New legislation · Montenegro
Critical infrastructure resilience in Montenegro — what the new law requires
The Critical Infrastructure Resilience Act (Official Gazette of Montenegro 150/26) introduces eleven sectors, a resilience plan approved by the Ministry, a resilience coordinator, an annual stress test and — for the first time — certificates to MEST ISO 31000 and MEST ISO 22301 as a statutory obligation. We prepare the documentation and the systems the law asks for.
Where the law stands today
The Parliament of Montenegro passed the Critical Infrastructure Resilience Act on 29 September 2026; it was published in the Official Gazette of Montenegro, no. 150/26 of 12 October 2026, and entered into force on 20 October 2026 — the eighth day after publication. The act transposes Directive (EU) 2022/2557 (CER), supplemented by Regulation (EU) 2023/2450 listing essential services. On entry into force it repeals the Act on Determination and Protection of Critical Infrastructure (Official Gazette of Montenegro 72/19 and 33/26).
What already exists and what is still to come
Implementing regulations are to be adopted within nine months of entry into force, that is by 20 July 2027 (Article 48). Until then the existing ones apply, where not contrary to the act.
Two instruments expressly remain in force: the Regulation on sector criteria for determining critical infrastructure (Official Gazette of Montenegro no. 91/26) and the Government Decision designating critical infrastructure, which is classified "INTERNAL". The criteria therefore already exist, and the list of critical entities is not public — you will learn of designation by written notification, not by consulting a register.
The text on this page is taken from the act as published in the Official Gazette of Montenegro; we reserve the right to error in transcription and recommend checking the source text.
The eleven sectors of Article 13
The act applies to state bodies, state administration bodies, local self-government units, companies and other legal entities that operate critical infrastructure in these sectors:
Being in a sector is not enough
This is the most common misunderstanding. You do not become a critical entity by working in energy or health care, but by a decision of the Government (Article 16(3)), on a consolidated proposal from the Ministry, after the sector ministry has identified you against the Article 15 criteria: the impact of disruption on the provision of essential services, interdependence with other sectors, single points of failure and possible cross-border effects. Sector criteria and sub-sectors are prescribed by the Government (Article 14), and the Regulation on sector criteria (Official Gazette no. 91/26) is in force.
What the law requires of a critical entity
The obligations of Article 17 and the deadlines scattered across the other articles — in one place, in the order in which they have to be done.
The correct standard designations
The standards the act calls for are MEST ISO 31000 — risk analysis and management, and MEST ISO 22301 — business continuity. The ISO/IEC prefix belongs to standards the International Organization for Standardization issues jointly with the International Electrotechnical Commission; in this field those are ISO/IEC 27001 and ISO/IEC 27701, which are often mentioned alongside. We use the correct designations on this page.
ISO 31000 certification
Article 17(9) and 17(10) require a critical entity to hold a certificate to the Montenegrin standard for risk analysis and management MEST ISO 31000 and to the business continuity standard MEST ISO 22301, and Article 45 sets a fine of EUR 3,000 to 20,000 where they are missing.
The term "certification" is used here in a broad sense and refers to conformity with the standard. In practice it works like this:
ISO 22301 is a requirements standard: an independent accredited certification body certifies the management system and issues a certificate to the organisation.
ISO 31000 is a guidance standard. It is applied in full and its application is evidenced — through a risk management policy, a risk register, acceptance criteria and records of review. For a system established in this way a statement of application and conformity with ISO 31000 is issued, and conformity is also assessed within ISO 22301 certification, where risk management is part of the audit.
There is also certification of persons — risk manager: a certificate issued to an individual after an examination by a body for the certification of persons, independently of training. That certifies the person, not the system, and evidences the competence of whoever runs risk management in your organisation.
We do both: we establish the system to ISO 31000 and prepare the evidence of conformity, prepare the organisation for ISO 22301 certification, and train the person taking on the risk manager role.
Resilience team
Set up to implement resilience measures, manage risks and remediate incidents at the level of the entity itself. The team takes over coordination when a disruption occurs.
Coordinator — six months
A resilience officer is appointed from among employees within six months of the Government decision. Requirements: residence in Montenegro, at least level VIII qualification, medical fitness, no criminal record, professional training and a passed professional examination. The examination is waived for people with level VIII and five years of work in critical infrastructure protection, physical and technical security or protection and rescue. Their details go to the Ministry within 15 days, any change within five days.
Risk assessment
An assessment against threats that could disrupt the provision of essential services. Under Article 29 it must be aligned with the national and sector risk assessments, not only with your own internal view.
Resilience plan — nine months
The plan contains the risk assessment and measures for prevention, protection, response and recovery. It requires the Ministry\u2019s approval within nine months of the Government decision. If the Commission issues instructions, they must be acted on within 60 days. The plan is reviewed at least every four years and whenever circumstances change.
Who may draft the plan
An employee with level VIII qualification and at least five years of experience in physical and technical security, critical infrastructure protection, protection and rescue or resilience, in the sector concerned. If you have no such employee, drafting may be contracted out to a company or sole trader that does.
ISO 31000 and ISO 22301 certificates
The act requires a critical entity to hold a certificate to the Montenegrin standard for risk analysis and management MEST ISO 31000 and to the business continuity standard MEST ISO 22301. Lacking either is a separate offence.
Risk management in five points
Analysis of disruption risk; procedures for early detection, response and mitigation of incidents; a business continuity plan to MEST ISO 22301; internal acts governing the establishment, development and maintenance of infrastructure management; and physical and technical protection of facilities.
Stress test — at least once a year
Resilience is stress-tested at least annually. The Ministry may order an exercise, set its type, method and deadlines and supervise it directly. The resilience plan is revised on the basis of the exercise results.
Incident — 24 hours and 30 days
A significant incident is reported to the Ministry and the sector ministry without delay and no later than 24 hours from becoming aware of it. A detailed report follows within 30 days, covering the description, the impact on the essential service, the consequences, the measures taken and an assessment of cross-border effects.
Register data — 15 days
Data for the Sector Register is submitted within 15 days of receiving the notification: name, seat, registration and tax number, responsible person and coordinator, official electronic address, contact telephone and details of the activity. Any change is reported within 15 days.
Staff training
Employees are trained in risk management and resilience under a programme drawn up by the Ministry. The statutory training itself is delivered by a licensed adult education provider (Article 25).
Penalties
Penalties are split across three articles by severity. A fine may be accompanied by a ban on performing the occupation, activity or duty in the field of resilience for three to six months.
EUR 3,000 to 20,000
For 23 failures: no resilience team, no risk assessment, no resilience plan or no approval within nine months, no coordinator within six months, a coordinator who does not meet the requirements, no MEST ISO 31000 certificate, no MEST ISO 22301 certificate, no annual stress test, no incident detection procedures, no business continuity plan, no physical and technical protection measures. Responsible person: EUR 500 to 2,000.
EUR 2,500 to 20,000
Incident not reported within 24 hours, detailed report not submitted within 30 days, no measures taken to remove the consequences, no cooperation with the Ministry in managing the incident. Responsible person: EUR 500 to 2,000.
EUR 1,000 to 10,000
Register data not submitted within 15 days, changes not reported, failure to act on an inspector\u2019s order or denying access to the resilience plan and documentation. Responsible person: EUR 300 to 1,500.
What we do for critical entities
The documents and systems the law asks for by name. Click a service and it will be ticked in the form at the bottom of the page.
Risk assessment and analysis
A risk assessment against the threats that could interrupt your essential service, aligned with the national and sector risk assessments — in a form that withstands inspection and feeds into the resilience plan.
Request a quote Articles 20–22Resilience plan preparation
Plan structure, risk assessment, prevention, protection, response and recovery measures, preparation for the Ministry\u2019s approval and for acting on Commission instructions within 60 days. The plan must be signed off by a person meeting Article 22 requirements — we will check together who that is in your organisation.
Request a quote Article 17(9)ISO 31000 certification and conformity
A risk management framework, policy and process to MEST ISO 31000, with a risk register and a review procedure — in a form that evidences conformity with the standard. We prepare the system and the documentation; certification, where applicable, is carried out by an independent certification body.
Request a quote Article 17(10)ISO 22301 certification — business continuity
Business impact analysis, recovery strategies, continuity plans and testing to MEST ISO 22301. The same system covers the continuity plan required by Article 29(3).
Request a quote Article 29(2)Incident procedures
Early detection, response and mitigation, with clear roles — who determines, who reports, who escalates. Includes the 24-hour reporting procedure and the template for the 30-day detailed report.
