What Accelerating NIS2 Enforcement in the EU Means for Companies in Serbia

by

Published: 5 August 2026.

In recent months, the NIS2 Directive in the European Union has been moving from the “paperwork” phase to the phase of real enforcement. Two events in July 2026 clearly show this shift — and they have direct implications for companies in Serbia that do business with European partners or are preparing for the national Law on Information Security.

What Exactly Happened

On 8 July 2026, the European Commission brought proceedings before the Court of Justice of the EU against Ireland, Spain, France and the Netherlands for incomplete transposition of the NIS2 Directive into national legislation, along with a request for financial sanctions. The deadline for transposing the directive expired back in October 2024, and this step is the final phase of the formal infringement procedure.

Interestingly, the Dutch parliament passed its cybersecurity law (Cyberbeveiligingswet) just one day before proceedings were brought against the Netherlands — and it enters into force on 15 August 2026. From that date, more than 8,000 organisations in the Netherlands must be registered, apply risk management measures and ensure oversight at board level.

Why This Is Relevant for Serbia

Serbia is not an EU member, so the NIS2 Directive has no direct legal force here. But the national Law on Information Security is deliberately aligned with the logic of NIS2, and the trend we see in the EU — from “copy the law” to “now it is really being enforced” — typically carries over to the region with a delay of a year or two. What we see today in the Netherlands, Germany and other member states is probably a picture of what will soon become the standard here too.

In addition, companies in Serbia that are part of the supply chain of European companies — as subcontractors, IT partners or service suppliers — increasingly receive requests from their EU partners to demonstrate compliance with security standards, regardless of whether national law formally requires it. Faster enforcement in the EU means these requests will become stricter and more frequent, not milder.

What This Means Specifically for Your Company

  • If you work with EU companies, expect increasingly detailed questions about your security infrastructure in contracts and tenders
  • If you are preparing your company for compliance, it is better to start now while there is time for gradual implementation than when deadlines become urgent
  • Basic measures (firewall, MFA, backup, incident response plan) are the common denominator of all versions of the NIS2 law in the EU — investing in them pays off regardless of exactly which regulation ultimately applies to you

If you are not sure whether the obligations apply to your company and how ready your infrastructure is, try the free NIS2 check — in two minutes you get an indicative answer and a concrete list of what is missing. For a more detailed assessment and compliance plan, request a free consultation.

Sources

Leave a comment

Powered by