Cybersecurity law & regulation in Albania (2026)
Cybersecurity in Albania: comprehensive law.
Albania enacted a standalone, comprehensive cybersecurity law (Law No. 25/2024) in April 2024, modelled closely on the EU NIS2 Directive and covering both critical and important information infrastructures across public and private sectors. The National Cybersecurity Authority (AKSK) serves as both the primary supervisory body and the National CSIRT, with power to classify infrastructure, supervise compliance, and impose administrative fines. The National Cybersecurity Strategy 2025-2030, approved in October 2025, further aligns Albania with EU (NIS2, eIDAS2, EUCC) and NATO standards.
Legal framework
Law No. 25/2024 'On Cybersecurity' (in force April 2024), enforced by the National Cybersecurity Authority (AKSK/NCSA)
Key points: cybersecurity in Albania
Comprehensive Law (2024)
Law No. 25/2024 'On Cybersecurity' entered into force 15 days after publication in the Official Gazette (18 April 2024), superseding the earlier Law No. 2/2017. It establishes a unified legal framework for network and information system security across critical and important sectors including energy, transport, banking, health, digital infrastructure, and public administration.
Regulatory Authority (AKSK)
The National Cybersecurity Authority (AKSK) supervises and enforces the law, classifies critical and important information infrastructures, operates as the National CSIRT/CERT, and coordinates with international partners. It is the single competent authority for cybersecurity matters in Albania.
Incident Reporting Obligations
Operators of critical and important information infrastructures must notify the National CSIRT within 4 hours of identifying an incident. For significant incidents, a follow-up assessment (severity, impact, indicators of compromise) is due within 72 hours, and a full comprehensive report, covering incident description, threat type, mitigation measures, and cross-border impact, must be submitted within 1 month.
Penalties for Non-Compliance
Administrative fines under Law 25/2024 range from 200,000 to 10,000,000 Albanian Lek (approximately €1,800, €90,000), scaled to the type and severity of the violation.
NIS2 Alignment
Law 25/2024 was explicitly drafted to transpose key elements of the EU NIS2 Directive into Albanian law as part of Albania's EU accession agenda (National European Integration Plan 2023-2025). The law mirrors NIS2's sector scope, risk-management obligations, and multi-tiered incident-notification structure.
National Cybersecurity Strategy 2025-2030
Approved by the Council of Ministers in October 2025, the strategy and its Action Plan 2025-2027 set five pillars: digital infrastructure protection, innovation and R&D (including a National Centre of Excellence for Cybersecurity), hybrid-threat resilience, capacity building, and international cooperation. It aligns with NIS2, eIDAS2, and the EUCC certification framework.
Timeline of decisions
- Guidance · officialNational Cybersecurity Strategy 2025-2030 and Action Plan 2025-2027 Approved
The Council of Ministers formally adopted Albania's second-generation national cybersecurity strategy, aligning with EU NIS2, eIDAS2, and the EUCC certification framework and covering both NATO and EU accession commitments. The accompanying three-year action plan operationalises the strategy's goals for building a secure digital ecosystem.
Albanian Telegraphic Agency (ATA)
- Law · officialLaw No. 25/2024 'On Cybersecurity' Published, NIS2-Aligned Framework Replaces 2017 Law
Albania's Parliament enacted a new, comprehensive cybersecurity law (in force 3 May 2024) repealing Law 2/2017, classifying critical and important information infrastructures, imposing risk-management and incident-reporting obligations on entities in energy, finance, healthcare, telecoms and public administration, and empowering the National Cybersecurity Authority (AKSK) as the national CSIRT and supervisor. Administrative fines range from ALL 200,000 to ALL 10,000,000.
AKSK (National Cybersecurity Authority)
- IncidentIranian-Linked 'Homeland Justice' Group Attacks Albania's Institute of Statistics (INSTAT)
Hackers claiming affiliation with Homeland Justice, attributed by Albanian authorities to the Iranian government, hit INSTAT, disabling systems on 40 computers and claiming exfiltration of over 100 TB of geographic and population data; INSTAT immediately isolated its network and Albanian authorities confirmed census data from the 2023 census was unaffected. The attack marked a continuation of the Iran-Albania cyber conflict that began in 2022.
The Record (Recorded Future News)
- GuidanceGovernment Publishes Draft Law 'On Cybersecurity' for Public Consultation
The Council of Ministers opened a month-long public consultation on the bill that would become Law 25/2024, signalling Albania's intent to transpose the EU NIS2 Directive as part of its EU accession commitments; the consultation closed 24 May 2023.
