Introduction
The contemporary world is becoming increasingly digitalized, with many aspects of daily life integrated into smart devices and other technological platforms. This digital transformation has brought about global connectivity, improved access to financial services, and facilitated cross-border transactions, among others. However, the fast-paced digitalization has also created major cybersecurity attacks, which disrupt or interrupt essential services, steal data, and otherwise compromise information systems, thereby compromising the confidentiality and security of networks. Such incidents may endanger individuals and entities by exposing their financial or other information and disrupting access to critical services.
At the national level, cyberattacks against financial institutions, telecommunications networks, and other critical infrastructure may disrupt economic activity and threaten a country’s financial and economic stability. That is apparently the reason why the Ethiopian National Cybersecurity Policy recognizes cyberattacks as a huge threat to the country’s economic and financial stability, prompting the government to enact specific legislation aimed at reducing cybersecurity vulnerabilities and protecting critical infrastructure. Accordingly, the government has enacted Critical Infrastructure Cybersecurity Proclamation No. 1426/2026 (“Critical Infrastructure Proclamation”), which has been published in the Federal Negarit Gazette in July 2026.
The Proclamation was tabled to parliament against background of frequent and growing cyberattacks in Ethiopia in recent years. The rise to growing adoption of digital tools with minimal safeguards has contributed to such growing attacks. While the Computer Crime Proclamation No. 958/2016 provided for punishment of offences against cyberattacks, there was no sufficient law that would set out how institutions should prevent, respond to, and recover from cyber incidents. ,
This legal update examines the Critical Infrastructure Proclamation, with particular emphasis on critical infrastructure cybersecurity, obligations of critical infrastructure owners and consequences of non-compliance.
- Scope of the Critical Infrastructure Proclamation
The Critical Infrastructure Proclamation applies to designated critical infrastructure of the country located within or outside the territory of Ethiopia and to persons providing cybersecurity products and services, including any hardware, software, and algorithms offered to protect information from unauthorized access. The Proclamation has extraterritorial effect as it extends its application to designated Ethiopian critical infrastructure located abroad. Accordingly, owners/operators of such infrastructure may be required to comply with the Proclamation despite operating outside Ethiopia in so far as such infrastructure is designated as critical as per the criteria set out under Article 4 of the Proclamation.
- What is Critical Infrastructure?
The Critical Infrastructure Proclamation defines critical infrastructure as a public or private infrastructure whose disruption due to a cyberattack will cause a significant negative impact on national security or interest. Article 4(1) of the Proclamation further lists the following sectors as critical infrastructure: information technology and communication, finance, security and safety, transport, education, health, water and energy, government services, disaster management services, agriculture, trade, and industry.
In addition, by virtue of Article 4(2) and (3), the Information Network Security Administration (the “Administration”) may identify other institutions/sectors as critical infrastructure if a cyber-attack against them would threaten the national economy, national security, peace and stability, social interaction, and daily life of the community and damage to other sectors as well due to their interconnectedness with such sectors. The Administration is the lead regulatory authority mandated to identify and oversee critical infrastructure, establish and enforce cybersecurity standards, conduct audits and security assessments, license and certify cybersecurity providers, and take enforcement measures to safeguard critical infrastructures, among others.
- Obligations of Owners of Critical Infrastructure
As per the Critical Infrastructure Proclamation, owners or persons managing critical infrastructure are required to comply with the following obligations, among others:
- Prior to integration, obtain security clearance for new or upgraded information and communication technology systems acquired through purchase, donation, development, or any other means, in accordance with the system established by the Administration;
- Maintain and renew the cyber audit and cyber inspection and evaluation certificate issued by the Administration;
- To take appropriate corrective action in accordance with the findings of the Administration’s cyber audit or cybersecurity inspection and evaluation;
- Develop and implement its own cybersecurity framework based on policies and laws issued by the Administration;
- To employ cybersecurity professionals who have obtained professional certificates issued or recognized by the Administration;
- To notify cybersecurity incidents.
Owners may fulfill these obligations either in their own capacity or by delegating them to licensed persons who provide cybersecurity products and services.
- Consequences of non-compliance
Failure by critical infrastructure owners to comply with the obligations under the Critical Infrastructure Proclamation has both administrative and criminal liabilities. Depending on the type of violation, the fine could range from 300,000 to 2,000,000 Birr if the violation was intentional, while the fine would be reduced to no less than one-half if it was due to negligence. This fine will be tripled if the offence occurs more than once. However, if the offence happens for the first time and no damage has occurred, the Administration may waive the fine by giving a warning notice to take appropriate corrective measures. A critical infrastructure owner who intentionally violates the provisions of the Proclamation may also be subject to criminal liability ranging from simple to rigorous imprisonment.
