On 20 November 2024, one day after the Montenegrin parliament adopted a new Cybersecurity Act, our senior partner Bogdan Ivanišević and associate Anja Gligorević held a seminar in Podgorica about the obligations for companies stemming from the Act. The seminar was co-organized by the American Chamber of Commerce in Montenegro and BDK Advokati.
The event gathered representatives of leading companies in Montenegro’s financial sector, providers of internet services, IT companies, and others.
Our team offered a detailed analysis of the similarities and differences between the newly enacted law and the NIS2 Directive which the law aims to follow. Like NIS2 and the Implementing Regulation 2024/2690 enacted by the European Commission in October, the Montenegrin law makes a distinction between essential and important entities, and requires from both types of entities a range of risk-management measures and incident reporting activities. Montenegrin law, however, has a broader scope of application insomuch as some of the obligations under the law target companies and organisations that do not qualify as either essential or important.
The text of the law does not explicitly regulate certain questions that are likely to be highly important in practice, such as the contents of the initial incident notifications and the extent to which the entities may massage security measures depending on the risk assessments. The competent cybersecurity authorities are expected to bring more clarity on these and other issues through implementing decrees.
The law mentions supply chain security only briefly, but one of the six thematic blocks in the seminar was devoted to the issue in light of its significance. Based on the existing best practices and the Implementing Regulation of the European Commission, our team suggested practical steps to regulate the relationship between the entities subject to the law and third parties.
For more information on cyber-security law related matters, please contact Bogdan Ivanišević (Bogdan.Ivanisevic@bdkadvokati.com), Pablo Pérez Laya (Pablo.Laya@bdkadvokati.com), or Anja Gligorević (Anja.Gligorevic@bdkadvokati.com).
