to the example · Lint your app

Page updated 18 September 2026.