ARS Law Firm (Tirana)
- Law · officialAlbania Signs Second Additional Protocol to the Budapest Convention
Albania became the 36th state to sign the Budapest Convention's Second Additional Protocol on enhanced cooperation and disclosure of electronic evidence, committing to streamlined cross-border access to e-evidence for criminal investigations. Legislative harmonisation work with the Protocol began in November 2024 under the EU-CoE CyberSEE project.
Council of Europe — Cybercrime Division
- Guidance · officialCISA/FBI Joint Advisory AA22-264A: Formal Attribution of July-September Attacks to Iranian State Actors
The US Cybersecurity and Infrastructure Security Agency and FBI released a joint advisory formally attributing both the July and September 2022 attacks on Albanian government systems to Iranian state cyber actors (IRGC-linked groups), detailing the use of ransomware-style file encryptors, disk-wiping malware, and initial access gained approximately 14 months before the destructive phase. The advisory provided TTPs and indicators of compromise for defenders worldwide.
CISA
- DecisionAlbania Expels Iranian Diplomats and Severs Diplomatic Relations Over Cyberattack, A Global First
Prime Minister Edi Rama announced Albania was cutting all diplomatic ties with Iran and ordering Iranian embassy staff to leave within 24 hours, citing 'indisputable evidence' of state-sponsored orchestration of the July cyberattack; this was the first time any country had severed diplomatic relations directly because of a cyberattack, setting a significant precedent in international cyber norms.
Euronews
- DecisionAlbania Severs Diplomatic Ties with Iran Over Cyberattack, A Global First
Albania expelled Iranian diplomats and cut diplomatic relations in direct response to the July 2022 state-sponsored cyberattack, the first time any country has severed diplomatic ties specifically because of a cyberattack. The US Treasury simultaneously sanctioned Iran's Ministry of Intelligence and Security for its role in the attack.
US Institute of Peace — Iran Primer
- Guidance · officialNational Cybersecurity Strategy 2020-2025 Adopted by Council of Ministers
Decision No. 1084 approved Albania's first multiyear national cybersecurity strategy, covering legislative harmonisation, critical infrastructure protection, capacity building, and, for the first time in any Albanian policy document, a dedicated chapter on children's online safety. Coordination and implementation is assigned to AKSK/AKCESK.
National Authority for Cybersecurity and Electronic Certification (AKSK)
- Guidance · officialCouncil of Ministers Decision No. 1084 Adopts National Cybersecurity Strategy 2020-2025
Albania formalised its first standalone five-year cybersecurity strategy, establishing priority pillars for legal-framework development, institutional capacity, public-private cooperation, and international alignment with NATO and EU standards; the strategy set the groundwork for the 2024 legislative reform.
Council of Ministers of Albania (via UNICEF)
- Law · officialLaw No. 2/2017 'On Cybersecurity' Enacted, Albania's First Dedicated Cybersecurity Law
Parliament enacted Albania's inaugural standalone cybersecurity statute, establishing the National Authority for Electronic Certification and Cybersecurity (AKCESK) as the central regulatory and CSIRT body, defining obligations for operators of critical and important information infrastructures, and creating a framework for incident reporting and sectoral CSIRTs; the law was aligned with EU NIS1 and remained in force until superseded by Law 25/2024.
AKSK (National Cybersecurity Authority)
- Law · officialAlbania Ratifies the Budapest Convention on Cybercrime (ETS No. 185)
Albania's Parliament ratified the Council of Europe's Budapest Convention on Cybercrime, one of the earliest countries to do so after signing at the opening ceremony in November 2001. The ratification committed Albania to criminalising computer intrusion, data interference, and device misuse, and set the international legal foundation for all subsequent cybercrime and online-safety legislation.
Council of Europe Treaty Office
- Law · officialAlbania Ratifies the Budapest Convention on Cybercrime
Albania became one of the early state parties to the Council of Europe's Budapest Convention on Cybercrime, the primary international treaty governing cybercrime offences, procedural powers, and cross-border cooperation, embedding its obligations into domestic criminal law and laying the treaty-law foundation for all subsequent cybersecurity legislation.
Council of Europe — Cybercrime Convention Committee
Sources
- aksk.gov.al/en/law-no-25-2024-for-cyber-security-is-published/
- aksk.gov.al/wp-content/uploads/2024/06/Law-Of-Cyber-Security.pdf
- pwc.com/al/en/Publications/Law_On_Cybersecurity.html
- sinteza-al.com/2025/04/11/law-25-2024-on-cybersecurity-a-major-step-towards-a-safer-
- aksk.gov.al/en/the-national-cyber-security-strategy-2025-2030-and-action-plan-are
- aksk.gov.al/wp-content/uploads/2026/01/National-Cyber-Security-Strategy-2025-2030
- cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
- aksk.gov.al/en/about-us/
Next for Albania: Starting a BusinessEasy
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026