Digital adoption among SMEs remains widespread but shallow. Most surveyed firms use at least one digital tool, but uptake is concentrated in basic, visibility-oriented technologies such as e-invoicing (58%), social media (47%) and websites (41%). Tools enabling deeper integration, such as cloud computing or enterprise resource planning, reach only around 10% of firms.
Growing AI usage is dominated by general-purpose tools. Around half of SMEs (48%) report using AI, though this use mostly involves generative tools such as ChatGPT (30%); conversely, custom and embedded systems reach only 9% uptake each. Adoption climbs steeply with digital maturity, from 29% among firms using one tool to 80% among those using six or more.
For most firms, e-commerce supplements rather than drives revenue. Most SMEs selling online generate little income from it: 56% report e-commerce below 10% of revenue, and only 9% above half of total sales. Sales run mainly through firms' own websites (42%) and social media (38%), with third-party marketplaces used by just 7%.
Cost and skills stand out as the main barriers to deeper digitalisation. Software and service fees (39%) and equipment costs (36%) are the most cited constraints. On skills, nearly half of firms (48%) rely on external expertise rather than developing it internally, against a regional skills base in which just 33.8% of adults have basic digital skills.
Awareness and uptake of public support are low. Only 17% of SMEs reported that they are aware of any government digitalisation programme. Among those aware of such programmes, most do not benefit: 47% received no support, and a further 7% applied unsuccessfully.
Formal data protection outpaces actual cybersecurity practice. While 72% of SMEs report having a data privacy policy, 22% have no cybersecurity measures in place. Exposure is likely understated: 18% confirm a cyberattack while a further 29% are unsure whether they have been targeted.
Western Balkans Enterprise Survey
Digitalisation has become a defining factor in how small and medium-sized enterprises (SMEs) operate, compete and grow. For SMEs, digital tools have meaningfully expanded firm-level capabilities, supporting market access, operational integration and connections to knowledge and partners that would otherwise be difficult to sustain. This dynamic is particularly pronounced for externally oriented firms, for which digital capabilities have become a baseline requirement: participation in cross-border value chains and access to global and EU buyers increasingly presuppose a level of digital readiness.
As such, the central question is no longer whether SMEs have adopted digital tools, but to what extent. Evidence suggests that productivity gains from digitalisation are highly uneven, accruing disproportionately to firms that combine digital tools with complementary investments in skills, organisational practices and process redesign, while firms adopting tools in isolation capture limited returns (OECD, 2021[2]; Gal, 2019[3]). Given the persistent productivity gap between the Western Balkans and the European Union, the depth of digital integration among SMEs carries significant implications for the region’s convergence prospects (OECD, 2025[4]). Moreover, as more business activity moves online and SMEs manage larger volumes of customer, supplier and operational data, cybersecurity and data protection become integral dimensions of digital maturity.
Against this backdrop, this chapter examines patterns of digital adoption among surveyed SMEs in the Western Balkans across five themes: the adoption and use of digital tools; the uptake of advanced technologies, including artificial intelligence (AI); e-commerce and digital transactions; constraints to deeper digital transformation; and cybersecurity and data protection. It concludes with a set of high-level policy implications that serve as entry points to more detailed economy-level analysis in the SME Policy Index 2026.
Understanding SME digitalisation requires looking beyond how many firms have adopted digital tools to which tools they use and why—distinctions that reveal the depth and strategic orientation of digital engagement more clearly than adoption rates alone.
2.2.1. Digital adoption among SMEs remains widespread but shallow
The large majority of surveyed SMEs use at least one digital tool, although adoption is heavily concentrated in foundational technologies. The most commonly used tools, which include electronic invoicing (58%), social media (47%) and company websites (41%), primarily serve visibility or compliance functions rather than process integration (Figure 1). E-invoicing rates reflect the influence of regulatory requirements, with Serbia (78%) and Albania (77%) recording the highest adoption following recent regulatory mandates,1 against 31% in Kosovo and 12% in North Macedonia. Social media and website adoption, while widespread, may reflect a perceived need for digital presence rather than strategic intent: many SMEs are likely to find it difficult to assess whether these tools generate tangible returns.
Note: As a percentage of respondent businesses using at least one digital tool (n=372). Respondents could select multiple tools.
