NIS2 in Slovakia

Key facts at a glance

Is your company in scope? Common Slovakia scenarios

Two worked examples of how NIS2 scoping plays out in Slovakia. Not sure where you land? Run the free NIS2 scope checker.

What Slovakia businesses need to know

• Slovakia transposed NIS2 by amending its 2018 Cybersecurity Act, zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti: zákon č. 366/2024 Z. z., promulgated on 19 December 2024, has applied since 1 January 2025 (Čl. VII). The act has been amended twice since, by 318/2025 Z. z. and 67/2026 Z. z., and the European Commission closed its infringement case INFR(2024)0300 on 8 October 2025, without a reasoned opinion.

• Národný bezpečnostný úrad (NBÚ), the National Security Authority, is the authority of the act and the national contact point for cybersecurity (§ 4(a), § 5(1)(e)): it keeps the register of operators of essential services, runs the single cybersecurity information system and supervises (§ 5(1)(j), § 17, § 29a). Its Národné centrum kybernetickej bezpečnosti is the national CSIRT, except in the sectors whose central state body performs the CSIRT's tasks (§ 6(1)).

• The register makes the operator. The act keeps the NIS1 vocabulary: the obliged party is the operator of an essential service (prevádzkovateľ základnej služby), and it is one only once NBÚ has entered it in its register (§ 3(2)). An entity covered by § 17(1) notifies NBÚ within 60 days of starting the activity (§ 17(2)); NBÚ enters it after consulting the central body and gives notice through the single information system and the electronic mailbox, with no separate decision (§ 17(3), (4)); and the duties start at the earliest on the 30th day after the entry (§ 17(5)).

• The essential entity's part is played by the operator of a critical essential service (§ 18): among others central government, a large entity's Annex 1 activity, qualified trust services, TLD and DNS services, and public electronic communications from medium size. One critical essential service makes the operator a critical operator, which it must notify to NBÚ (§ 18(2)); the act has no word for the important entity.

• Scope reaches beyond the directive's lists: cities, and the state bodies acting in at least two districts and the higher territorial units, on a significance test (§ 17(1)(d), (f)); the administrators of public administration IT in categories II and III (§ 17(1)(g)); registrars at any size (§ 17(1)(h)); and a third party with significant influence on cybersecurity under contract with an operator of a critical essential service (§ 17(1)(i)). Medium-sized and larger entities of the two annexes are in by the size test of Recommendation 2003/361/EC (§ 17(1)(e)).

• Every report goes through the single cybersecurity information system that NBÚ manages and operates (§ 24(3), § 5(1)(j)). From becoming aware of the serious incident ('zistenie', the word the directive's Slovak text uses for becoming aware): an early warning (včasné varovanie) within 24 hours, a notification of the serious incident (oznámenie o závažnom kybernetickom bezpečnostnom incidente) within 72 hours, 24 for trust service providers, updates at the CSIRT's request within the period it sets, and a final report (záverečná správa) at the latest one month after the notification (§ 24(3)(a) to (d)). For an incident still ongoing then, an updated final report follows within 30 days of its resolution or, for a cross-border one, of the restoration of normal operation (§ 24(3)(e)). The system is the JISKB, behind a sign-in page: the incident-reporting page of SK-CERT, NBÚ's national centre, gives its address for whoever has been given access, an operator of an essential service for one, and says that only a report made through it meets the statutory duty to report a serious incident.

• A decree puts numbers on what is serious. Annex 1 to NBÚ's Decree No. 226/2025 Coll., in effect since 1 September 2025, lists the criteria of a serious disruption of an operator's functioning, and one is enough. Among them: a complete outage of the activity for more than 60 minutes, or more than 30 minutes for an operator of a critical essential service; a disruption or limitation for more than 180 minutes, or more than 60 minutes for an operator of a critical essential service; a threat to stored, transmitted or processed data, or to the related services, that affects more than 25,000 persons; an economic loss or material damage of more than EUR 250,000 to at least one user; and an event in which a network or information system was accessed in an evidently unauthorised way, or put out of operation, and which could lead to any of the consequences the first seven criteria describe. Annex 2 lists what the early warning and the notification must contain.

• Serious incidents are not all an operator reports. Through the same system it also reports a significant cyber threat it learns of, a near miss that could have caused a serious incident, and a vulnerability of the publicly accessible networks and information systems it operates that can be exploited to cause one and that it could not remove or mitigate in reasonable time (§ 24(5)). The act words the three as a duty; voluntary reports beyond it remain possible (§ 24(6)).

• Within 12 months of its entry in the register an operator adopts at least the general security measures of § 20, in eighteen areas from governance and asset management to the supply chain and certified ICT products, on approved security documentation that matches reality (§ 19(1), § 20(2) and (3)); the digital types apply Implementing Regulation (EU) 2024/2690 instead. The minimum measures include a cybersecurity manager independent of IT operations and development who meets the knowledge standards (§ 20(4)(a)), and the risk analysis covers the political risk of each third party, the risks being approved by the government on NBÚ's opinion (§ 20(5)). NBÚ's decree on the content of the measures is not on Reglyze's record, and Reglyze assesses Slovak operators on the NIS2 substrate.

