Cybersecurity law & regulation in Armenia (2026)
Cybersecurity in Armenia: comprehensive law.
Armenia enacted a comprehensive cybersecurity law that came into force on 4 January 2026, establishing a unified national cybersecurity policy covering both state bodies and private critical-infrastructure operators across 14 designated sectors. The law mandates risk management, minimum security standards (ISO 27001 or equivalent), and a 72-hour incident-reporting obligation for serious cyber incidents to the Authorised Body. An autonomous Information Systems Regulatory Authority is to be constituted by the National Assembly, and approximately 30 secondary regulatory acts are still required for full implementation.
Legal framework
Law of the Republic of Armenia 'On Cybersecurity' (entered into force 4 January 2026), administered by the Ministry of High-Tech Industry and a newly mandated Information Systems Regulatory Authority; Government CERT operates under the Information Systems Agency of Armenia (ISAA)
Key points: cybersecurity in Armenia
Comprehensive Law in Force
The Law 'On Cybersecurity' was approved by the National Assembly of Armenia in November 2025 and entered into force on 4 January 2026, following government approval of the legislative package on 14 August 2025. It is Armenia's first dedicated, horizontal cybersecurity statute.
Critical Infrastructure Scope
The law designates 14 critical sectors, including energy, transport, healthcare, financial services, manufacturing, and public administration, and places obligations on Critical Information Infrastructure (CII) operators in both state and private spheres to implement organisational and technical measures.
Incident Reporting, 72-Hour Obligation
Upon becoming aware of a serious cyber incident (defined as one threatening life, national security, the economy, or critical infrastructure continuity), regulated entities must submit updated information to the Authorised Body within 72 hours. CII operators must also maintain incident-response and business-continuity processes.
Mandatory Security Standards & Certification
CII operators are required to meet government-determined minimum cybersecurity standards and obtain ISO 27001 or equivalent international certification every three years. State bodies and public-sector entities are also subject to mandatory standards.
New Regulatory Authority & CERT
The companion Law 'On the Information Systems Regulatory Authority' creates an autonomous regulator whose members are elected by the National Assembly. The existing Government Computer Incident Response Center (CERT, cert.gov.am) currently operates under ISAA and will be integrated into the new framework as the operational cyber-incident response function.
Personal Data Breach Notification (Pre-existing)
Separate from the new cybersecurity law, Armenia's personal data legislation already requires data processors to immediately notify the Police and the Personal Data Protection Authority upon discovering an outflow of personal data from electronic systems.
Timeline of decisions
- IncidentAlleged Sale of 8 Million Government Records Probed
A threat actor advertised an alleged dataset of approximately 8 million Armenian government records, including communications from police and judicial bodies, for $2,500 on an underground forum. Authorities denied a direct government email breach but opened an investigation pointing to the electronic civil litigation platform as a likely source.
The Record (Recorded Future News)
- LawLaw 'On Cybersecurity' Enters into Force
Armenia's first dedicated cybersecurity statute took effect, mandating minimum security standards (ISO 27001 or equivalent) for critical-infrastructure operators, compulsory cyber-incident reporting to AM-CERT, and establishing a new independent Information Systems Regulatory Authority with commissioners elected by the National Assembly.
EVN Report
- Law · officialNational Assembly Adopts Law on Cybersecurity
Armenia's parliament enacted a dedicated Cybersecurity Law establishing mandatory standards for critical-infrastructure operators, incident-notification obligations, and a new autonomous Regulatory Authority for Information Systems. The law directly reinforces data-confidentiality and integrity obligations under the Personal Data Protection Law.
Ministry of High-Tech Industry of the Republic of Armenia
- Law · officialCabinet Approves Draft Cybersecurity Legislative Package
The Armenian government approved the draft Law 'On Cybersecurity' and two companion bills submitted by the Ministry of High-Tech Industry and Information Systems Agency of Armenia, clearing them for National Assembly consideration after an 18-month public consultation and revision process.
Ministry of High-Tech Industry, Republic of Armenia
- IncidentRussian-Linked Groups Launch Sustained DDoS Campaigns Against Armenian Infrastructure
Beginning in January 2024, Anonymous Russia and Anonymous Sudan conducted repeated DDoS attacks on Armenian government websites, banks, and telecoms; a subsequent FBI investigation concluded Russian actors were behind attacks on Armenian telecommunications infrastructure, underscoring the geopolitical dimension of cyber threats facing Armenia.
