Anyone selling goods or services online from a Montenegrin company — a web shop, a booking site, a software subscription, a marketplace — is an "information society service provider" under the Law on Electronic Commerce (Zakon o elektronskoj trgovini). The Act is short and old, but it has been amended twice and its rules are specific: what your website must disclose, when you may send marketing e-mail, what you must tell a customer before the contract is concluded, and when you are liable for what your users upload. The information society services inspector checks the same points, and fines run to €17,000 for a company.
Sources, checked 11 September 2026: the Act as published in "Sl. list RCG" 80/2004 and amended by "Sl. list CG" 41/2010 and 56/2013, all read from the Official Gazette's own page images; the 2013 amendment also repealed the provision of the 2011 misdemeanour-fines omnibus ("Sl. list CG" 40/11, Article 111) that had touched this Act. The inspection checklist Kontrolna lista – elektronska trgovina published by the Administration for Inspection Affairs (Uprava za inspekcijske poslove), updated 20 June 2026. Consumer-contract rules for distance sales sit in the separate Consumer Protection Act ("Sl. list CG" 12/2026), which this page does not cover. General information, not advice on a specific business.
Who the Act covers — and what it leaves out
An information society service is a service provided at a distance, for remuneration, by electronic means, at the individual request of the user — the Act names internet sales of goods and services, offering data online, online advertising, search tools and services that transmit or store users' data (Article 3). The provider is any natural or legal person providing such a service (Article 3).
- No licence to start. Providing information society services is free; no special permit, approval or concession is needed (Article 6(1)-(2)). A provider registered in Montenegro has the activity designated in the register as "information society services" (Article 6(3), as amended in 2013).
- Montenegrin providers follow Montenegrin law. A provider with its seat in Montenegro must act and provide services in accordance with the Act (Article 4, as replaced in 2010).
- The EU rules wait for accession. The special regime for providers established in an EU member state, and the related powers to restrict their services, apply only from the day Montenegro joins the European Union (Article 25, as replaced in 2010, covering Articles 5, 6a, 6b and 22a).
- Excluded fields. The Act does not apply to data protection, taxation, notarial activity, representation of parties before courts, or games of chance with money stakes — lotteries, casinos, betting and slot machines — unless a special law provides otherwise (Article 2).
What your website must show
Article 7(1), as replaced in 2010, requires a provider to make the following available to users and to the competent state authorities free of charge, in a form that is directly and permanently accessible electronically:
| Item | Article 7(1) |
|---|---|
| Name (natural person) or business name (company) | item 1 |
| Residence, or seat or business unit in Montenegro, with place, street and number | item 2 |
| Other contact details for quick, direct communication, including an e-mail address | item 3 |
| Register number, or other identifier in the relevant register | item 4 |
| Name and seat of the supervisory authority, if the activity is subject to official supervision | item 5 |
| For regulated professions: the professional body, the professional title and the state that granted it, and where the professional rules can be found | item 6 |
| VAT number, if the provider is liable for VAT | item 7 |
Where prices are shown, they must be clear and unambiguous and state whether taxes, delivery and other costs are included (Article 7(2)). The inspectorate's checklist asks exactly this as its first question — whether the information is available free of charge, directly and permanently (checklist item 1, Article 7). A missing or buried imprint page is a fine (Article 24(1), item 1).
Commercial messages and marketing e-mail
Every commercial message that forms part of an information society service must be clearly identifiable as a commercial message; the person on whose behalf it is sent must be identifiable; and promotional offers such as discounts and gifts must be identifiable as such (Article 8, items 1-3). An invitation to a promotional competition or game must set out its conditions or rules clearly and unambiguously (Article 8, item 4, as replaced in 2010).
For marketing e-mail, Article 9 as amended in 2013 is strict:
- using e-mail or equivalent means to send an unsolicited commercial message is allowed only with the prior consent of the person it is addressed to, in accordance with the electronic communications legislation (Article 9(1));
- unsolicited commercial messages must be clear and recognisable as such immediately on receipt (Article 9(2));
- a provider sending unsolicited commercial messages by e-mail must keep a register of users who have said they do not want them (Article 9(3)), and may not send those users such messages (Article 9(4)).
The inspectorate checks all three: whether messages were sent without prior consent, whether the opt-out register exists, and whether messages were sent to people on it (checklist items 2-4). Each is a separate item in the fines provision (Article 24(1), items 2 to 4).
Before the customer clicks "buy"
Before a contract is concluded, the provider must give the prospective user, free of charge and in a clear, understandable, unambiguous and durable way (Article 14(1), as amended in 2010):
- the steps to be followed to conclude the contract;
- the contractual terms;
- the general terms of business, if they form part of the contract;
- the languages offered for concluding the contract;
- the codes of conduct the provider follows and how they can be consulted electronically;
- whether the concluded contract will be stored and whether it will be accessible.
The provider must also offer technical means to spot and correct input errors before the order is sent (Article 14(2)). Contract terms and general terms must be available in a way that lets the user store and reproduce them (Article 15). Receipt of an order must be confirmed without delay by a separate electronic message (Article 16(1)), and the contract is concluded when the offeror receives the acceptance (Article 17(1)).
Business customers can agree to depart from Articles 14(1)-(2) and 16(1), but consumers cannot (Articles 14(3), 16(2)), and none of these three pre-contract duties applies to contracts concluded by e-mail or an equivalent form of individual communication (Articles 14(4), 16(3)). The inspectorate checks the Article 14 information (checklist item 5).
