This is general information, not legal advice. The guide reflects the law and bylaws as of the date of the last update. For specific decisions, check the current texts and seek legal advice.
What the law is and how it relates to NIS2
The Закон за безбедност на мрежни и информациски системи (Official Gazette of the Republic of North Macedonia no. 135/2025) is the country’s main cybersecurity law. It has no official English title; “Law on Security of Network and Information Systems” is an unofficial translation.
The law states that it is aligned with Directive (EU) 2022/2555, known as NIS2. North Macedonia is not an EU member, so the directive does not apply directly and the EU transposition deadline of 17 October 2024 never bound the country. The model is the same, though: essential and important entities, risk-management measures, strict reporting deadlines and supervision.
Aligned does not mean identical: the scope, the authorities, the first reporting deadline and the basis for fines all differ.
Key dates and bylaws
- 27 June 2025: the Assembly adopts the law.
- 4 July 2025: the law is published in Official Gazette no. 135/2025 and enters into force on the eighth day after publication.
- Deadlines: bylaws within six months of entry into force; the Government’s lists of entities and the start of MKD-GOV-CSIRT within twelve months.
- 1 January 2026: the law applies (Art. 62).
- June 2026: the main bylaws are published (table below).
- Pending: AEK’s rulebook on risk-management measures for the private sector and its significant-incident thresholds were in public consultation from 15 to 30 July 2026; adoption is not confirmed.
| Official Gazette | Date | Act |
|---|---|---|
| 128/2026 | 12 June 2026 | Rulebooks on the register of representatives, the methodology for identifying essential entities, size criteria for the cybersecurity officer, and incident records |
| 129/2026 | 15 June 2026 | Coordination team for large-scale incidents and crises |
| 133/2026 | 18 June 2026 | Decree on identification and classification of sectors and entities |
| 139/2026 | 25 June 2026 | Portal access, cybersecurity officer competencies, MKD-GOV-CSIRT prioritization |
| 140/2026 | 25 June 2026 | Government decision with the lists of essential and important entities |
| 141/2026 | 26 June 2026 | MDT rulebook on incident reporting |
Who the law applies to
The law covers the public sector, medium and large entities in 16 sectors, and certain entities regardless of size.
Whether you are medium or large depends on the classification in the Law on Trade Companies (employees, annual revenue and total assets), not on the EU SME definition.
Foreign providers without a registered seat in North Macedonia, such as cloud, data center, managed service and managed security service providers, as well as those serving essential or important entities, must register a local representative with MDT.
- Public sector (essential entities): the Assembly, independent and regulatory bodies, the Government, ministries, state administration bodies, courts, municipalities and the City of Skopje.
- Sectors 1–7, applying now: energy, transport, banking, financial market, health, digital infrastructure and ICT service management (B2B).
- Sectors 8–16, applying from the day of EU accession: drinking water, wastewater, postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.
- Regardless of size: public electronic communications, trust services, the .mk and .мкд registry, DNS services, domain registrars, the sole provider of an essential service, critical infrastructure operators and others listed in the law.
Essential and important entities
The category determines supervision, the cybersecurity officer requirement and the maximum fine. The Government published the lists in June 2026 (OG 140/2026). If you meet the criteria but are not listed, you must notify the competent authority yourself. Covered entities register on the single cybersecurity portal.
| Essential entities | Important entities | |
|---|---|---|
| Who | Large entities in the sectors; trust service providers, regardless of size; the .mk and .мкд registry and DNS providers; medium and large electronic communications operators; the public sector; critical infrastructure operators; entities designated by law or risk assessment | Medium entities in the sectors; entities designated by law or risk assessment |
| Measures | The ten measures of Art. 32 | The ten measures of Art. 32 |
| Incident reporting | Art. 33 deadlines | Art. 33 deadlines |
| Cybersecurity officer | Mandatory | Not mandatory; we recommend a named owner |
| Supervision | Proactive, including on-site checks and audits | Ex post only |
| Maximum fine | Up to 2% of total annual revenue (entities in the sectors) | Up to 1.4% of total annual revenue |
Who is not covered
The Ministry of Interior, the National Security Agency, the Operational-Technical Agency, the Directorate for Security of Classified Information, the Intelligence Agency, the Ministry of Defence and the Public Prosecutor’s Office are exempt. The law does not apply to the National Bank.
Sectors 8 to 16 are deferred until EU accession. Even so, covered customers may already require the same measures from you through contracts, because supply chain security is one of their obligations.
The ten risk-management measures
Article 32 requires technical, operational and organizational measures that are proportionate to the risk and reflect the state of the art. Where measures fall short, corrective action must follow immediately and at the latest within 30 days.
As of the update date, adoption of AEK’s rulebook with detailed requirements for the private sector is not confirmed, so the measures in the law itself are the baseline. The minimum in Art. 32(3), mirroring Art. 21(2)(a)–(j) of NIS2, is:
- risk analysis and information system security
- incident handling
- business continuity: backups, disaster recovery and crisis management
- supply chain security, including relationships with direct suppliers
- security in acquisition, development and maintenance, including vulnerability handling and disclosure
- assessing the effectiveness of the measures
- basic cyber hygiene and cybersecurity training
- cryptography and encryption
- human resources security, access control and asset management
- multi-factor or continuous authentication, secured communications and secured emergency communications
Management, the annual risk assessment and the cybersecurity officer
Management bodies must carry out a risk assessment at least once a year, update the measures and oversee their implementation. They must also provide regular training for management and staff.
