The American Chamber of Commerce in a public statement appreciates the efforts and public investments of the Government of Albania in the digitalization of public services, including the development of the e-Albania platform, as an important step towards modernizing the administration and improving services for citizens and businesses. However, given that government digital systems manage highly sensitive data, the lack of auditing, security, and continuous updating in accordance with international standards poses serious risks to economic stability, business continuity, and national security.
AmCham expresses particular concern regarding the ongoing feedback received from its members following recent developments related to the AKSHI. According to member reports, some services of the e-Albania platform are currently operating unsustainably and do not meet the operational needs of businesses and citizens. These concerns include service interruptions, delays, limited access during busy hours, and unpredictable system performance, which directly impact the disruption of normal business activity.
Such disruptions have a tangible and immediate negative impact on companies’ ability to meet regulatory obligations, serve customers, and conduct day-to-day operations. This concern is particularly relevant to AmCham, as the Chamber represents a significant number of member companies operating in the Information and Communications Technology (ICT) ecosystem and related sectors. Many of these companies are internationally certified, implement high security and regulatory standards, and some of them are fully vetted and authorized to provide services to the United States Government. However, despite this strong domestic and international experience, AmCham members report ongoing concerns regarding public procurement processes in the ICT sector. These concerns undermine fair competition and the effective use of public funds, while increasing the risks associated with the management and protection of highly sensitive data.
This data includes information related to public institutions, businesses, personal and property data of citizens, as well as other information of critical importance for the functioning of the state and the economy.
In comparison, in the United States and other advanced economies, companies involved in government ICT systems and sensitive systems are subject to strict vetting processes, security clearance requirements, and financial controls, including limits on profit margins, in order to ensure transparency, efficiency, and protection of taxpayer funds.
For this reason, AmCham calls on the Government to take immediate corrective measures to guarantee the uninterrupted, stable and reliable operation of all e-Albania services, with a particular focus on services critical to business activity and procurement.
In short-term solutions, AmCham proposes taking the following immediate actions:
AmCham proposes the creation of a mandatory legal framework for periodic and independent IT and cybersecurity audits for all critical e-Government platforms, conducted in accordance with international standards and EU best practices, including ISO/IEC 27001, ISO/IEC 22301, NIST, SOC 2 and ENISA guidelines, with executive summaries available to stakeholders.
Security Authorization, Verification and Access Control: AmCham suggests strengthening the effectiveness and level of maturity of existing mechanisms for security authorization, verification and access control in government ICT systems, in accordance with applicable regulations on information security, state database management, procurement of classified information and public procurement law. Recognizing the practices implemented by the NIS, it is recommended to evaluate and improve these mechanisms, including role-based access control, in line with the EU NIS2 Directive and best practices of member states.
Availability and continuity standards: Defining and implementing minimum service level requirements (SLA) regarding the operation, recovery time and performance of critical systems, including redundancy, disaster recovery and business continuity, in accordance with ISO/IEC 22301 and the EU digital resilience principles.
AmCham suggests increasing the effectiveness and maturity of existing procurement procedures in the ICT sector, in line with the applicable legal framework on information security, state database management, procurement of classified information and the public procurement law. Recognizing the current practices of the National Agency for Information Security, it is recommended to strengthen the merit-based evaluation, through a clearer weighting of technical criteria, certifications, experience and security profile, in line with the EU Directives on Public Procurement.
Structured communication and mandatory incident notification: Establish formal mechanisms for notifying businesses and citizens about planned maintenance, incidents and service interruptions, including estimated resolution time and post-incident reports, in line with reporting obligations under NIS2.
Regulated framework for systems integration: Establish a secure and regulated framework that enables authorized private sector systems to integrate with e-Government platforms, where appropriate, in strict compliance with GDPR, eIDAS / eIDAS2, cybersecurity standards and defined access control rules, to support automation and reduce administrative burden.
AmCham expresses its readiness to cooperate with the Government by providing technical expertise and sharing international best practices, particularly those implemented in the United States, with the aim of strengthening governance, minimizing corruption risks, protecting sensitive data, and increasing national and economic security, the statement concludes.
