In The Debrief, our Practice Leaders across CEE share updates on recent and upcoming legislation, consider the impact of recent court decisions, showcase landmark projects, and keep our readers apprised of the latest developments impacting their respective practice areas.
This House – Reached an Accord
AECO Law Partner Cagri Cetinkaya turns to developments in Turkiye’s data protection landscape, highlighting newly published amendments to the Regulation on Private Health Insurance. As he explains, “the amendments to the Regulation on Private Health Insurance were published in the Official Gazette on October 20, 2025, introducing changes to the conditions governing the processing of health data. With the amendments, the data processing legal grounds will need to be reassessed. Furthermore, in policy transfer processes, policyholder information shall be obtained through the Insurance Information and Monitoring Center, and may not be exchanged directly between insurance companies.” As a result, Cetinkaya says that health insurance companies operating in Turkiye “should review the amendments on changes to the legal grounds of data processing and new restrictions on information and document requests.”
Wolf Theiss Poland Senior Associate Anna Panek outlines Poland’s evolving labor framework. “From 2026, new rules for calculating employment tenure will come into force in Poland, significantly impacting employee entitlements,” she says, adding that the reform “expands the range of professional activities considered when determining employment tenure.”
“Currently, employment tenure is primarily based on periods of work under a formal employment relationship (e.g., employment contracts),” Panek continues. “Under the new rules, other forms of professional activity will also be taken into account, provided, among other conditions, that social security contributions have been paid, or the individual was covered by pension and disability insurance. The aim of the reform is to ensure fairer treatment of various professional groups – full-time employees, self-employed individuals, and those working under civil law contracts – by including their professional activity in the calculation of employment tenure. This tenure directly affects employee entitlements such as annual leave duration, seniority bonuses, and jubilee awards (if such bonuses are provided for in internal workplace regulations).”
Panek emphasizes that the changes will take effect on “January 1, 2026 – for the public sector,” and “May 1, 2026 – for the private sector.” Under the new regulations, the following periods will be included in employment tenure: “running a non-agricultural business, work performed under civil law contracts, e.g., contracts of mandate, B2B contracts, and agency contracts (excluding contracts for specific work), and documented employment abroad. These periods will be recognized on a certificate issued by the Social Insurance Institution or, in certain cases, other documents confirming professional activity. Employees will have 24 months to submit the relevant documentation. After this deadline, employers will no longer be obligated to include these periods in the employee’s tenure.” Finally, she says that “the new rules will require employers to update internal regulations, recalculate tenure, adjust HR and payroll systems, maintain additional documentation, and account for a potential increase in employment-related costs.”
Law Office Lazarov Managing Partner Dragan Lazarov describes recent amendments affecting financial instruments, prospectuses, and transparency rules in North Macedonia. “In September 2025, the Official Gazette of the Republic of North Macedonia published the Law Amending the Law on Financial Instruments and the Law Amending the Law on Prospectus and Transparency Obligations of Securities Issuers,” he notes. “According to these amendments, the implementation of both laws has been postponed, with their provisions scheduled to take effect on October 1, 2026.” Lazarov adds that “these legislative updates extend compliance deadlines for financial institutions and defer certain transparency obligations, thereby providing market participants with additional time to adjust to the evolving regulatory framework.”
“Under the amendments to the Law on Financial Instruments, the existing acts of the Central Securities Depository AD Skopje and the Macedonian Stock Exchange AD Skopje, which were previously adopted based on the Law on Securities, will remain in force until new acts are enacted under the updated legal framework,” Lazarov continues. “The amendment further extends the compliance period to 18 months from the start of the law’s implementation for brokerage houses, licensed banks, investment advisory firms, management companies of investment funds, and other entities providing investment services.” Additionally, “the Law on Prospectus and Transparency Obligations of Securities Issuers introduces a more streamlined and structured approach to the preparation of prospectuses by allowing them to consist of multiple documents. Its main objectives are to enhance investor protection, strengthen both domestic and international investor confidence, and promote greater participation in the capital market, thereby contributing to the overall growth and stability of the national economy.”