• An operator that has a third party carry out activities bearing directly on the availability, confidentiality and integrity of its networks and information systems signs a contract with it securing the security measures and the notification duties for the whole term, after a risk analysis (§ 19(2)), unless the third party is itself an operator or the risk is low (§ 19(3)).

• A certified cybersecurity auditor audits the operator within two years of its entry in the register, at the operator's cost, and again after every significant change and at set intervals; the final report goes to NBÚ within 30 days with the remedial measures (§ 29(1) to (5), (7)). An operator without a critical essential service may instead self-assess, the self-assessment done by its cybersecurity manager, and is then audited within five years of the entry (§ 29(8)).

• The act words no training duty for the members of the statutory body (štatutárny orgán), unlike Article 20(2) of the directive: training is one of the measures, with adequate training and retraining for every role, named persons responsible for approving the measures, oversight and training, and a mechanism that keeps the statutory body informed of threats, incidents and the treatment of risks (§ 19(6)(h), § 20(4)(g) and (h)).

• Until 31 December 2026, operators registered before 2025 may keep adopting and implementing security measures under the rules in force until 31 December 2024 (§ 34b(5)). The act gives no notification date for entities already active on 1 January 2025, and NBÚ's notice of 20 February 2025 gives none either.

NIS2 in Slovakia: frequently asked questions

Is NIS2 in force in Slovakia?

Yes. Zákon č. 366/2024 Z. z. amended the Cybersecurity Act, zákon č. 69/2018 Z. z., to transpose NIS2, and has applied since 1 January 2025 (Čl. VII). Slovakia kept its 2018 act and its vocabulary: the obliged party is still the operator of an essential service, entered in NBÚ's register. The European Commission closed its infringement case on 8 October 2025.

When do a Slovak operator's duties start?

From its entry in NBÚ's register, not from its notification. An entity covered by § 17(1) notifies NBÚ within 60 days of starting the activity (§ 17(2)); NBÚ enters it and gives notice through the single cybersecurity information system and the electronic mailbox, without a separate decision (§ 17(3), (4)); the duties start at the earliest on the 30th day after the entry (§ 17(5)). The general security measures follow within 12 months of the entry (§ 19(1)) and the first cybersecurity audit within two years (§ 29(1)).

Where does a Slovak operator report a serious cybersecurity incident?

Through the single cybersecurity information system (jednotný informačný systém kybernetickej bezpečnosti) that NBÚ manages and operates (§ 24(3), § 5(1)(j)); NBÚ's Národné centrum kybernetickej bezpečnosti is the national CSIRT, except in the sectors whose central state body performs the CSIRT's tasks (§ 6(1)). The early warning is due within 24 hours and the notification within 72 hours of becoming aware ('zistenie') of the incident, the final report one month after the notification. The system is the JISKB, behind a sign-in page: the incident-reporting page of SK-CERT, NBÚ's national centre, gives its address and says that only a report made through it meets the statutory duty. Entities under DORA report through DORA's competent authority (§ 24(8)).

When is an incident serious under Slovak law?

When it is a large-scale incident, when it has caused or may cause a serious disruption of the operator's functioning or damage, other harm to property or lost profit on a large scale, or when it has affected or may affect other persons by causing them damage, other harm or lost profit to a considerable extent (§ 24(2)). NBÚ's Decree No. 226/2025 Coll. says what a serious disruption is, in eight criteria of which one is enough: a complete outage of the activity for more than 60 minutes, or more than 30 minutes for an operator of a critical essential service; a disruption or limitation for more than 180 minutes, or more than 60 minutes for an operator of a critical essential service; a threat to data protected under a special regulation; a threat to stored, transmitted or processed data or to the related services that affects more than 25,000 persons; an economic loss above 0.1 % of gross domestic product; an economic loss or material damage of more than EUR 250,000 to at least one user; rescue work, more than 100 injured persons requiring medical treatment or the death of at least one person; and an event in which a network or information system was accessed in an evidently unauthorised way or put out of operation and which could cause any of these, an event that disrupts or may significantly disrupt another operator of a critical essential service, or an event that is a significant incident under Article 3 of Implementing Regulation (EU) 2024/2690 or an incident under Act No. 367/2024 Coll. on critical infrastructure.

Does a Slovak operator need a cybersecurity manager?

Yes. The minimum security measures include a cybersecurity manager who is independent of the structure that runs IT operations and development when designing, adopting and enforcing the measures, and who meets the knowledge standards for the role (§ 20(4)(a)). An operator without a critical essential service may have that manager carry out a self-assessment instead of the two-year audit, and is then audited within five years of the entry (§ 29(8)).

Which deadline applies to a change in a Slovak operator's registered data?

The act gives two: 14 days through the single information system in § 17(6), and 30 days in § 19(7) for what reads as the same duty, so 14 days is the safe one. A critical operator also reports the conclusion and the end of a contract with a third party of significant influence, and the digital types report changes to their data within three months (§ 21(3)).