Serbia, Montenegro and Bosnia and Herzegovina
Export-oriented manufacturers, IT outsourcing companies and service providers in the Western Balkans are asked for ISO 9001 and ISO 27001 by EU customers long before any local law requires it. Kellwick provides implementation, integrated systems, independent internal audits and ongoing management system support - with local information security law treated country by country, because it differs.
Buyers
Local context
Context for scoping, not legal advice. Whether a law applies to you depends on your entity type, sector and size; where a formal legal position is needed we work alongside your counsel.
Serbia, Montenegro and Bosnia and Herzegovina are not EU members, so DORA and NIS2 do not apply as domestic law. They reach companies in the region through EU customers' contracts and supplier requirements.
Each country has its own legal position - summarised below. We give governance context, not legal advice.
A new Law on Information Security aligned with NIS2 was adopted in 2025. Obligations for in-scope operators phase in through implementing regulations, and a new national information security office starts work in 2027. ISO 27001 is a practical way to build the controls the law points to.
The Law on Information Security has been in force since December 2024 and defines key and important entities on an NIS2-style model. A national cyber security agency has been established.
There is no comprehensive state-level law on network and information security; Republika Srpska has its own information security law. For most companies, customer contracts and ISO certification requirements set the bar.
Last verified 16 October 2026 against EUR-Lex - Regulation (EU) 2022/2554 and European Commission - Digital operational resilience.
Last verified 16 October 2026 against European Commission - 2025 enlargement reports.
Services
Delivery
Sectors
Questions
Not as domestic law. If you supply EU customers in regulated sectors, their contracts may impose NIS2- or DORA-derived requirements on you. Serbia and Montenegro also have their own NIS2-inspired information security laws.
No. Certification is issued by accredited certification bodies. We prepare you, audit you internally and maintain the system; you choose the certification body.
The standards, the sites and the deadline are enough to start. A specialist replies within one business day and confirms whether the work is remote, onsite or both.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.