This House – The Latest Draft
The key development in the area of cybersecurity in Poland over the past month, according to Addleshaw Goddard Poland Associate Malgorzata Czubernat, “has been the adoption by the Council of Ministers of the long-awaited draft amendment to the Act on the National Cybersecurity System (UKSC). The draft implements Directive (EU) 2022/2555 (NIS2) on measures for a high common level of cybersecurity across the Union and has now been submitted to the Sejm for parliamentary debate.” This marks a “significant acceleration in the legislative process, with the Ministry of Digital Affairs indicating that the law is expected to be passed before the end of 2025. Once enacted, entities covered by the amended UKSC will have only six months to ensure compliance with the new requirements.”
Czubernat explains that “the amendment introduces two new categories of regulated entities – ‘essential entities’ and ‘important entities’ – replacing the previous framework of ‘operators of essential services’ and ‘digital service providers.’ It also broadens the scope of sectors covered, extending the regulation to ICT service management, drinking water supply and distribution, energy, wastewater management, transport, digital service providers, and the production, manufacturing, and distribution of chemicals.”
Key obligations under the draft, according to Czubernat, “include the implementation of an information security management system, regular risk assessments, incident reporting within 24 hours (initial) and 72 hours (detailed), and the adoption of appropriate technical and organizational measures. Non-compliance may result in administrative fines of up to EUR 10 million or 2 % of turnover for essential entities, and EUR 7 million or 1.4 % for important entities. Given the broad applicability, an estimated 38,000 organizations will fall under the amended regime in Poland.”
The Verdict
Peterka & Partners Partner Adela Krbcova highlights a recent decision impacting the Czech labor landscape. “In an November 2025 decision, the Czech Supreme Court clarified that occupational health and safety (OHS) obligations extend not only to an employer’s own employees and those of another employer providing tasks on-site, but also to any individuals present at the workplace with the employer’s knowledge,” she notes. “The Court held that the duty of ensuring OHS is not limited to places where employees perform their work, but covers all places and premises under the employer’s control where employees may be exposed to potential threats to their life or health. Thus, all spaces where the employer carries out its activities through its employees are considered to be workplaces, including places and premises related to such activities (e.g., corridors, staircases, and roads), if they are under the employer’s control and if any individuals (in addition to its employees), who are present there with the employer’s knowledge, are exposed to potential threats to their life or health.” According to Krbcova, “this applies regardless of whether there is a contractual or other relationship between such individuals and the employer. Consequently, this could include an individual entrepreneur hired by the employer’s supplier, in which case the employer would have OHS duties towards them.”
“An energy distribution company learned this the hard way when the courts decided that it was liable for violating its OHS duties towards an independent contractor of its cleaning services supplier,” Krbcova adds. “The contractor was electrocuted and fell from a ladder while washing windows in an unlocked transformer that was only to be entered accompanied by a security officer. The employer’s objections that the individual had entered the transformer by themselves, had performed the cleaning without the employer’s instructions, was not an approved subcontractor, and that the OHS duties had to be assumed by the supplier, were dismissed.”
LCF Law Group Partner Iryna Kobets reports that with the invasion of Ukraine, “approximately 30% of Ukraine’s solar power plants and nearly 80% of its wind generation capacity found themselves located in temporarily occupied territories.” She notes that despite the occupation, “many renewable energy facilities continued to generate electricity and feed it into Ukraine’s unified grid. Correspondingly, payments for this electricity continued to be made. In 2023, however, due to legal uncertainty regarding whether power plants located in occupied territories remained part of Ukraine’s integrated power system, payments to renewable energy producers in those areas were suspended.” She adds that “this gave rise to a series of disputes regarding payments for electricity generated in 2022-2023, which have been litigated in Ukrainian courts for several years. The Supreme Court had previously indicated that the ‘annulment’ of metering data for past periods lacked legal grounds, and therefore, recalculation of payments was unwarranted.”
On October 3, 2025, “the Joint Chamber of the Commercial Cassation Court of the Supreme Court, in case No. 908/1162/23, issued a decision that may significantly reshape the approach to this category of disputes,” Kobets reports. “The Supreme Court concluded that the legal status of a temporarily occupied territory does not depend on whether (or when) a competent authority has formally adopted a decision recognizing it as such. What matters is whether Russian armed forces and occupation administration have established and exercised effective, or general, control over that territory with the clear intention of establishing an occupation administration.” According to her, “this ruling may lead to a reconsideration of payments previously made to solar and wind power plants for electricity generated during 2022-2023, and may reshape ongoing and future litigation involving renewable energy facilities located in temporarily occupied territories.”
