Virtual assistants welcoming citizens to bank portals and state agency platforms have become a ubiquitous reality across the Western Balkans. However, behind the seamless “Welcome, I am your virtual assistant” interface lies a regulatory vacuum.
A comprehensive regional investigation by Radio Free Europe (RFE) has revealed that not a single Western Balkan country has enacted legislation to regulate Artificial Intelligence (AI). Public administration workers are actively feeding data into external platforms like ChatGPT, Copilot, and Gemini to translate texts, organize data, and draft official paperwork with virtually zero technical oversight or consideration for personal data protection.
The Regional Landscape: Fragmentation and Risk
While Member States of the European Union have entered the execution phase of the groundbreaking EU AI Act, the Western Balkans remain exposed, stuck in prolonged drafting phases or reliant on non-binding ethical guides.
[EU AI Act: Rigid Risk Tiers & Mandatory Compliance]
│
▼ (Lagging alignment pipelines)
┌────────────────────────────────────────────────────────┐
│ WESTERN BALKANS REGULATORY VOID │
├───────────────┬────────────────┬───────────────────────┤
│ Country │ Current Status │ Public Sector Reality │
├───────────────┼────────────────┼───────────────────────┤
│ Bosnia & Herz.│ No Draft Laws │ Uncontrolled usage │
│ Kosovo │ Assessing Act │ e-Kosova 2.0 testing │
│ Montenegro │ Strategy Stage │ NIS2 Law implemented │
│ Serbia │ Draft Phase │ Active Chatbot network│
└───────────────┴────────────────┴───────────────────────┘
Bosnia and Herzegovina: Complete Institutional Chaos
Bosnia and Herzegovina does not possess even a baseline draft law to regulate AI tools within its layered public institutions.
- The Bureaucratic Silo: RFE’s tracking indicates that individual state organs are establishing their own improvised firewalls. The Prosecutor’s Office of BiH restricted personnel to IT-approved tools, strictly forbidding them from inserting criminal case files, personal details, or unreleased draft acts into public AI infrastructure.
- The Federal Split: Neither the Federation of BiH nor Republika Srpska have systemic regulations for their collective 28,000 public officials. The IT Agency of Republika Srpska admitted that elements of AI are already actively running inside state servers to automate administrative pipelines.
“Banning AI is impossible; it’s like banning someone from speaking a language they know. But it must be legally bound,” warned Enes Čengić, an IT judicial expert in BiH. He cautioned that data processed by public tools remains cached indefinitely on external global servers.
Kosvo: Testing e-Services Ahead of Legislation
Kosovo’s e-Government Strategy 2023–2027 positions advanced data analytics and AI at the front of public sector digitization.
- The Sandbox: State developers are actively piloting AI tools within the e-Kosova 2.0 ecosystem and automated processing models within the Tax Administration of Kosovo (ATK). Conversely, the State Prosecutor of Kosovo maintained that its investigators utilize no AI components whatsoever.
- The Compliance Hurdle: Throughout 2026, Pristina initiated structural evaluations to map out how the country can harmonize its legal framework with the EU AI Act and GDPR. Krenare Sogojeva Dermaku, Commissioner for Information and Privacy, emphasized that current data protection laws handle AI violations under general data breach clauses, lacking targeted algorithmic boundaries.
Montenegro & Serbia: Advanced Deployment, Fragile Oversight
Montenegro and Serbia have embedded conversational AI deep into public facing state systems, though formal legal accountability remains missing.
- Montenegro’s Strategy: Podgorica is currently formulating its AI Development Strategy 2026–2030 alongside the World Bank. While AI rules are still being compiled, Montenegro has successfully upgraded its security layer by executing a new cybersecurity law completely synchronized with the EU’s NIS2 Directive.
- Serbia’s Commercial Chatbot Deficit: Belgrade has deployed highly operational AI chatbots across the Tax Administration, Business Registers Agency (APR), and the e-Uprava portal.
- The Financial Cost: Procurement records exposed by RFE show that the Tax Administration’s virtual assistant alone cost Serbian taxpayers €196,000 during 2026. Yet, no state department could clarify how citizens’ sensitive personal queries within these chats are legally insulated.
The Race Against the 2026 Target
Serbia is currently closest to passing targeted legislation. A dedicated working group—featuring inputs from the National Alliance for Local Economic Development (NALED)—is finalizing a draft law modeled strictly after the EU AI Act.
According to NALED’s Irena Gjorgjeviq, the incoming bill will segment AI systems into four specific risk levels: Prohibited, High-Risk, Medium-Risk, and Minimal-Risk. It will bind both domestic tech startups and foreign enterprise providers operating inside the Serbian market by the end of 2026.
However, civil society watchdogs remain highly skeptical of institutional loopholes. Ana Toskiq Cvetinoviq from Partneri Srbija raised alarms that the upcoming Serbian draft completely exempts the state defense sector from algorithmic accountability, warning that without a centralized registry of state-deployed AI tools, internal misuse will continue to fly completely under the radar.