Beyond this foundational layer, usage falls sharply, pointing to low levels of digital maturity among surveyed enterprises. Tools that support more integrated business operations, such as cloud computing, enterprise resource planning (ERP) and customer relationship management (CRM) systems, are used by between 10-20% of surveyed firms, while e-commerce and supplier-customer management systems are less common. Data-intensive technologies such as big data analytics remain marginal, used by around 2% of respondents. The breadth of firms' digital toolkits reflects this pattern: the median surveyed firm uses two digital tools, with 43% reporting that they only use one.
Low uptake of more advanced technologies likely reflects both lack of organisational readiness and high cost. ERP systems, for instance, are most effective when introduced into firms with well-defined internal functions, communication channels and operational procedures—conditions that are often absent among smaller enterprises. Firm-level data are consistent with this: ERP adoption among medium-sized firms stands at 29%, nearly double the rate among small firms (16%) and six times that of micro-enterprises (4%).
Adoption patterns vary meaningfully by sector, reflecting the demands of different business models. Firms in business and professional services show higher uptake of cloud computing (35%) and CRM tools (20%), consistent with the centrality of client management in knowledge-intensive activities, while manufacturing firms report stronger ERP use (15%), reflecting the co-ordination demands of production processes. Hospitality and public services record higher social media adoption (61%) and greater use of e-booking systems, in line with their direct-to-consumer orientation.
Export orientation emerges as one of the strongest correlates of digital depth. Among firms deriving more than 80% of revenues from exports, cloud computing adoption reaches 41%, with ERP and CRM each at 18%—or approximately double the rates observed among firms with only sporadic export activity. This is consistent with the more demanding operational, compliance and reporting requirements that participation in EU value chains places on suppliers and suggests that international market exposure drives digital upgrading in ways that domestic market orientation alone does not.
2.2.2. Digitalisation is driven primarily by market reach and operational efficiency
The motivations behind digital tool adoption are largely centred on near-term commercial and operational gains. Broadening the customer base is the most frequently cited reason (51%), followed by automating processes (42%), increasing domestic sales (33%) and improving business monitoring (32%) (Figure 2). Motivations linked to product development and revenue model innovation are reported less frequently: only 22% cite exploring new revenue sources and 25% mention enhancing products or services, pointing to operational rather than transformative drivers of digitalisation. Regulatory compliance is cited by 23% of firms, indicating that external requirements also shape adoption decisions to a meaningful degree.
Note: As a percentage of respondent businesses using at least one digital tool (n=372). Respondents could select multiple options.
Motivational profiles vary with firm size in ways that reflect differences in organisational complexity (Table 4). Micro-enterprises are most likely to cite customer base expansion (62%), consistent with the priority smaller firms place on visibility and client acquisition. Conversely, process automation becomes more prominent among small and medium-sized firms (54% and 55%, respectively), where more developed internal operations increase the scope for efficiency gains. Supply chain cost reduction follows a similar pattern, cited by 27% of medium-sized enterprises compared to 13% of micro-firms.
Note: As a percentage of respondent businesses using at least one digital tool. Respondents could select multiple options.
1. Regulatory compliance and improve monitoring are tied at 34% (11/32 each).
2. Increase international sales is tied at 32% (43/133).
3. Increase domestic sales is tied at 39% (48/124). Subsample sizes for self-entrepreneurs (n=32) and medium-sized firms (n=56) are small; consequently, figures should be read as indicative.
Export orientation and sector both shape how firms approach digitalisation, reflecting the distinct operational demands of different business models. Among firms deriving more than 50% of sales from exports, international sales growth and process automation are cited more frequently than among domestically oriented peers (39% versus 17%, and 42% versus 33%, respectively), suggesting that international competition can encourage deeper operational digitalisation. Sectoral motivations vary similarly: manufacturing firms prioritise supply chain cost reduction (23%) and international sales growth (33%), while hospitality and public services firms are more focused on customer-base expansion (63%).
Advanced digital technologies, and particularly artificial intelligence (AI), are increasingly expected to reshape how firms compete and create value: 86% of employers globally expect AI to transform their business by 2030 (World Economic Forum, 2025[5]). For SMEs in the Western Balkans, moving beyond initial experimentation will depend on whether the underlying conditions, in terms of skills, infrastructure and organisational readiness, are in place to support more substantive adoption.
