NIS2 obligations in North Macedonia

transposed Non-EU alignment · Last verified 28 Oct 2026 · needs verification

StatusTransposed

Adopted27 Jun 2025

In forceNot yet published / needs verification

National lawLaw on Security of Network and Information Systems

Registration portalNot yet published / needs verification

Commissionn/a (non-EU)

⚠ Non-EU alignment status is self-reported/secondary; verify with national source.

Competent authority & CSIRT Legal ref: Art. 11,18

Ministry of Digital Transformation: serves as the Competent Authority for the Government, ministries, independent bodies of state administration, bodies of state administration within ministries, and administrative organisations. ecs-org.eu · 28 Oct 2026 · secondary source
Agency for Electronic Communications (through the National Computer Incident Response Centre – MKD-CSIRT): serves as the Competent Authority for the security of network and information systems for the Parliament, independent state bodies, and regulatory bodies established by and accountable to the Parliament. ecs-org.eu · 28 Oct 2026 · secondary source
Crisis Response Coordination Team (operating within the framework of the Crisis Management Centre): consists of the Minister as coordinator, a representative of the Computer Incident Response Team for the executive authorities (GOV-CSIRT), and the head of the National Computer Incident Response Centre (MKD-CSIRT). ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 4,5,9

Classification corresponds to NIS 2, except for the space sector. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 7, 10

The Ministry of Digital Transformation will establish and maintain four registers of: ecs-org.eu · 28 Oct 2026 · secondary source
Sectors of high criticality. ecs-org.eu · 28 Oct 2026 · secondary source
Other critical sectors. ecs-org.eu · 28 Oct 2026 · secondary source
Essential entities. ecs-org.eu · 28 Oct 2026 · secondary source
Important entities. ecs-org.eu · 28 Oct 2026 · secondary source
Registries of top-level domains and domain name registration service providers are obliged to establish registration in a separate database. The database will include: ecs-org.eu · 28 Oct 2026 · secondary source
Domain names and PoC’s list. ecs-org.eu · 28 Oct 2026 · secondary source
Name of domain users. ecs-org.eu · 28 Oct 2026 · secondary source
Date of registration. ecs-org.eu · 28 Oct 2026 · secondary source
Entities that operate but do not have a registered office in North Macedonia are obliged to electronically register a representative with the Ministry of Digital Transformation if they are providers of: ecs-org.eu · 28 Oct 2026 · secondary source
DNS services, top-level domain name registries. ecs-org.eu · 28 Oct 2026 · secondary source
Domain name registration services. ecs-org.eu · 28 Oct 2026 · secondary source
Cloud computing services. ecs-org.eu · 28 Oct 2026 · secondary source
Data centre services. ecs-org.eu · 28 Oct 2026 · secondary source
Content delivery network services. ecs-org.eu · 28 Oct 2026 · secondary source
Managed services. ecs-org.eu · 28 Oct 2026 · secondary source
Managed security services. ecs-org.eu · 28 Oct 2026 · secondary source
Online sales services. ecs-org.eu · 28 Oct 2026 · secondary source
Internet search engine services. ecs-org.eu · 28 Oct 2026 · secondary source
Social networking service platforms. ecs-org.eu · 28 Oct 2026 · secondary source
Essential services. ecs-org.eu · 28 Oct 2026 · secondary source
Important services. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 33, 34

In the event of a significant incident, entities must send to the competent CSIRT: ecs-org.eu · 28 Oct 2026 · secondary source
Early warning within 24 hours, stating whether the incident has a cross-border impact. ecs-org.eu · 28 Oct 2026 · secondary source
Incident report within 72 hours . ecs-org.eu · 28 Oct 2026 · secondary source
Interim report at the request of the CSIRT . ecs-org.eu · 28 Oct 2026 · secondary source
Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
The competent CSIRT is obliged, within 24 hours of receiving the early warning, to submit a response to the essential or important entity, including the initial feedback on the incident, and upon request, to provide guidance or operational advice. ecs-org.eu · 28 Oct 2026 · secondary source
If a significant cybersecurity incident affects multiple countries, the CSIRT must notify the Ministry of Digitalisation, which will then inform the affected countries within two hours of the early warning. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 54

Up to 2% of the total worldwide annual turnover for failing to implement measures, notify authorities of incidents, inform affected users, or comply with requests from the Competent Authority. (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
Up to 1.4% of the total worldwide annual turnover for failing to implement measures, notify authorities of incidents, inform affected users, or comply with requests from the Competent Authority. (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
The legal representative and managing person face a fine of 5,000 EUR if the entity has violated the obligations under the law. Officials who head state administration bodies of the central government, municipalities, the City of Skopje and municipalities in the City of Skopje, as well as other central government bodies, face a fine of 5,000 EUR for violating the obligations under the law. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 35

In the year following the transposition, the Ministry for Digitalisation will establish standards in line with EU and international standards, as well as guidelines for their implementation. It will require essential and important entities to use ICT services, systems and products that are certified based on EU and international certification programmes. It will also create and maintain a register of high-risk ICT services, systems and products, and their manufacturers, which shall be excluded from public procurement procedures. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Law

What changed recently

No dated changes recorded.

Sections marked secondary source come from the ECSO NIS2 Transposition Tracker (updated 10 Sep 2026), which simplifies law extracts; source-checked items were read on the regulator's or official gazette's site. Data: data/nis2/. Not legal advice — always check the official text.