NIS2 obligations in Albania

Competent authority & CSIRT Legal ref: Art. 7, 9, 34

• The National Cybersecurity Authority is subordinate to the Prime Minister, which is financed from the state budget and other legal sources. Part of the structure and organisation of the National Cyber Security Authority is the National Cyber Security Operational Centre. The organisation and operation of the Authority are approved by the decision of the Council of Ministers. All public entities responsible for cybersecurity are required to establish their sectoral CSIRT responsible for cybersecurity incidents. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 12, 15, 17

• Sectors added: ecs-org.eu · 28 Oct 2026 · secondary source
• Entities processing or transmitting classified information related to public security (essential). ecs-org.eu · 28 Oct 2026 · secondary source
• Education sector (essential). ecs-org.eu · 28 Oct 2026 · secondary source
• Tourism sector (essential). ecs-org.eu · 28 Oct 2026 · secondary source
• The research sector is out of scope ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 12

• The Competent Authority continuously identifies essential and important infrastructures in cooperation and coordination with other entities responsible for cybersecurity. The entities identified as essential and important should report the following information to the Authority: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the entity. ecs-org.eu · 28 Oct 2026 · secondary source
• Address. ecs-org.eu · 28 Oct 2026 · secondary source
• When applicable, the sector and sub-sector classification. ecs-org.eu · 28 Oct 2026 · secondary source
• When applicable, a list of the states where they provide services under the scope of this law. ecs-org.eu · 28 Oct 2026 · secondary source
• The list of essential and important infrastructures is confidential and updated at least once every two years under the direction of the Authority and approved by decision of the Council of Ministers. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 24, 23, 25, 28

• Operators of essential and important infrastructures report all types of cybersecurity incidents to the National CSIRT and the sectoral CSIRT within four hours of detecting the incident. In the case of significant incidents, within 72 hours of detecting the incident, operators update the information and conduct an initial assessment, including severity and impact, as well as, where present, indicators of compromise. Within one month after sending the incident notification, operators of essential and important infrastructures submit a final report to the National CSIRT with the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• A detailed description of the incident, including its significance and impact. ecs-org.eu · 28 Oct 2026 · secondary source
• The type of threat or the main cause that may have resulted in an incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Implemented measures and ongoing measures for mitigating the consequences. ecs-org.eu · 28 Oct 2026 · secondary source
• Where applicable, the cross-border impact of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Other entities can voluntarily report to the national CSIRT, which examines the reports submitted and determines the significance of the cybersecurity incident’s impact according to the parameters prescribed in the Law. However, voluntary reporting does not create consequences or obligations for the reporting entity ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 47, 45

• When the Competent Authority identifies a violation of provisions constituting an administrative offence, as per Article 44 of the law, it imposes a fine as follows: ecs-org.eu · 28 Oct 2026 · secondary source
• From 1,000,000 to 10,000,000 Albanian lekë for administrative violations specified in items “a” and “e” of Article 44 . ecs-org.eu · 28 Oct 2026 · secondary source
• From 200,000 to 400,000 Albanian lekë for administrative violations specified in items “b”, “c”, “d”, and “g” of Article 44 . ecs-org.eu · 28 Oct 2026 · secondary source
• From 2,000,000 lekë to 5,000,000 lekë for administrative violations specified in item “h” of Article 44. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 39, 40, 41, 42

• The Competent Authority develops the national cybersecurity certification scheme in line with EU-approved certification frameworks. One year after the scheme takes effect, the Authority publishes a list of accredited Conformity Assessment Bodies. The law outlines the required security objectives, promotes the use of electronic identification and qualified trust services, and sets implementation deadlines for entities subject to the scheme. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Document view – Center for Official Publications

What changed recently

No dated changes recorded.