2.3.1. AI uptake is widening but remains concentrated among digitally mature and export-oriented firms
AI adoption is reported by around half of surveyed SMEs (48%), though uptake is concentrated in accessible, general-purpose tools. Generative AI services such as ChatGPT are the most commonly used form, cited by 30% of respondents, while custom AI systems and tools with embedded machine learning functions are each reported by only 9% of surveyed firms (Figure 3). The composition reflects the relative accessibility of different technology types: generative AI lowers the barrier to entry by enabling natural language interaction without specialist technical knowledge (World Economic Forum, 2025[5]), while custom and embedded AI typically require higher technical capacity, larger data assets and more deliberate system integration.
Note: As a percentage of respondent businesses using at least one digital tool (n=372). Respondents could select multiple options.
Adoption varies systematically with firm characteristics. Self-entrepreneurs report the highest rate of generative AI use (53%), likely reflecting its value as a low-cost substitute for tasks that would otherwise require additional personnel. AI adoption also rises sharply with the breadth of a firm's digital toolkit—from 29% among firms using only one digital tool to 80% among those using six or more—suggesting that digital maturity is cumulative and that broader foundational engagement creates the conditions for more advanced adoption. Firm age introduces a further dimension: firms established after 2020 show the highest generative AI use (49%) and greater CRM adoption, but lower ERP uptake (5%, versus 17% among pre-2015 firms), consistent with their earlier stage of organisational development and fewer legacy systems. Older firms display the reverse profile, with stronger process integration and more structured digital practices (e.g. ERP adoption, more advanced cybersecurity practices) but lower engagement with emerging tools such as generative AI.
Sectoral patterns are similarly differentiated, with enterprises in knowledge-intensive services reporting the highest uptake. Business and professional services report the highest rate of any AI use (60%), with generative AI at 48% and custom AI at 17%, while manufacturing (38%) and hospitality and public services (33%) trail behind. This trend remains consistent with global evidence that knowledge-intensive sectors tend to adopt AI earlier and more extensively than traditional industries (World Economic Forum, 2025[5]).
2.3.2. Firms primarily view generative AI primarily as an efficiency and innovation enabler
Surveyed SMEs associate generative AI most strongly with improvements to existing operations, and less with structural change to their business models or workforce. Boosting innovation (67%) and improving efficiency in daily tasks (65%) are the most frequently cited opportunities, while finding new revenue sources (52%) and enabling operations with fewer staff (40%) attract lower agreement (Figure 4). Expectations are therefore more measured when it comes to generative AI's potential to reshape how firms are organised or how they compete.
Note: As a percentage of respondent businesses (n ranges from 344 to 345). Likert scale: Strongly disagree, Disagree, Agree, Strongly agree. A neutral category is included in the survey instrument.
Smaller firms express stronger optimism about generative AI's potential. Self-entrepreneurs and micro-enterprises report higher agreement that it improves efficiency (77% and 68%, respectively) and boosts innovation (71% and 74%), while agreement among small and medium-sized firms is more measured (59% and 68%, respectively, for efficiency; 62% for both on innovation). Both the practical relevance of low-cost AI tools for firms operating with limited resources and the more risk-conscious culture of larger, more structured organisations likely contribute to this divergence.
Awareness of risks is nonetheless widespread. Inaccurate information is identified as a challenge by 47% of respondent firms, followed by copyright and legal issues (45%) and data privacy concerns (44%), while 38% indicate they do not fully understand how to use generative AI or the risks involved (Figure 5). Notably, businesses with greater AI experience tend to be more alert to the limitations: knowledge-intensive services firms, which report the highest adoption rates, are also most likely to identify information inaccuracy as a challenge (57%), compared to approximately 40% of enterprises in manufacturing and trade. Expanding AI adoption through targeted programmes may therefore increase rather than reduce the volume of risk-related concerns firms report, as greater experience brings greater awareness of limitations.
Note: As a percentage of respondent businesses (n ranges from 344 to 345). Likert scale: Strongly disagree, Disagree, Agree, Strongly agree. A neutral category is included in the survey instrument.
2.3.3. Engagement with advanced technologies beyond AI and with more substantive digital innovation remains limited across most SMEs
Apart from AI, engagement with other advanced technologies, such as blockchain and the Internet of Things, remains limited, with 79% of surveyed firms reporting no use of any such technology. Among those that are used, the Internet of Things (IoT) records the highest adoption at around 10%, whereas blockchain is reported by fewer than 4% of respondents.
