Slovakia NIS2 Transposition

NIS2 implementation through the Act on Cybersecurity. Covers essential and important entities in energy, transport, banking, health, and digital infrastructure. AG enforcement.

JurisdictionSlovakia
CategoryCybersecurity
StatusActive
Latest development

Analysis

Slovakia has transposed NIS2 through Act No. 366/2024 Coll., which amends the existing Act No. 69/2018 Coll. on Cybersecurity rather than creating a standalone NIS2 statute.[1][2][3] The amendment entered into force on 1 January 2025, and later implementing measures were reported for 2025 onward, including updated secondary rules and registry-related obligations.[1][2][9]

Key Requirements

  • Scope / entity classification
  • Slovakia uses the NIS2-style split into essential and important entities, with sector coverage extending across energy, transport, banking, health, digital infrastructure, public administration, manufacturing, food, water, and other NIS2 sectors.[1][2][9][10]
  • The Slovak transposition is built into Act No. 69/2018 Coll. as amended, so compliance must be checked against the amended Cybersecurity Act and related implementing rules, not just the directive text.[2][3][8]
  • Official source: National Security Authority (NBÚ) and the Slovak legal corpus via Slov-Lex
  • Registration / national register enrollment
  • Covered entities are required to be entered into the Slovak cybersecurity registry, commonly referred to as JISKB, and sources describing the transposition report a 1 March 2025 deadline for re-registration of existing operators.[1][6][7]
  • This registration obligation is part of the national operationalization of NIS2 scope and supervisory tracking.[1][2][7]
  • Official sources: NBÚ and Slov-Lex
  • Cybersecurity risk-management measures
  • The transposed framework requires in-scope entities to implement technical and organizational measures proportionate to risk, including governance, access control, incident handling, continuity, supply-chain security, and resilience measures aligned with NIS2-style controls.[2][5][9][10]
  • Sources describing the amendment state that it strengthens the cybersecurity baseline compared with the pre-NIS2 regime and expands obligations on security controls.[2][5][9]
  • Official source: European Union NIS2 Directive text
  • Incident reporting
  • The Slovak transposition includes the NIS2-style incident reporting timetable and reporting duties, with sources describing a three-stage reporting process and NBÚ supervisory oversight.[2][5]
  • Organizations should expect fast initial notification, follow-up reporting, and final reporting obligations under the national regime.[2][5]
  • Official source: EUR-Lex NIS2 Directive
  • Management accountability
  • Sources on the Slovak amendment state that it introduces personal liability for management and strengthens governance expectations for cybersecurity oversight.[5][9]
  • This aligns with the broader NIS2 model, where management is expected to approve and oversee cybersecurity measures.[5][10]
  • Official source: EUR-Lex NIS2 Directive
  • Supervision and enforcement
  • The National Security Authority (NBÚ) is the supervising authority in Slovakia, with enforcement powers tied to the amended act and implementing measures.[2][6][7]
  • The transposition is described as bringing in the NIS2 supervisory model and sanctions framework.[2][5]
  • Official source: NBÚ
  • Sanctions
  • Sources on the Slovak transposition report a NIS2-style sanctions framework, including potentially significant administrative penalties.[5]
  • The exact national penalty amounts should be verified in the final consolidated Slovak legal texts and NBÚ guidance because secondary sources summarize the regime differently.[5][8][9]
  • Official source: Slov-Lex

Compliance Challenges

  • Determining whether the entity is in scope
  • Many organizations struggle to map legal entity structure, service lines, and size thresholds to the Slovak essential/important classification.[1][2][4][7]
  • This is especially difficult for groups operating across multiple regulated sectors or with shared IT services.[9][10]
  • Example source: Copla Slovakia NIS2 overview
  • Registration and re-registration logistics
  • Sources report that existing operators had to re-register into the national register after the new framework took effect, which creates operational friction for large and legacy organizations.[1][6][7]
  • This challenge is common where organizations must align legal, compliance, IT, and business ownership data before filing.[1][7]
  • Example source: RISI Slovakia regulatory entry
  • Upgrading legacy controls
  • Several sources note that Slovakia set later deadlines for full compliance and legacy control upgrades, indicating that many entities need substantial remediation work beyond simple policy updates.[1][4][7]
  • Legacy environments in critical infrastructure and public-sector suppliers often require segmentation, logging, identity modernization, and vendor-risk improvements.[5][9][10]
  • Example source: NIS Solutions Slovakia analysis
  • Supply-chain and third-party risk
  • NIS2-style requirements significantly expand supplier oversight, which is difficult for organizations with outsourced IT, cloud services, managed security providers, or shared industrial systems.[5][9][10]
  • Example source: PwC Slovakia NIS2 overview

