By careful reading of provisions of the New Law governing scope of its application, we understand the lawmaker created a confusion about elementary questions:
a) Unlike the NIS 2 Directive, the New Law does not establish size-cap criteria for determining whether it is applicable to an entity and whether an entity should be classified as essential or important. The New Law does authorise the Government to regulate such criteria by secondary legislation, which can create confusion dur to the absence of statutory basis for such differentiation.
b) It remains unclear which regulatory regime applies to tax authorities, public prosecutor’s offices, and courts. Specifically, it is uncertain whether these authorities are to be treated as independent ICT operators, and therefore partially exempt from the New Law, or whether they fall within the category of essential entities and are fully subject to its provisions.
c) With respect to trust services provided by an independent ICT operator (the Ministry of Interior), it is unclear whether the applicable regime is that governing independent ICT operators or the regime applicable to essential entities.
This Article by Nikola Djordjević and Ivan Milošević, partners in JPM Belgrade office, is aimed to open a debate for clarification of ambiguities in the New Law.