Digital innovation is more widespread, though depth of engagement varies considerably. Around 57% of firms report using digital innovation to develop new or improved products, services, processes or business models, but only 17% describe this as extensive. A further 34% indicate plans to adopt digital innovation. Younger firms are notably more active: among those established after 2020, 29% report extensive digital innovation, roughly double the rate among both pre-2015 firms (14%) and those established between 2015 and 2019 (13%) (Figure 6). This is consistent with the broader digital profile of younger enterprises documented earlier: although they tend to adopt new tools more readily and operate with fewer legacy constraints, their lower rates of process integration suggest that innovation activity may be more experimental than structurally embedded.
Notes: As a percentage of respondent businesses (n=341). Single-choice question. Firm age groups are based on the year of establishment: pre-2015, 2015-2019, and post-2020 onwards.
E-commerce offers SMEs a direct channel for expanding market reach and diversifying revenue, though its contribution to business performance depends on how effectively online selling is integrated with payment infrastructure, platform ecosystems and logistics.
2.4.1. E-commerce is widely used but remains a marginal revenue channel for most firms
E-commerce engagement is relatively common, but for most firms it remains a marginal revenue channel. Among surveyed SMEs, 56% report that online sales account for less than 10% of total revenue, and only 9% derive more than half their sales through e-commerce (Figure 7).2 As such, for the majority of firms, online selling functions as a complement to existing channels rather than a primary source of revenue.
Note: As a percentage of respondent businesses (n=347). Single-choice question.
E-commerce revenue contribution varies markedly by sector, reflecting differences in transaction models and customer orientation. Hospitality and knowledge-intensive services report the highest shares of firms with e-commerce exceeding 50% of sales (13% each), reflecting the suitability of these activities for direct online transactions. Manufacturing firms are at the other end of the distribution, with 63% reporting e-commerce below 10% of sales and only 4% exceeding 50%, consistent with the business-to-business orientation of the sector, where procurement relationships are less readily intermediated through standard e-commerce channels.
Firm size and export orientation shape e-commerce revenue intensity in distinct but complementary ways. Smaller firms are more likely to rely on online selling as a primary channel: e-commerce contributes more than half of sales for 14% of micro-enterprises and 9% of self-entrepreneurs, but for only 2% of medium-sized firms, which tend to operate more diversified channel mixes. Export-oriented firms show a different dynamic: among those deriving more than 80% of sales from exports, 16% report e-commerce contributing more than half of total revenue, compared to 5% among firms with less than 10% export exposure. Such a pattern contributes to the idea that international market reach and e-commerce usage can reinforce one another.
2.4.2. Online sales are conducted primarily through owned channels rather than structured marketplaces
SMEs selling online rely predominantly on owned channels, with third-party marketplaces largely absent from their e-commerce mix. For online sales, firms primarily rely on their own websites (42%) and social media platforms such as Instagram and Facebook (38%), while third-party marketplaces are used by only 7% of respondents.3 Notably, around 30% report using no e-platform at all (Figure 8).
Notes: As a percentage of respondent businesses using at least one digital tool (n=372). Respondents could select multiple options. Third-party marketplaces are exemplified in the survey as Amazon and eBay.
Platform choice differs with firm size and export orientation. Export-oriented firms show the most varied approach, with own website use reaching 48% among firms deriving 50-80% of sales from exports (versus 36% among firms with less than 10% of sales from exports). For micro-enterprises, social media often fills the gap left by limited marketplace participation: in several Western Balkan economies, dedicated social media groups connect small producers directly with consumers in low-cost, trust-based selling environments.³ In fact, only 22% of micro-enterprises report using no platform at all, compared to 41% among small firms, pointing to social media as a viable, if informal, commercial infrastructure for firms that have yet to engage with more structured platforms.
2.4.3. Bank transfers dominate digital payments, while advanced solutions remain constrained by infrastructure and trust gaps
Digital payment adoption is somewhat limited, with acceptance concentrated in basic methods. Bank transfers are the most widely accepted method, reported by 54% of surveyed SMEs, followed by credit or debit card payments via online platforms (22%) (Figure 9). Mobile payment solutions (9%) and e-commerce payment gateways such as PayPal (5%) are used by a small minority, while a quarter of respondent firms report accepting no form of digital payment at all.
Notes: As a percentage of respondent businesses using at least one digital tool (n=372). Respondents could select multiple options.
Limited adoption of advanced digital payment methods partly reflects infrastructure constraints. At the time of the survey (April-June 2025), mobile payment solutions such as Apple Pay and Google Pay were available in only three of the six Western Balkan economies (Montenegro, North Macedonia, Serbia), directly limiting the options firms could offer. The regional rollout has since expanded, with Apple Pay launching in Albania, Bosnia and Herzegovina and Kosovo in mid-2025, though uptake by SMEs in these economies will only become observable in subsequent data collection rounds. PayPal, while broadly available, has faced restrictions in some economies, notably Kosovo, where the absence of a UN country code has prevented full integration.
Consumer behaviour and trust compound these supply-side constraints. Cash-on-delivery remains predominant for a large share of e-commerce transactions in the region, reflecting both established consumer preferences and historically lower trust in online payment systems, particularly outside major urban centres. Concern about online payment security is considerable among citizens across the region, and debit and credit card ownership stands at roughly half and one third of EU levels, respectively (OECD, 2025[4]). The reliance on bank transfers in the survey data is consistent with this context: these transfers represent a familiar, trusted method that does not require merchants to adopt integrated payment processing infrastructure. The low uptake of payment gateways (5%) and mobile solutions (9%) therefore reflects a combination of supply-side constraints and demand-side preferences, rather than a lack of awareness or willingness among firms. Both dimensions are expected to shift gradually as Western Balkan economies advance their integration into the Single Euro Payments Area (SEPA), broadening the availability of standardised payment instruments and potentially improving consumer familiarity and trust in digital transactions over time.
Whether at the early stages of digital adoption or advancing toward more integrated technologies, SMEs across the region face a common set of reinforcing constraints that shape both the pace and the reach of digital transformation.
2.5.1. Cost and human capital constraints are the principal barriers to deeper digital adoption
Among surveyed SMEs, cost-related barriers dominate. Software maintenance and technical service fees are cited by 39% of respondents, equipment acquisition or repair costs by 36%, employee training costs by 31% and insufficient time for training by 29% (Figure 10). Taken together, these figures point to the total cost of ownership, which encompasses acquisition, maintenance and workforce preparation, as a significant and recurring obstacle. Only 13% of firms report facing no challenges, suggesting that constraints are near-universal.
Human capital barriers form a second, closely related cluster: 21% of respondents cite difficulty hiring qualified staff, 19% report insufficient in-house digital skills and 13% cannot find suitable external consultants. These firm-level findings are consistent with trends observed in the broader business environment, where labour shortages, driven by high-skilled emigration and rapid population ageing, are consistently identified as the primary obstacle to doing business (OECD, 2026[6]).
Note: As a percentage of respondent businesses using at least one digital tool (n=372). Respondents could select multiple options.
The barrier profile shifts with firm size and export orientation, reflecting the more complex and costly challenges that arise as digitalisation deepens. Medium-sized enterprises report higher constraint rates across most categories: 50% cite equipment acquisition costs, 39% hiring difficulty and 30% insufficient internal skills (compared with 39%, 24% and 20% respectively among small firms). This pattern reflects not fewer obstacles among smaller firms, but the more demanding challenges that emerge as digitalisation advances. Among export-oriented firms, the human capital constraint is particularly acute: 46% of firms deriving more than 80% of sales from exports cite hiring difficulty, reflecting the more demanding digital capability thresholds imposed by export-facing operations.
2.5.2. Digital expertise among SMEs is sourced predominantly externally, with limited internal capacity building
Faced with limited resources and thin internal skills, most SMEs look outside the firm for digital expertise rather than developing it in-house. Indeed, 48% of respondents cite contracting consultants and professionals outside of the business, compared to only 22% that rely on their own IT specialists (Figure 11). Only 4% of surveyed SMEs report hiring digital specialists when additional expertise is needed, and a further 4% reassign existing staff.
Notes: As a percentage of respondent businesses (n=341). Single-choice question.
External contracting dominates across all firm sizes, though the methods used to supplement it vary (Figure 12). Although a notable proportion of medium-sized enterprises are reliant on external consultants (54%), they still show higher use of internal IT specialists (29%) than micro-enterprises (18%) or self-entrepreneurs (10%), reflecting the greater organisational capacity and resource base of larger firms. For smaller firms, informal channels fill the gap: while 13% of respondents on average turn to friends and family for digital expertise, this rises to 29% among self-entrepreneurs, pointing to the extent to which the smallest firms operate outside the formal digital advisory ecosystem.