In the Works
CMS Sofia Managing Partner Kostadin Sirleshtov outlines upcoming developments in Bulgaria’s energy sector, covering natural gas exploration and storage initiatives. “In the field of natural gas, OMV Petrom and NuMed Energy received all critical authorizations from the Bulgarian Government for the start of the three new wells in Han Asparuh offshore block in the Black Sea,” Sirleshtov notes. “The results of this campaign are expected in early 2026. In the fields of electricity production and storage, Bulgaria is focused on having a few gigawatts of BESS installed by the middle of 2026, and as a result, several investors (both local and international) announced successful financing of their respective projects.”
Regulators Weigh In
“Umit Onal has been appointed as the first president of the Cybersecurity Presidency, which was legally established in January 2025,” Cetinkaya reports. “Some of the key steps are expected to shape the forthcoming period: (i) the completion of the organizational structuring, (ii) the convening of its decision-making body, Cybersecurity Council, to determine the policy framework, and (iii) publication of secondary regulations, within a one-year transition period that started in March 2025.” In addition, he notes that “the Cybersecurity Council is expected to identify critical sectors in line with the EU approach. Such companies will be subject to more stringent requirements under the new Cybersecurity Law.”
In Related News
Sirleshtov points to recent developments involving sanctions, explaining that “the Lukoil sanctions, which were announced in November 2025, caught the Bulgarian authorities by some surprise despite the fact that Lukoil was trying to find a buyer of the largest Bulgarian industrial company – the Burgas refinery – for over a year now. With a few ongoing authorizations underway, it is expected that the global sale of Lukoil will unlock some of the existing deadlock.”
JPM & Partners Senior Partner Jelena Gazivoda highlights Serbia’s energy sector’s mounting pressures associated with sanctions and supply risks. “The second week of November 2025 is increasingly being referred to as ‘Decision Week’ in the Serbian energy sector. Accordingly, the most pressing issue in Serbia’s energy sector remains the situation surrounding NIS and the sanctions imposed on it, which have now been in force for a full month. After eight postponements of the sanctions’ implementation, Serbia continues to search for a sustainable solution.”
Gazivoda adds that “sanctions against the Russian oil company Lukoil are set to take effect on November 21. These measures have created additional pressure not only in Serbia but also in neighboring countries – Bulgaria, Romania, and Hungary. Following the US announcement, Lukoil attempted to sell its operations to Sweden’s Gunvor Group, but the proposal was rejected by the US due to Gunvor’s past ownership ties to a sanctioned Russian oligarch. After a strong reaction from Washington, Gunvor withdrew its offer. In response, Bulgaria’s parliament acted swiftly, passing legislation that empowers the government to take operational control of refineries, approve their sale, or nationalize plants if necessary – following Germany’s precedent with the Rosneft refinery. Bulgaria also reinforced security measures to safeguard energy infrastructure and prevent incidents ahead of any planned takeover, especially after recent accidents: a fire at Hungary’s MOL refinery and an explosion at Romania’s Petrol-Lukoil refinery. Romania, facing its own challenges, has requested a postponement of sanctions implementation and is increasingly considering nationalization as a last-resort measure. Hungary, on the other hand, secured a one-year exemption from US sanctions on oil and gas imports by committing to purchase approximately USD 600 million worth of US liquefied natural gas and gradually diversifying its energy sources.”
Meanwhile, Gazivoda reports that Serbia is under growing pressure to find a solution as time runs short. “The Pancevo refinery reportedly has crude oil reserves sufficient for processing only until November 25. Officially, no solution has been announced, though there are reports that the Russian side is prepared to transfer control of NIS to a third party. The Russian party has already submitted a request to the US Office of Foreign Assets Control for an extension of its operating license, citing ongoing negotiations with this potential third-party buyer. If such a transfer does not materialize, Serbia faces two unfavorable options: nationalization or bankruptcy of NIS. The government continues to seek an acceptable and sustainable solution, while OFAC is expected to insist on one that is concrete, transparent, and durable, ensuring the exclusion of Russian operational control and the ultimate change of ownership in NIS.”
This article was originally published in Issue 12.10 of the CEE Legal Matters Magazine. If you would like to receive a hard copy of the magazine, you can subscribe here.
