Albania’s government has approved amendments to the country’s draft cybersecurity law, introducing fines of up to 10 million lek (approximately €100,000) for operators of critical and important information infrastructure that fail to meet legal security obligations.

The proposed amendments were approved at a Cabinet meeting on November 12 and introduce stricter requirements for cybersecurity incident reporting, security measures and transparency regarding the management of information systems.

Under the draft legislation, operators of critical and important information infrastructure will be required to disclose to the National Cyber Security Authority (AKSK) the technical, organizational and operational measures they have implemented to protect their systems.

They must also provide details about the entities managing their technological infrastructure, hosting arrangements, infrastructure locations and applicable security measures.

Failure to submit mandatory security declarations within the established deadline, or to disclose how information systems are managed, could result in fines ranging from 500,000 to 2 million lek.

Submitting inaccurate, incomplete or outdated information could carry penalties of between 200,000 and 1 million lek.

The legislation also ??????????? fines of 500,000 to 1 million lek for failing to implement cybersecurity measures communicated by the AKSK, including blocking, filtering, restricting or neutralizing indicators of cyberattacks and addressing system vulnerabilities.

For other administrative violations specified in the law, penalties could reach as high as 10 million lek.