Public institutions and essential entities must have a cybersecurity officer who reports to management and acts independently. The competencies of officers in public institutions are set in one rulebook (OG 139/2026) and the size criteria in another (OG 128/2026).
The evidence to keep: an annual risk assessment approved by management, a named officer with a clear mandate, minutes that show oversight, and training records.
Incident reporting: to whom and for what
You report significant cybersecurity incidents and significant cyber threats that affect your services to the competent CSIRT (MKD-CIRT or MKD-GOV-CSIRT) through the single portal.
What counts as significant is set by each competent authority’s methodology. MDT publishes its methodology on its website, and its reporting procedure for the Government and municipalities is in a rulebook (OG 141/2026). AEK adopted its rulebook on reporting to MKD-CIRT on 15 July 2026; its private-sector thresholds were still a draft as of the update date.
Trust service providers report within 24 hours. Where possible, recipients of your services who may be affected by a serious cyber threat must be told by the next working day at the latest about the measures or remedies they can take. If personal data is affected, the notification duty under the Law on Personal Data Protection also applies.
Supply chain and public procurement
Supply chain security is one of the ten measures. MDT must require essential and important entities to use certified ICT products and services; a rulebook adopted by the minister sets which products and which entities. It also keeps a register of high-risk ICT products, services and vendors, which are excluded from public procurement.
In practice: keep an inventory of ICT suppliers, put security requirements into contracts and check new purchases against the register.
Supervision and audits
Essential entities are supervised proactively, including on-site checks and audits. Important entities are supervised ex post only.
Audits are carried out by independent cybersecurity auditors licensed by MDT, or by other institutions the law permits. Diverto is not a licensed auditor and does not issue certificates. We prepare you: we find the gaps, implement controls and gather the evidence.
Penalties
Fines are imposed by a competent court in misdemeanor proceedings, not by MKD-CIRT or MDT. There is no fixed euro cap, and the basis is total annual revenue, not worldwide turnover (Arts. 54–57).
- Essential entities in the sectors: up to 2% of total annual revenue in the previous business year.
- Important entities: up to 1.4% of total annual revenue in the previous business year.
- Other offenses under the law: up to EUR 10,000.
- The responsible person in the entity: up to EUR 5,000; the head of a public institution: EUR 5,000.
- Bans: for an essential entity, a ban on an activity for 3 months to 2 years; for its responsible person, a ban on practicing a profession, activity or duty for 3 months to 1 year.
How it compares with EU NIS2
For subsidiaries of EU groups, the usual gaps are the 3-hour deadline, the local portal, the local authorities and the size test.
| Topic | North Macedonia | EU NIS2 |
|---|---|---|
| Legal form | National law aligned with NIS2 | Directive transposed by each member state |
| Application | From 1 January 2026 | Transposition by 17 October 2024, application from 18 October 2024 |
| Sectors | 16; 1–7 now, 8–16 from EU accession | No accession-linked deferral |
| Size test | Law on Trade Companies | EU SME definition |
| Measures | Ten, Art. 32(3) | Ten, Art. 21(2) |
| First notice | Immediately, at the latest within 3 hours | No 3-hour step; early warning within 24 hours |
| Later reports | 24 h, 72 h and 1 month (Art. 33) | 24 h, 72 h and 1 month (Art. 23) |
| Fine basis | Total annual revenue in the previous business year | Worldwide annual turnover |
| Fine, essential | Up to 2%, no fixed euro amount | Maximum of at least EUR 10 million or 2% |
| Fine, important | Up to 1.4%, no fixed euro amount | Maximum of at least EUR 7 million or 1.4% |
A practical checklist for the first 90 days
This is a working plan, not a legal deadline: the law already applies.
- Days 1–15: confirm scope and check the Government lists; notify the competent authority if needed. Register on the portal; foreign providers register a representative.
- Days 15–30: brief management on its duties, appoint an officer where mandatory and write a procedure for a first notice within three hours, with contacts and out-of-hours escalation.
- Days 30–60: run the risk assessment and a gap assessment against the ten measures. Quick wins: MFA, tested backups, privileged access control and logging.
- Days 30–60: inventory your ICT suppliers, review security terms in contracts and check purchases against the high-risk register.
- Days 60–90: turn the gaps into a plan with owners, budget and dates, approved by management.
- Days 60–90: train management and staff, run an incident exercise that tests the 3-hour deadline, and file the evidence.
- Ongoing: track AEK’s rulebook and thresholds.
Reporting a significant incident (Art. 33)
- 0You become awareOf a significant incident or significant cyber threat.
- 3 hFirst noticeImmediately, at the latest within three hours, to the competent CSIRT.
- 24 hEarly warningWithin 24 hours.
- 72 hIncident notificationWithin 72 hours.
- 1 monthFinal reportOne month after the notification; if the incident is ongoing, a progress report first.