Implementation Best Practices

  • Perform a formal scope assessment
  • Map legal entities, services, and sector activities against the amended Slovak Cybersecurity Act and NBÚ guidance before building controls.[2][3][6]
  • Use a documented rationale for essential vs. important classification and maintain it for audits and supervisory review.[2][7]
  • Relevant guide: NBÚ
  • Build a gap assessment against NIS2 controls
  • Compare current controls with NIS2-aligned requirements for risk management, incident response, continuity, logging, identity, supplier security, and governance.[5][9][10]
  • Track remediation as a formal program with owners, due dates, and evidence requirements.[5][9]
  • Framework reference: ENISA NIS2 resources
  • Set up incident reporting workflows
  • Define severity criteria, escalation triggers, legal review, notification templates, and evidence preservation steps so reporting can be completed on time.[2][5]
  • Test the process through tabletop exercises and post-incident reviews.[5]
  • Guide: ENISA incident reporting resources
  • Strengthen governance
  • Assign board-level oversight, management sign-off, and documented accountability for cybersecurity risk decisions, because the Slovak transposition reports stronger management responsibility.[5][9]
  • Tie cybersecurity metrics to regular management reporting and internal audit.[5]
  • Framework reference: ISO/IEC 27001 overview
  • Harden supply-chain assurance
  • Classify vendors by criticality, require contractual security clauses, verify incident notification obligations, and monitor security posture continuously.[5][9][10]
  • This is especially important for cloud, telecom, MSP, and industrial automation suppliers.[9][10]
  • Tooling reference: ENISA supply-chain security resources
  • Use recognized implementation frameworks
  • Adopt ISO/IEC 27001, NIST CSF, or CIS Controls to structure controls, evidence, and maturity tracking.[5][9][10]
  • These frameworks are commonly used to operationalize NIS2-style legal requirements into auditable controls.[5][10]
  • Resources: NIST Cybersecurity Framework, CIS Controls, ISO/IEC 27001

Recent Updates

  • Act No. 366/2024 Coll. adopted
  • The Slovak National Council adopted the transposition law on 28 November 2024.[1][2][3]
  • Official legal source: Slov-Lex
  • Entry into force
  • The amendment entered into force on 1 January 2025.[1][2][3][8]
  • Official legal source: Slov-Lex
  • Registration deadline reported by industry sources
  • Industry summaries report a 1 March 2025 deadline for re-registration of existing operators into the national system.[1][6][7]
  • Because this is derived from secondary sources, organizations should verify the current status in NBÚ guidance and the consolidated legal text.[1][2][6]
  • Official source: NBÚ
  • Secondary implementing rules
  • One analysis reports that a newer NBÚ decree replaced the earlier security-measures decree from 1 September 2025.[8]
  • Another source reports additional implementing decrees in 2025 affecting security measures and operational detail.[10]
  • Official source: Slov-Lex
  • Full compliance / legacy upgrade timing
  • Some industry sources report a later 31 December 2026 deadline for full compliance and legacy control upgrades.[1][4][7]
  • This should be checked against the current consolidated Slovak text and NBÚ publications because secondary sources are not fully uniform on the final timing.[1][4][7]
  • Official source: NBÚ

Related Regulations

  • EU NIS2 Directive (Directive (EU) 2022/2555)
  • Slovakia’s regime is the national transposition of NIS2, so the directive remains the primary interpretive benchmark for scope, governance, risk management, incident reporting, and supervision.[2][3][5]
  • Official text: EUR-Lex NIS2 Directive
  • EU CER Directive (Directive (EU) 2022/2557)
  • CER covers resilience of critical entities and overlaps with NIS2 for organizations in critical infrastructure sectors, especially where physical and cyber resilience must be coordinated.[5][10]
  • Official text: EUR-Lex CER Directive
  • GDPR
  • Cybersecurity controls required under NIS2-style rules often support GDPR security obligations for personal data protection, incident handling, and breach management.[5][9][10]
  • Official text: EUR-Lex GDPR
  • ISO/IEC 27001
  • This standard is often used as a control framework to evidence risk management, policies, asset management, incident response, and continual improvement under NIS2-like obligations.[5][10]
  • Official standard overview: ISO/IEC 27001
  • NIST Cybersecurity Framework
  • NIST CSF is a practical structure for identifying, protecting, detecting, responding, and recovering, which maps well to NIS2-aligned programs.[5][10]
  • Official framework: NIST Cybersecurity Framework