Which contracts can and cannot be concluded online
A contract, offer and acceptance may be made electronically, and a contract cannot be denied validity only because it is in electronic form (Article 10). That rule does not reach (Article 11, as renumbered in 2010):
| Excluded from Article 10(3) | Article 11 |
|---|---|
| Property and marital agreements and other contracts governed by family law | item 1 |
| Contracts disposing of property that require the approval of a social welfare centre | item 2 |
| Contracts on the division of property during life, lifelong maintenance, renunciation of inheritance and other inheritance-law contracts | item 3 |
| Gift contracts | item 4 |
| Contracts transferring ownership of real estate or other rights in real estate, except leases | item 5 |
| Contracts that a special law requires in notarial form | item 6 |
| Suretyship given outside the surety's trade, business or profession | item 7 |
For a property business the line is clear: a lease of real estate may be concluded online; a sale may not. Where a signature is required, an electronic message signed with an advanced electronic signature satisfies it (Article 13, as amended in 2013).
When you are liable for your users' content
Chapter IV of the Act, renamed in 2010 "Liability of intermediary service providers", sets out the safe harbours:
- Mere conduit. A provider that only transmits users' messages or gives access to a network is not liable for their content if it did not initiate the transmission, select the data or recipient, or modify the content (Article 18, as amended in 2013).
- Caching. Automatic, temporary storage for onward transmission is covered if the provider does not modify the data, respects access conditions and update rules, does not interfere with widely recognised technology for obtaining data, and removes or disables access immediately on learning that the source has been removed or that a court or authority ordered removal (Article 19).
- Hosting. A provider storing users' data is not liable if it had no knowledge, and could not have known, of the user's unlawful activity or the unlawful data — wording extended in 2010 to damages proceedings arising from them — and removes or disables access immediately once it learns of it (Article 20(1)). The protection does not apply where the user acts under the provider's authority or control, including companies with common owners (Article 20(2)).
- Links. A provider linking to third-party information is covered on the same knowledge-and-removal test (Article 21).
There is no general duty to monitor stored or transmitted data (Article 22(1)). But a provider that stores data must notify the competent state authority, on learning of it and without delay, where there is reasonable suspicion that a user is carrying out unlawful activity or has provided unlawful data (Article 22(2), as amended in 2010 and 2013), and must hand over the data needed to detect or prosecute offences or protect third parties' rights on a court or administrative order (Article 22(3)). The inspectorate checks the notification duty (checklist item 6).
Supervision, disputes and fines
Supervision is carried out by the administration responsible for inspection affairs through an inspector for information society services (Article 23(1), as replaced in 2013), and providers must give the inspector access to computer equipment and devices and show or deliver the data and documents requested without delay (Article 23(2)). Courts must hear claims for protection of rights in this field in an urgent procedure (Article 22c), and providers and users may agree arbitration or mediation for their disputes (Article 22d).
| Who is fined | Amount (Article 24, as replaced in 2013) |
|---|---|
| The provider as a legal person | €500 to €17,000 |
| The responsible person in the legal person | €100 to €1,500 |
| An entrepreneur | €300 to €4,000 |
| A natural person who is a provider | €50 to €1,100 |
| Especially serious or repeated breaches | Additionally, a ban on carrying on the activity for three to six months |
The listed breaches are: missing Article 7 information; marketing e-mail without prior consent; no opt-out register; messages sent to people on it; missing Article 14 pre-contract information; terms that cannot be stored and reproduced (Article 15); and failure to notify the authority or hand over data under Article 22(2)-(3) (Article 24(1), items 1 to 7).
What this Act does not settle
Three questions usually come up alongside it and are governed elsewhere. Consumer rights in distance contracts — withdrawal, information on the right to withdraw, delivery and returns — are in the Consumer Protection Act ("Sl. list CG" 12/2026). Customer data and cookies-style tracking fall under the personal data protection act, which the e-commerce Act expressly excludes (Article 2); see our data protection page. And security of the systems behind the shop is now a separate statutory duty under the 2024 Information Security Act, set out in Montenegro's cybersecurity law.
A compliance check for an online business
- Is the Article 7(1) imprint — name, address in Montenegro, e-mail, register number, VAT number — on every page, free and directly accessible?
- Do prices show whether taxes and delivery are included (Article 7(2))?
- Is every marketing e-mail sent on prior consent, clearly marked, and checked against an opt-out register (Article 9)?
- Does the checkout give the six Article 14(1) items and an input-correction step before submission (Article 14(2))?
- Are terms downloadable and printable (Article 15), and is every order acknowledged electronically without delay (Article 16)?
- If users can upload content, is there a notice-and-removal process and an Article 22(2) route to the authority?
- Is any contract you plan to conclude online on the Article 11 excluded list?
How we work on these files
We review the site, the checkout and the marketing flows against Articles 7 to 22 and the inspectorate's checklist, draft the imprint, terms and pre-contract information, and set up the notice-and-removal procedure for platforms. Formation of the Montenegrin entity that will run the business is on our company formation page; technology contracts sit with our IT law practice.
If you are launching or running an online business in Montenegro, send us the site address, the checkout flow and a sample marketing e-mail. We will tell you which Articles of the Act they already meet and what the inspector would mark as missing.
