Slovenia NIS2 Transposition

National implementation through Cybersecurity Act 2024. Supervised by the Slovenian Information Security Authority. Covers essential entities in energy, transport, banking, and health.

JurisdictionSlovenia
CategoryCybersecurity
StatusActive
Latest development

Analysis

Slovenia has transposed NIS2 through the Information Security Act (ZInfV-1), which entered into force on 19 June 2025 and is now the core national law for NIS2-covered entities.[1][5][7] The competent national authority / single point of contact is the Information Security Administration (URSIV), with SI-CERT named as the national CSIRT.[5][6]

Key Requirements

  • Register / identify in-scope entities: Slovenia’s ZInfV-1 establishes the national framework for entities that fall within NIS2 scope, including essential and important entities in sectors such as energy, transport, banking, and health.[1][6][8]
  • Implement risk-management measures: In-scope entities must adopt technical and organisational cybersecurity measures proportionate to the risk, aligned with the NIS2 requirement set and Slovenian transposition measures.[1][6][8]
  • Incident reporting: NIS2-style incident reporting applies, including early warning, notification, and final reporting timelines that are carried into Slovenian implementation practice.[6]
  • Governance and accountability: Entities must assign responsibility for cybersecurity governance and ensure management involvement in the implementation of measures, consistent with the NIS2 model reflected in ZInfV-1.[1][6]
  • Supervision and inspections: URSIV is the supervisory authority, and regulated entities may be subject to oversight, audits, and enforcement actions under the Slovenian framework.[5][6]
  • Sanctions and penalties: ZInfV-1 is reported to include NIS2-aligned sanctions for non-compliance, with higher exposure for essential entities than for important entities.[4][6]

Official sources:

Compliance Challenges

  • Mapping scope correctly: Organizations often struggle to determine whether they are essential or important entities and whether their activities fall within Annex I / Annex II sector definitions.[4][6][8]
  • Completing remediation on time: Slovenia’s implementation has a transitional period, but organizations still need to build programs, close gaps, and align controls quickly after entry into force.[4][6]
  • Incident response readiness: Meeting NIS2-style reporting windows requires mature detection, triage, escalation, and legal/compliance coordination.[6]
  • Supply-chain dependency management: NIS2 requires control over suppliers and service providers, which is operationally difficult for organizations with complex vendor ecosystems.[6][8]
  • Auditability and documentation: Regulators expect evidence of risk assessments, policies, technical controls, training, and board oversight, which many organizations do not maintain in a structured way.[6][8]

Real-world implementation examples and market commentary:

Implementation Best Practices

  • Perform a formal scope assessment: Identify whether the entity is essential or important and document the legal basis for inclusion under ZInfV-1 and NIS2 sector criteria.[1][6][8]
  • Run a gap assessment against NIS2 controls: Compare current controls to NIS2-style requirements for risk management, incident handling, continuity, backup, access control, encryption, and supply-chain security.[6][8]
  • Build incident reporting playbooks: Define internal escalation thresholds so the organization can meet the 24-hour / 72-hour / final report rhythm described for NIS2 implementation.[6]
  • Create a control ownership matrix: Assign named owners for governance, asset management, vulnerability management, logging, supplier security, and crisis management.[6][8]
  • Maintain evidence continuously: Keep board approvals, risk registers, incident logs, supplier reviews, and test results ready for supervisory review.[6][8]
  • Align with recognized frameworks: Use existing frameworks to operationalize compliance, especially where Slovenian secondary acts are still developing.[6][8]

Relevant frameworks and implementation resources:

Useful tools/resources:

Recent Updates

  • 17 October 2024: NIS2 transposition deadline under the Directive passed without Slovenian full transposition at that time.[1][5][7]
  • 7 May 2025: The European Commission sent Slovenia a reasoned opinion for failure to notify full transposition.[5]
  • 23 May 2025: The Slovenian National Assembly adopted the new Information Security Act (ZInfV-1).[1]
  • 4 June 2025: ZInfV-1 was published in the Official Gazette.[1][8]
  • 19 June 2025: ZInfV-1 entered into force, formally transposing NIS2 into Slovenian law.[1][7][8]
  • Post-entry implementation phase: Slovenia moved into operational implementation, including registries, incident-reporting platforms, and technical requirements for regulated entities.[1]

Effective dates and deadlines reported in secondary sources:

  • 18 months from entry into force for risk-management measures in some descriptions of the Slovenian transposition process.[6]
  • Registration and operational deadlines may be set through implementing measures and authority guidance, so entities should verify current URSIV instructions before relying on secondary summaries.[1][6]

Official update sources:

Related Regulations

  • NIS2 Directive (Directive (EU) 2022/2555): ZInfV-1 is the national transposition vehicle for the EU cybersecurity directive.[1][5]
  • CER Directive (Critical Entities Resilience Directive): Slovenia’s new law is also described as aligning with the CER framework, so resilience and cybersecurity obligations may overlap for critical operators.[4][8]
  • GDPR: Data protection obligations overlap with NIS2-style security and incident response requirements, especially where personal data is involved.[6]
  • ISO/IEC 27001: Not legally required by NIS2, but commonly used as a control framework to operationalize governance and security requirements.[8]
  • NIST Cybersecurity Framework: Useful for control mapping, maturity assessment, and program structure.[8]

Official documentation:

Industry Impact

  • Energy and transport operators face higher compliance burdens because they are typically in higher-criticality sectors and depend on complex industrial and operational technology environments.[6][8]
  • Banks and financial institutions must reconcile NIS2-style cyber controls with existing sectoral supervision and incident expectations.[6][8]
  • Healthcare providers often face legacy-system constraints, staffing shortages, and high availability requirements, making remediation harder.[6][8]
  • Public administration and digital infrastructure providers are impacted by broader scope and stricter supervisory expectations under the new regime.[8]
  • Supply-chain and managed-service ecosystems are affected because regulated entities need stronger third-party controls and contractual security requirements.[6][8]

Industry analysis and country impact resources:

Sources

Recent developments

  • — A 2026 compliance update said Slovenia had already adopted transposing legislation, placing it among the majority of EU member states that had moved beyond the drafting stage. The article also noted that the Commission had previously issued reasoned opinions to multiple states, including Slovenia, for incomplete notification.[10] (source)
  • — ECSO’s tracker said 23 of 27 EU member states had transposed NIS2 into national law. While not Slovenia-specific in detail, it places Slovenia within the broader EU implementation wave and indicates continued movement toward full harmonization.[2] (source)
  • — This status page says Slovenia’s ZInfV-1 is in force and that URSIV is the competent authority and single point of contact for NIS2 in Slovenia. It also says entities have an 18-month window from entry into force to implement risk-management measures, which keeps compliance activity ongoing into 2026.[9] (source)
  • — A compliance-focused industry article described Slovenia’s transposition as a major expansion of regulated entities, including some medium manufacturers, municipalities, and all cloud and telecom operators. It also said the move materially increases compliance obligations and reporting requirements for affected organizations.[3] (source)
  • — According to this transposition tracker, ZInfV-1 entered into force on 19 June 2025, moving Slovenia from legislative adoption into operational implementation. The tracker notes that implementing acts and guidance would follow to support compliance.[4] (source)
  • — Eversheds Sutherland states that NIS2 was implemented into Slovenian law on 19 June 2025 through ZInfV-1. The law broadens the scope of regulated entities and requires risk assessments and incident-management planning.[5] (source)
  • — The European Commission’s Slovenia page still listed the country’s NIS2 implementation status and official contact points, including the Information Security Administration and SI-CERT. This is useful operationally because it identifies the national bodies responsible for supervision and incident handling.[1] (source)
  • — Slovenia published the new Information Security Act (ZInfV-1) in the Official Gazette, formally completing national transposition of NIS2 according to this source. The page says the law entered into force on 19 June 2025.[4] (source)
  • — Eversheds Sutherland reported that Slovenia officially published ZInfV-1 in its Official Gazette on 4 June 2025. It said the act would enter into force on 19 June 2025 and extend cybersecurity obligations to additional public- and private-sector entities.[5] (source)
  • — The European Commission issued a reasoned opinion to Slovenia for failing to notify full transposition of the NIS2 Directive. This marked an escalation in infringement proceedings and signaled that Slovenia still had implementation gaps at that point.[1] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates