TerraLex AI Guide

Serbia does not have a dedicated, binding AI law in force as of February 2026

Serbia currently regulates artificial intelligence primarily through the application of general legislation rather than a dedicated AI framework.

At the constitutional and institutional level, the Constitution of the Republic of Serbia guarantees the protection of personal data and consumer protection against violations of privacy.

The Personal Data Protection Act (conforming GDPR) represents the most relevant regulatory instrument, as it applies to all AI systems that process personal data, covering any form of automated processing. In particular, it grants individuals the right not to be subject to decisions based solely on automated processing, including profiling, where such decisions produce legal effects or significantly affect their position. This provision effectively limits the autonomy of AI systems in sensitive areas such as employment, credit assessment, or healthcare. Exceptions are permitted only under strict conditions, for example where the data subject has provided explicit consent, and even then the controller must ensure safeguards such as the right to human intervention and the right to challenge the decision.

In addition, the Law on Obligations provides the general basis for liability for damage caused by AI systems, notably through the regime of strict liability for damage arising from a dangerous object or dangerous activity. Autonomous AI technologies, such as self-driving vehicles, could likely fall within this category, although the legislation does not clearly determine which actor, such as the developer, manufacturer, owner, or operator, would qualify as the liable party.

However, a comprehensive legislative and soft-law framework is taking shape:

Strategy for the Development of Artificial Intelligence 2025 – 2030 adopted by the Government of Serbia in January 2025, building on the earlier Strategy 2020–2025 adopted in 2019. The document explicitly highlights the need to prepare draft legislation and accompanying by-laws that will regulate the use of artificial intelligence in the market. As a key performance indicator, it sets the objective of achieving the “full implementation of the Artificial Intelligence Act” by the end of 2027. This clearly signals the planned adoption of a dedicated legal framework that will specifically govern artificial intelligence.

Ethical Guidelines for the Development, Implementation and Use of Reliable and Responsible AI adopted by the Government on 23 March 2023. While not legally binding, they establish the foundational principles, conditions and self-assessment methodology for responsible AI and are explicitly referenced in the 2025–2030 Strategy. The Guidelines also include an AI System Assessment Questionnaire, a self-assessment tool for individuals and organizations that develop or use AI to check compliance with ethical requirements.

Belgrade Ministerial Declaration on Artificial Intelligence adopted in December 2024 during Serbia's presidency of the Global Partnership on Artificial Intelligence (GPAI) and endorsed by 44 EU and GPAI member states. The Declaration signals a commitment to human-centric AI, reducing AI risks and fostering international cooperation.

Because Serbia lacks a binding AI law, no statutory definition of "AI" or "AI system" is currently in force. Nonetheless, the existing strategic and soft-law instruments refer to and build on internationally recognized concept.

The Strategy and Ethical Guidelines rely on the OECD's conceptualization of AI. The OECD defines an AI system as "a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments".

The Strategy also makes references to the EU AI Act, defining artificial intelligence system „A machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments“. On the other hand, the Ethical Guidelines refer to the definition developed by the Independent High-Level Expert Group on Artificial Intelligence established by the European Commission.

In addition, The Ethical Guidelines and Strategy refer to the OECD's risk classification framework, distinguishing between AI systems of: (i) unacceptable risk; (ii) high risk; (iii) limited risk; and (iv) minimal risk, mirroring the EU AI Act approach.

Serbia’s regulatory approach to artificial intelligence, reflected in the Strategy and Ethical Guidelines, is proactive, comprehensive and strongly human-centred. The Strategy envisages the establishment of a flexible and comprehensive legal and institutional framework that will enable the safe, secure and responsible development and deployment of AI technologies while keeping pace with rapid technological change, emphasizing alignment with European and international standards, as well as active participation in global initiatives related to trustworthy AI.

Because no binding AI law is yet in force, there is no formal definition of covered actors under AI-specific rules. Under the existing framework. The Strategy addresses obligations and targets for public authorities, public institutions, and the private sector broadly. Key stakeholders include state authorities and regulatory bodies, companies and developers, research and academic institutions, individuals affected by AI systems, and international organizations, reflecting a multi-stakeholder and human-centred approach to AI governance.

Several horizontal laws in Serbia are tied to use of AI:

• Consumer Protection Act;
• Copyright and Related Rights Act;
• Education laws;
• Electronic Commerce Act
• Electronic Communications Act;
• Information Security Act (2016, amended in 2025, NIS2-inspired);
• Innovation Activity Act;
• Labor Act;
• Patents Act;
• Personal Data Protection Act (2018, GDPR-aligned);
• Prohibition of Discrimination Act;
• Tax legislation.

Since Serbia has not yet adopted a dedicated AI law, there is no defined territorial scope specific to AI regulation.

The Strategy states that it applies throughout the entire territory of the Republic of Serbia and is intended to cover all relevant stakeholders, including state institutions, business entities, the academic community, and citizens. On the other side, the Ethical Guidelines apply as soft-law recommendations to entities operating within the Republic of Serbia, primarily targeting state bodies and holders of public authority.

In regard to this, Personal Data Protection Act applies not only to controllers and processors established in Serbia but also to foreign entities whose processing activities relate to offering goods or services to, or monitoring the behavior of, data subjects in Serbia. If the Serbian AI Act follows EU approach, it will also have extraterritorial application.

The Strategy identifies the following priority sectors for AI development and application:

• Medicine and biotechnology: AI for diagnostics, therapy, and health data management
• Education: AI integration at primary, secondary, and tertiary levels; lifelong learning
• Agriculture: Precision agriculture and AI-driven food production
• Information security/cybersecurity: AI for threat detection and resilience
• Public sector services: AI-powered e-government, administrative decision-making, and public service optimization
• Automotive/autonomous mobility: Testing of autonomous vehicles on public roads

The Ethical Guidelines' concept of high-risk AI systems encompasses cross-sectoral applications including: biometric identification, critical infrastructure, employment, access to essential services (including financial services), law enforcement, migration and border control, and administration of justice.

As no AI-specific law has been adopted, there is no designated AI regulatory authority with enforcement powers.

Currently, the supervision and enforcement of AI-related regulation in Serbia are distributed among several public authorities, with the Commissioner for Information of Public Importance and Personal Data Protection acting as the key supervisory authority for data protection aspects, and the Ministry of Science, Technological Development and Innovation serving as the main strategic policymaker. The Office for Information Technologies and eGovernment plays an operational role in data preparation and the development of e-government systems.

The leading institution responsible for coordinating the implementation of the AI Strategy and the drafting of the AI Act is the Ministry of Science, Technological Development and Innovation.

In 2024, the Council for Aritificial Intelligence was established by the Government of the Republic of Serbia in 2024 as a strategic advisory and coordinating body. The Council is chaired by the Advisor to the Prime Minister and includes representatives from government, academia, and industry. Its mandate covers: (a) coordinating activities related to implementing the AI strategic framework; (b) defining and monitoring the AI action plan; (c) overseeing the drafting of the AI Act; and (d) aligning AI governance with international standards.

Several existing authorities have competences that extend to AI-related activities:

• Commissioner for Information on Public Importance and Personal Data Protection;
• Ministry of Justice;
• Ministry of Interior;
• Office for Information Technologies and Electronic Government;
• Ministry of Information and Telecommunications;
• National Bank of Serbia;
• Institute for Artificial Intelligence of Serbia;
• Intellectual Property Office

The future approach, as outlined in the Strategy, includes the adoption of a dedicated Artificial Intelligence Act and the potential establishment of new bodies for supervision and coordination, with the Council for Artificial Intelligence already playing a significant coordinating role.

The Ethical Guidelines and the Strategy currently do not prescribe direct sanctions, as they constitute public policy and non-binding instruments. However, they are important for understanding the future regulatory framework and indirectly indicate the areas in which sanctions may be introduced.

The maximum administrative fine in the Republic of Serbia, except in competition and anti-trust matters, is 2 million RSD (approximately 18.000,00 EUR), which is also the case for Personal Data Protection Act. if the same approach is followed, it highly likely that Serbian AI Act when enacted will not go above the mentioned threshold.