Online safety & content laws in Bosnia & Herzegovina (2026)
Online safety rules in Bosnia & Herzegovina: partial.
Bosnia and Herzegovina has no comprehensive online safety or platform-liability regime. The Communications Regulatory Agency (CRA) regulates broadcasting and telecommunications but has limited reach over online content moderation. A stakeholder agreement on co-regulatory principles was reached in May 2026 under Council of Europe facilitation, but no legislation has been enacted; the field remains characterised by a legislative vacuum and political deadlock over jurisdictional competences.
Legal framework
Communications Regulatory Agency (CRA); Law on Personal Data Protection (2025); self-regulatory Press Council, no dedicated online safety or platform-liability law
Key points: internet & online safety in Bosnia & Herzegovina
No online platform law, legislative vacuum
CRA: broadcasting & telecom regulator, limited online remit
The Communications Regulatory Agency, established 2001, licenses broadcasters and telecom operators and manages spectrum, but its mandate does not extend to regulating social-media or user-generated content on online platforms.
May 2026 CoE stakeholder agreement, proposals, not law
On 6 May 2026 in Sarajevo, public institutions, regulators, media, civil society, and academia agreed on principles for a multi-stakeholder co-regulatory model aligned with the EU Digital Services Act and European Media Freedom Act, under the CoE/EU PRO-FREX programme. Next steps require formalising coordination and drafting legislation, none yet enacted.
EU DSA, non-binding but cooperation underway
As an EU candidate country, BiH is not subject to the Digital Services Act. However, the European Commission has engaged BiH in TAIEX workshops on DSA implementation and Western Balkans alignment, and the May 2026 agreement explicitly targets DSA-compatible co-regulation.
New Personal Data Protection Law (2025), GDPR-aligned
The Law on Personal Data Protection was adopted 30 January 2025 and entered into force 8 March 2025, substantially transposing GDPR principles including protections relevant to children's data online. It does not, however, establish a platform content-moderation or age-verification regime.
No specific age-verification or platform-liability rules
No enacted law mandates age-verification for online services or imposes liability on platforms for user-generated content. Children's online safety relies on awareness campaigns and general criminal-law provisions, with no dedicated statutory framework.
Sources
- ifex.org/bosnia-and-herzegovina-deadlock-in-digital-platform-regulation/
- coe.int/en/web/freedom-expression/-/agreement-reached-on-advancing-online-con
- coe.int/en/web/freedom-expression/-/towards-the-co-regulation-of-harmful-onli
- rak.ba/en/about
- digital-strategy.ec.europa.eu/en/news/commission-takes-first-cooperation-steps-candidate-countries-
- europeanwesternbalkans.com/2025/02/12/the-digital-services-act-a-crucial-contribution-to-the-pro
- dataguidance.com/news/bosnia-herzegovina-parliament-passes-draft-law
- rm.coe.int/co-regulation-of-harmful-content-online-study-eng/1680adeef7
- en.wikipedia.org/wiki/Communications_Regulatory_Agency_of_Bosnia_and_Herzegovina
- lawoffice.ba/bosnia-and-herzegovina-aligns-data-protection-with-eu-standards/
- rm.coe.int/factsheet-bosnia-and-herzegovina-the-protection-of-children-against-s
Next for Bosnia & Herzegovina: CybersecuritySectoral rules
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026