Request a quote Article 28Stress test and resilience exercise
Scenarios, preparation and delivery of the exercise, minutes, findings and revision of the resilience plan on the basis of the results — so that the annual obligation does not stay on paper.
Request a quote Articles 17 & 23Resilience team and coordinator
Setting up the team, defining the coordinator\u2019s duties, checking whether your candidate meets the Article 23 requirements and preparing them for the professional examination, which is sat before a Ministry board.
Request a quote Article 29(4)Infrastructure management acts
Internal acts governing the establishment, development and maintenance of critical infrastructure management and the provision of essential services.
Request a quote Article 29(5)Physical and technical protection
Review of existing measures and a plan for the gaps — access control, surveillance, zoning, security procedures — to prevent unauthorised access and deliberate damage.
Request a quote Article 17(7)In-house resilience training
Training for staff on risk management, incident response and roles in the resilience team, with records. The statutory training is delivered by a licensed adult education provider — we prepare candidates and run the in-house sessions.
Request a quote Articles 41–42Register data
Preparing and checking the data for the Sector Register of Critical Entities and the procedure for reporting changes within 15 days.
Request a quote Article 3Boundary with information security
If you are also covered by the Information Security Act, some obligations overlap and some are expressly excluded. We draw the line so you do not do the same work twice.
Request a quoteWho does what
Certificates to MEST ISO 31000 and MEST ISO 22301 are issued by an independent certification body — we prepare the system and the documentation for that audit and stand with you during it. The training under Article 25 is delivered by a licensed adult education provider — we prepare the candidate and run the in-house sessions. The coordinator’s professional examination is sat before a board appointed by the Minister of the Interior.
Frequently asked questions
Are we critical infrastructure?
You cannot know this in advance with certainty and nobody can guarantee it. Being in one of the eleven sectors of Article 13 is a condition but not a sufficient one — you become a critical entity only by the Government decision under Article 16(3), after the sector ministry has identified you against the Article 15 criteria. Send us a description of your activity and the essential service you provide and we will go through the criteria with you.
When do the deadlines start running?
From the Government decision under Article 16(3), not from the day the written notification reaches you. The coordinator is appointed within six months, the resilience plan with the Ministry\u2019s approval within nine months, and the Sector Register data within 15 days of receiving the notification.
Certification to ISO 31000 — how is conformity with the standard evidenced?
Article 17(9) requires a certificate to the Montenegrin standard for risk analysis and management, MEST ISO 31000. The term "certification" is used broadly here and refers to conformity with the standard. ISO 31000 is a guidance standard: it is applied in full and its application is evidenced through a risk management policy, a risk register, acceptance criteria and records of review. For such a system a statement of application and conformity with ISO 31000 is issued, and conformity is also assessed within ISO 22301 certification, where risk management is part of the audit. There is also certification of persons — risk manager: a certificate issued to an individual after an examination by a body for the certification of persons, independently of training.
Who may draft the resilience plan?
Under Article 22, an employee of the critical entity with at least a level VIII qualification and five years of work experience in physical and technical security, critical infrastructure protection, protection and rescue or resilience, in the sector for which the plan is being drafted. If you do not employ such a person, the act expressly allows the drafting to be contracted out to a company, another legal entity or a sole trader that does.
How does this relate to the Information Security Act?
Separately. Under Article 3, this act does not apply to measures and obligations in the field of cyber and information security — those are governed by a separate act. For entities covered by both, the Information Security Act applies to the protection of information and communication systems.
What if we are only a supplier to a critical entity?
The act places obligations on the critical entity, not on its suppliers. In practice, however, critical entities pass continuity, incident handling and protection requirements down to suppliers through contracts. If you work for an operator in energy, water supply or health care, expect those requirements to arrive contractually rather than by statute.
Some of our references
More than 400 organisations in Montenegro and the region have gone through implementation with us — from banks and public bodies to manufacturing, IT, laboratories and hospitality.
These are only some of our clients. More about us →
Send an enquiry — we will go through the criteria together
This is specialised ground and it is not settled by a questionnaire. Describe your activity, the essential service you provide and whether you have already been notified — we will tell you exactly what is coming, what we can do and what has to go through others. Call us or send an enquiry — we reply within 24 hours.