CyberHUB-AM
- Guidance · officialDraft Law 'On Cyber Security' Released for Public Consultation
The Ministry of High-Tech Industry published Armenia's first standalone cybersecurity draft law for public comment through January 4 2024, proposing mandatory incident notification and security standards for critical-infrastructure operators in both the state and private sectors.
Information Systems Agency of Armenia
- GuidanceDraft Law 'On Cybersecurity' Opened for Public Consultation
Armenia's Ministry of High-Tech Industry released the first draft of a dedicated cybersecurity law for public comment (December 19, 2023, January 4, 2024), proposing mandatory security requirements for critical information infrastructure operators, incident-reporting duties, and authority for a national cybersecurity body.
PanArmenian.Net
- Decision · officialArmenia Signs Second Additional Protocol to the Budapest Convention
Armenia was among the early signatories of the Second Additional Protocol to the Budapest Convention on Cybercrime, committing to enhanced cross-border cooperation mechanisms including expedited subscriber-data disclosure and joint cybercrime investigations, strengthening Armenia's international law-enforcement cooperation framework.
Council of Europe – Cybercrime Division
- Decision · officialAM-CERT (National CERT) Declared Operational
Armenia's national Computer Emergency Response Team, AM-CERT, operated under the Information Systems Agency of Armenia, became fully operational in September 2023, serving as the primary national body for coordinating cybersecurity incident response for critical infrastructure; Armenia subsequently joined FIRST (Forum of Incident Response and Security Teams).
Information Systems Agency of Armenia (ISAA)
- IncidentPegasus Spyware Targeting of Armenian Officials Publicly Disclosed
Access Now and Amnesty International published research confirming Pegasus spyware (NSO Group) had been deployed against at least 12 Armenian nationals, including a former Human Rights Defender, RFE/RL journalists, and a UN official, primarily during 2020-2022, representing the first documented use of commercial spyware in an active international armed conflict.
Access Now
- Law · officialNew Criminal Code Enacted with Dedicated Cybercrime Chapter
Armenia adopted a new Criminal Code (effective January 2022) containing Chapter 38, Crimes Against the Security of Computer Systems and Computer Data, explicitly criminalising hacking, illegal data interception, creation of malicious tools, and computer-related fraud in line with Budapest Convention obligations.
Council of Europe — Octopus Cybercrime Community
- DecisionNational Security Strategy Mandates Cybersecurity Centre and Legal Framework
Armenia's 2020 National Security Strategy, adopted by the Security Council, formally designated cybersecurity as a core national security priority for the first time, directing the creation of a national cybersecurity centre, national CERTs, and a dedicated legal framework for critical information infrastructure, the political mandate that drove the subsequent 2023-2026 legislative process.
Digital Watch Observatory
- Decision · officialArmenia Ratifies Budapest Convention on Cybercrime
Armenia ratified the Council of Europe's Convention on Cybercrime (CETS 185), committing to harmonise domestic criminal law on computer intrusion, illegal data interception, and related offences, and to cooperate with other parties on cybercrime investigations and extradition.
Council of Europe
Sources
- hightech.gov.am/en/tegekatvakan-kentron/ayl/norutyunner/government-approved-package-d
- gratanet.com/publications/new-laws-and-regulatory-reforms
- evnreport.com/politics/building-the-architecture-of-cybersecurity-armenias-institut
- arkatelecom.am/en/news/telecom/armenian-parliament-passes-bill-titled-on-cybersecuri
- arkatelecom.am/en/news/telecom/armenia-is-set-to-introduce-legislation-aimed-at-safe
- cert.gov.am/en/
- dlapiperdataprotection.com/index.html?t=breach-notification&c=AM
- legal500.com/guides/wp-content/uploads/sites/1/2024/05/Armenia-Data-Protection-Cyb
- ncsi.ega.ee/country/am/
- isaa.am/en/articles/%D5%B6%D5%B8%D6%80%D5%B8%D82%D5%B5%D5%B8%D6%82%D5%B6%D5%B
Next for Armenia: Starting a BusinessEasy
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026