The reliance on external contracting reflects a structural skills shortage that extends well beyond the firm level. ICT specialists account for only 3% of employed persons across the region, compared to 5% in the EU, and only 33.8% of adults possess at least basic digital skills, against 55.6% in the EU (RCC, 2025[7]; OECD, 2025[4]). Together, these gaps constrain both the supply of external expertise available to firms and their ability to recruit and retain digital talent internally. High emigration rates among the highly educated in some economies further deplete the available talent pool (OECD, 2025[4]). While contracting is a practical and often necessary response to these constraints, it carries limitations: outsourced expertise is episodic rather than continuous, rarely contributes to knowledge spillovers that build lasting internal capacity and can create dependence on the quality and availability of the external service market.
Notes: As a percentage of respondent businesses (n=341). Single-choice question.
2.5.3. Training is relatively common but concentrated on basic digital literacy, with insufficient coverage of the advanced skills most relevant to deeper digitalisation
Among SMEs that provide digital skills programmes, internal training is the preferred approach, with 28% of respondents reporting in-house provision, compared to 17% relying on external institutions (Figure 13). A further 25% encourage peer learning among colleagues, while 22% promote informal learning through internet searching or generative AI. Around 31% of firms provide no digital skills programmes at all.
Note: As a percentage of respondent businesses (n=372). Respondents could select multiple areas.
Training provision is notably less common among smaller firms, which tend to rely on informal learning over structured skills development. Over a third of micro-enterprises (37%) provide no skills development programmes, compared to 21% of medium-sized firms. Where learning does occur among smaller firms, it tends to be informal: self-entrepreneurs and micro-enterprises more frequently utilise internet searching and generative AI as learning tools (28% and 26%, respectively), which serve as pragmatic responses to resource constraints that rarely substitute for structured capability-building.
Where training is provided, it is concentrated at the foundational level, with the specialised skills most relevant to deeper digitalisation largely absent. Among firms offering training, 73% cover basic digital literacy such as common business software use, while e-commerce and platform management, AI and machine learning, cybersecurity, and skills needed for the green and digital transition are each covered by roughly one in five firms or fewer (Figure 14). This foundational orientation persists even among medium-sized firms, where 89% of training activity focuses on basic skills.
Notes: As a percentage of respondent businesses that provide training (n=234). Respondents could select multiple areas.
2.5.4. Both awareness and uptake of government digitalisation programmes for SMEs remain low
Only a minority of SMEs (17%) report knowing of any government programme supporting business digitalisation. Awareness remains broadly consistent across firm sizes, but economy-level variation is more pronounced, ranging from 8% in Serbia to 41% in Bosnia and Herzegovina.4 This likely reflects differences in both programme availability and outreach effectiveness.
Where firms do learn about available programmes, intermediary organisations are the primary channel: chambers of commerce and SME associations account for 31% of discovery, government media advertising for 28% and government portals for only 13%. This points to the central role that intermediaries play in bridging the gap between programme availability and firm-level uptake, and to the need for more systematic outreach through these channels.
Knowledge of available programmes does not guarantee access to support. Of the firms reporting awareness, 26% received financial support such as grants or vouchers, 10% received training support and 10% participated in networking activities. However, most SMEs that are aware of support programmes do not benefit: 47% report receiving no support at all and a further 7% applied unsuccessfully. This gap between awareness and uptake may reflect supply-side constraints, such as limited programme capacity or competitive selection processes, but could equally point to demand-side hesitancy, where firms forgo applying due to costs associated with participation, including co-financing requirements or the administrative burden of preparing an application.5 Even economies with more developed programmes show a similar pattern: in Serbia, only 60% of businesses applying for funding through a dedicated SME digital transformation programme were successful (OECD, 2024[8]).
The supply side reveals an instrument mix that is fragmented and poorly matched to the firms most in need of support. Most Western Balkan economies offer grants for acquiring digital tools or software, but more sophisticated instruments remain limited: low-interest loans for IT infrastructure are available in only a handful of economies, “test before invest” pilot programmes exist only in Serbia, and tax incentives for digitalisation are found only in North Macedonia. Demand-driven instruments with low administrative requirements, such as digitalisation vouchers or small advisory subsidies, remain underdeveloped, meaning the most accessible instruments for less digitally mature firms are often the least available. A large share of financing continues to flow through EU initiatives which, while important, can introduce discontinuity and limit the development of domestically owned, scalable schemes (OECD, 2026[6]).
As SMEs deepen their digital engagement, the security and governance of their data environments become increasingly important, both as a condition for business continuity and as a requirement for regulatory compliance and market trust.
2.6.1. Formal data privacy policies are widespread, but operational implementation lags behind
A large majority of surveyed SMEs (72%) report having a data privacy policy (Figure 15). Adoption is broadly consistent across firm sizes, ranging from 69% among micro-enterprises to 77% among medium-sized firms. This proportion rises to 85% among the most export-oriented firms, consistent with the more demanding compliance requirements of international operations.
Economy-level variation is more pronounced: Montenegro (81%), Serbia (77%) and Albania (74%) report the highest rates, while Kosovo (64%) and Bosnia and Herzegovina (59%) lag behind. Regulatory alignment does not appear to be the primary driver of firm-level adoption: Serbia and Kosovo are the only economies to have fully aligned their data protection legislation with the EU’s General Data Protection Regulation (GDPR) (OECD, 2025[4]), yet Kosovo records one of the lowest adoption rates in the sample.
Note: Data privacy policy: as a percentage of respondent businesses (n=341), single-choice question.
Beyond these cross-economy differences, the headline adoption rate warrants a degree of interpretive caution. What constitutes a data privacy policy in practice ranges widely: at one end, a substantive governance framework covering data classification, access controls, breach response protocols and staff accountability; at the other, a basic document of limited operational relevance. For smaller firms with limited regulatory exposure, formal adoption may function more as a signal of awareness of international norms than as a reflection of organisational practices that meaningfully protect data. The distinction matters: as SMEs manage increasing volumes of customer, supplier and operational data, the gap between holding a policy and implementing effective data governance carries real business and compliance risk.
2.6.2. Cybersecurity practices remain basic, with significant gaps observed among smaller firms
Among the surveyed SMEs, cybersecurity practices are concentrated in basic measures, such as strong passwords, updated antivirus software, two-factor authentication and VPN or firewall systems (Figure 16). More structured practices such as regular expert assessments and annual cybersecurity training remain uncommon. Notably, around 22% of firms report no cybersecurity measures at all, rising to 38% among self-entrepreneurs.
The size gradient follows a familiar pattern. Medium-sized firms report higher uptake across all categories,6 and while micro-enterprises show comparable engagement with basic measures, they exhibit higher rates of having no cybersecurity practice in place at all (27%). The gap is most pronounced for structured practices: regular expert assessments and annual cybersecurity training are adopted primarily by medium-sized and small firms and remain uncommon among micro-enterprises, most likely due to resource constraints.
Note: Cybersecurity measures: as a percentage of respondent businesses using at least one digital tool (n=372), respondents could select multiple options.
Taken together, these patterns suggest that formal data privacy adoption and cybersecurity practice are only loosely connected. Cross-tabulating policy status with actual cybersecurity measures reveals a positive but incomplete association: firms with a data privacy policy in place adopt more security measures than those without, but the gap between formal adoption and operational implementation remains significant. Among firms with a policy, 18% still report no cybersecurity measures at all and only 36% implement three or more structured measures, compared to 39% and 13% respectively among firms without a policy.
2.6.3. Cyberattack exposure is likely higher than confirmed incident rates suggest
Around 18% of surveyed SMEs report having experienced a cyberattack, while a further 29% are unsure whether they have been targeted (Figure 17). The combined 47% of firms that either confirm an incident or cannot rule one out suggest actual cyber exposure is considerably higher than confirmed figures alone would indicate. Without regular security assessments, intrusion detection systems or cybersecurity audits, many incidents are likely to go undetected. Notably, firms with cybersecurity measures in place report confirmed incidents at higher rates (20-22%) than those without (10%), reflecting greater digital exposure and detection capacity rather than the ineffectiveness of security measures. These firm-level findings are consistent with the broader regional risk environment, in which approximately 1.2 million personal records have been compromised in data breaches across the Western Balkans since 2022, and attacks on government systems in Montenegro and Albania that same year demonstrated the vulnerability of digital infrastructure across the region (Atlantic Council, 2024[9]; OECD, 2025[4]).
Notes: As a percentage of respondent businesses (n=342). Single-choice question.
The survey findings presented in this chapter point to a number of high-level priority areas for policy attention. These are intended as entry points for further analysis and economy-specific action and should be read in conjunction with the more detailed, tailored recommendations provided in the OECD SME Policy Index 2026.
Couple access to digital tools with organisational and advisory support. Effective programmes should combine financial instruments (e.g. digitalisation vouchers, low-interest loans for IT investment, "test before invest" schemes) with co-financed advisory services that help firms assess their operational readiness and sequence their digital investments. Support should be tailored to different levels of digital maturity and designed for continuity across multiple stages of firm development, replacing one-off pilot interventions.
Strengthen the delivery channels through which SME digitalisation support reaches firms. Policy action should focus on systematising outreach through intermediary organisations, developing single entry points where firms can identify available support and assigning clear institutional responsibility for SME digital transformation across ministries.
Move from scattered pilot approaches to longer-term, domestically anchored support models. Establishing domestically owned financing mechanisms, including dedicated SME digitalisation budget lines, tax incentives for digital investments and predictable multi-year funding for advisory services, is essential to ensure firms receive continuous support rather than fragmented donor-funded project-based access.
Strengthen the digital skills base. Skills policy should expand modular, practical training delivered through business support organisations and vocational institutions, with content shaped by firm-level input. Subsidised training and voucher schemes can offset cost barriers for SME participation. At the labour market level, sustained investment in ICT skills pipelines, alongside policies to retain and attract skilled workers, is necessary to address the structural shortages reported across all six economies.
Open structured pathways from initial AI adoption to more integrated use. Micro and small firms need low-threshold advisory and peer-learning mechanisms to channel informal experimentation toward productive applications, while medium-sized firms require co-financed implementation support and access to specialised expertise. Accessible, sector-differentiated guidance on responsible AI use is also needed across all business demographics.
Advance e-commerce from informal channels to scalable digital trade. Support should build on existing sales channels to help firms progress to more structured models, including facilitating access to domestic marketplace platforms, supporting interoperable payment solutions, and strengthening logistics and fulfilment infrastructure.
Embed cybersecurity within mainstream digitalisation support rather than treating it as a standalone compliance requirement. Demand-driven instruments such as co-financed cybersecurity audits and basic hygiene advisory services should be scaled to reach the smallest and most exposed firms. A parallel effort is needed to translate widespread formal data protection policy adoption into operational practice, through simplified guidance, sector-specific compliance toolkits, and integration of data protection support into broader business advisory services.
← 1. Serbia introduced mandatory e-invoicing under the Law on Electronic Invoicing (Zakon o elektronskom fakturisanju, Official Gazette of the Republic of Serbia No. 44/2021, with subsequent amendments), administered through the Sistem e-Faktura (SEF) platform managed by the Ministry of Finance. Implementation was phased: from 1 May 2022 for transactions between public sector entities and their suppliers (B2G), and from 1 January 2023 for transactions between private sector entities (B2B). Albania introduced its mandatory fiscalisation system earlier, under Law No. 87/2019 of 18 December 2019 "On the Invoice and Circulation Monitoring System" (Për faturën dhe sistemin e monitorimit të qarkullimit), administered through the Central Information System (CIS) platform managed by the General Directorate of Taxes. Implementation was phased: from 1 January 2021 for cashless B2G transactions, from 1 July 2021 for cashless B2B transactions, and from 1 September 2021 for cash B2C transactions.
← 2. A further 14% of surveyed firms were unable to quantify the share of total revenue derived from online sales.
← 3. The low reported marketplace uptake should be interpreted with caution. The survey references international platforms such as Amazon and eBay, which have limited presence in the region; in practice, the Western Balkans e-commerce ecosystem is shaped more by domestic alternatives. In Serbia, for instance, KupujemProdajem.com functions as the most visited online trading platform, while Ananas.rs has emerged as a structured domestic marketplace hosting thousands of local sellers. Therefore, the 7% figure likely understates actual marketplace engagement, particularly on domestic platforms not explicitly captured by the survey.
← 4. Rates for other economies include: 23% in Kosovo, 16% in Albania, 12% in North Macedonia and 11% in Montenegro.
← 5. Data collected in this survey do not allow these two dynamics to be distinguished, though each carries distinct policy implications.
← 6. 66% using strong passwords, 55% maintaining updated antivirus software and 29% using VPN or firewall systems