Industry Impact

  • Broader sector coverage
  • Sources state that NIS2 increased the number of regulated sectors compared with NIS1, and Slovakia’s transposition extends obligations across more industries, including public administration, digital services, health, transport, water, and manufacturing.[9][10]
  • This materially expands the compliance population in Slovakia.[4][7][10]
  • Industry analysis: PwC Slovakia NIS2 overview
  • More organizations brought into scope
  • One industry source reports that Slovakia’s transposition brought over 10,000 organizations into scope, though other sources give lower or different estimates, so the exact figure should be treated cautiously.[6][10]
  • The practical effect is a large increase in governance, reporting, and assurance workload.[4][6][10]
  • Industry analysis: Shards Cybersecurity Slovakia page
  • Higher governance and cost burden
  • Sources consistently indicate increased obligations for management accountability, incident reporting, security controls, and supplier oversight, which raises internal compliance cost and external audit demand.[5][9][10]
  • Sectors with legacy OT/ICS, extensive outsourcing, or thin security teams are likely to face the highest remediation burden.[9][10]
  • Industry analysis: NIS Solutions Slovakia analysis
  • Public-sector and critical infrastructure pressure
  • Because Slovakia’s scope includes public administration and critical service sectors, the amendment affects both government entities and private operators that support essential services.[9][10]
  • This creates spillover effects in procurement, contract terms, and security attestations across supply chains.[5][9]
  • Industry analysis: Copla Slovakia NIS2 overview

Sources

Recent developments

  • — ECSO’s tracker says 23 of 27 EU Member States had transposed NIS2 as of this update, indicating Slovakia is part of the group that has already completed transposition. The tracker is useful for comparing Slovakia’s status with the broader EU rollout.[6] (source)
  • — A Slovakia-specific compliance update says the Act on Cybersecurity was amended again with effect from 30 April 2026, changing the scope in Section 17(1). The same source says public-administration IT administrators were narrowed to those subject to Category II or III minimum security measures.[8] (source)
  • — A March 2026 update states that Slovakia has fully completed the legislative transposition of NIS2 through Act No. 366/2024 Coll. The source confirms the law’s adoption, publication, and entry into force dates, reinforcing that the transposition is not just planned but implemented.[3] (source)
  • — This update says another amendment took effect on 1 January 2026, assigning the National Security Authority (NBÚ) the role of market surveillance authority for products with digital elements under the Cyber Resilience Act. It signals that Slovakia’s cyber-regulatory framework is still evolving after the initial NIS2 transposition.[8] (source)
  • — The European Commission sent reasoned opinions to 19 Member States for failing to notify full NIS2 transposition. Slovakia was not among those listed, which supports the view that Slovakia had already notified transposition by then.[5] (source)
  • — Slovakia’s NIS2 transposition entered into force on 1 January 2025 under Act No. 366/2024 Coll., which amended the Cybersecurity Act 69/2018 Coll. The update also says the JISKB registration portal opened on the same date.[1] (source)
  • — The Slovak transposition law was published in the official Collection of Laws on 19 December 2024. This publication date marked the final step before the law took effect at the start of 2025.[1] (source)
  • — The National Council approved Act No. 366/2024 Coll. on 28 November 2024, completing the core legislative step for NIS2 transposition. The law significantly expanded the number of regulated entities and introduced more detailed cybersecurity obligations.[1] (source)
  • — The Slovak government sent the draft bill to Parliament on 27 September 2024, moving the NIS2 transposition process into the legislative phase. This helped set up the later adoption and entry into force in late 2024 and early 2025.[1] (source)
  • — The National Security Authority opened stakeholder consultations on 27 April 2024. That consultation step was an early signal that Slovakia was preparing a broad implementation of NIS2 requirements.[1] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates