NIS2 obligations in Slovenia

Competent authority & CSIRT Legal ref: Art. 10, 13, and 59

• The competent national authority is the Information Security Office of the Government of the Republic of Slovenia. CSIRT SI-CERT. CSIRT of the State Administration (acts as an internal organisational unit of SIGOV CERT at the competent national authority). ecs-org.eu · 28 Oct 2026 · secondary source
• The government shall determine the CSIRT group that is the coordinator for coordinated vulnerability disclosure in the Republic of Slovenia Until the CSIRT group is designated, its tasks are performed by SIGOV-CERT and SI-CERT. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art 3. Annex I, II

• Sectors covered by the Act correspond to sectors of high criticality and other critical sectors under NIS2. The Act does not apply to entities that Slovenia has exempted from the regulation on digital operational resilience for the financial sector (DORA) ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 7, 28

• Entities must register with the URSIV through the mechanism for self-registration within 30 days from the day they receive a decision confirming they meet the identified criteria. If an entity meets the criteria prior to the entry into force of the Act, self-registration must be done within 6 months. ecs-org.eu · 28 Oct 2026 · secondary source
• Until the self-registration mechanism is in place (max 4 months after entry into force), the information shall be sent in digital form to the email address of the competent national authority. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 26

• Entities are required to report to the relevant CSIRT: ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours plus an initial assessment of the impact, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the national CSIRT (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident: an event that compromises the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or services provided by or accessible through these network and information systems. ecs-org.eu · 28 Oct 2026 · secondary source
• Significant incident: an incident that causes a disruption beyond the capability of the Republic of Slovenia to respond to it, or an incident that significantly affects at least two Member States of the European Union ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 50 – 56

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover(important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 10,000 EUR (responsible person of an essential entity). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000 EUR (responsible person fo an important entity) . ecs-org.eu · 28 Oct 2026 · secondary source
• Additional fines are listed under specific provisions for offences. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines

• For each incident subject to mandatory notification, the relevant essential, important and public entities shall submit to the competent authority: ecs-org.eu · 28 Oct 2026 · secondary source
• NIST, ISO 27001 / ISO 27002. ecs-org.eu · 28 Oct 2026 · secondary source
• CIS Controls. ecs-org.eu · 28 Oct 2026 · secondary source
• GDPR. ecs-org.eu · 28 Oct 2026 · secondary source
• Proposal is standard agnostic but supporting document explains that National and ENISA guidelines along with NIST, ISO 27001/27002, CIS Controls, and GDPR should be used. ecs-org.eu · 28 Oct 2026 · secondary source
• Certification: references to the EU Cybersecurity Act Standardisation: essential and significant entities shall, to the greatest extent possible, follow the recommendations and guidelines of ENISA and use European and international standards. The competent national authority shall public relevant information on the central website of the state administration on European and international standards. ecs-org.eu · 28 Oct 2026 · secondary source
• Slovenia requires structured cybersecurity risk assessments covering critical IT/OT assets, cloud systems, and third-party dependencies. Updates are required at least every two years or after major changes. Entities must maintain audit-ready records, with supervisory enforcement starting from Q4 2025. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Link to Law

What changed recently

1. 19 Jun 2025
   National NIS2 law enters into force (per tracker) ecs-org.eu secondary source