Is NIS2 in force in Slovenia?

Yes. The Zakon o informacijski varnosti (ZInfV-1) was published in Uradni list RS, št. 40/2025 on 4 June 2025 and entered into force on 19 June 2025 (Art. 70), repealing the 2018 ZInfV, whose rules survived one year for the operators it already covered (Art. 62). Incident reporting and self-registration have applied since then; the risk-management measures of Arts. 21 and 22 have an 18-month transition and must be in place by 19 December 2026 (Art. 62(1)), one year for former operators of essential services and e-communications operators (Art. 62(2) and (3)). The European Commission closed its infringement case against Slovenia on 30 January 2026.

Which Slovenian companies are in scope of ZInfV-1?

Annex 1 and 2 entities with at least 50 employees and at least EUR 10 million of annual turnover or balance-sheet total, both conditions together (Art. 6(1)). Public e-communications providers, trust service providers, TLD registries and DNS providers are in at any size, as are state-level public administration, critical entities, domain registrars and urban municipalities. Banka Slovenije is excluded, and banks and financial-market infrastructures follow DORA instead of the act's measures and incident chapters (Art. 3).

When and how do entities register with URSIV?

Within 30 days of meeting the criteria (Art. 8(2)), through URSIV's official digital form, whose output is currently e-mailed to the office as a signed PDF plus a CSV file; the form exists only in Slovenian. Entities already in scope on 19 June 2025 had until 19 December 2025. Changes are notified within 10 working days. Failing to register is a separate offence: EUR 3,000 to 15,000 for essential and EUR 1,000 to 10,000 for important entities.

Where does a Slovenian company report a significant incident, and how fast?

To SI-CERT by e-mail (cert@cert.si); public administration and state-run trust services report to SIGOV-CERT (Art. 59). The clock runs from detection: early message within 24 hours, notification within 72 hours, final report one month after the notification, with a progress report if the incident is still ongoing (Art. 30(1)). Trust service providers notify within 24 hours. A national reporting platform is foreseen (Art. 30(10)) but reporting stays by e-mail until it exists.

How high are NIS2 fines in Slovenia?

ZInfV-1 states fines as ranges. An essential entity risks 0.5% to 2% of its total annual turnover, not less than EUR 10,000 and not more than EUR 10 million (Art. 52(1)); an important entity 0.3% to 1.4%, between EUR 7,000 and EUR 7 million (Art. 53(1)). The responsible manager personally risks EUR 1,000 to 10,000 or EUR 1,000 to 7,000, and inspectors can request a temporary ban on management functions at an essential entity (Art. 46(3)).

← Back to Reglyze

Transposed & Enforced

NIS2 in Slovenia

Everything you need to know about the NIS2 directive in Slovenija: transposition law, competent authority, fines, deadlines, and how Reglyze helps SMEs become compliant.

Slovenia replaced its 2018 Information Security Act with the Zakon o informacijski varnosti (ZInfV-1), adopted on 23 May 2025, published in Uradni list RS, št. 40/2025 and in force since 19 June 2025, with URSIV, the Government Information Security Office, as the single competent authority. Its scope test is stricter than the directive's own yardstick (at least 50 employees and EUR 10 million, cumulatively), while e-communications providers, trust services, TLD and DNS operators, state administration and urban municipalities are caught at any size, and the risk-management measures become enforceable for most entities on 19 December 2026, one year earlier for former operators of essential services and e-communications operators.

Key facts at a glance

Transposition Law

Zakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/2025

Adopted / in force: 2025-06-19

Competent Authority

Urad Vlade Republike Slovenije za informacijsko varnost (Government Information Security Office) (URSIV)

https://www.gov.si/drzavni-organi/vladne-sluzbe/urad-vlade-za-informacijsko-varnost/

Fines — Essential

Up to EUR 10 million or 2% of total annual turnover (the directive's ceilings), applied in Slovenia as a band from 0.5% to 2% of turnover with a EUR 10,000 floor (Art. 52(1) ZInfV-1); the responsible person personally risks EUR 1,000 to 10,000

Fines — Important

Up to EUR 7 million or 1.4% of total annual turnover (the directive's ceilings), applied in Slovenia as a band from 0.3% to 1.4% of turnover with a EUR 7,000 floor (Art. 53(1) ZInfV-1); the responsible person personally risks EUR 1,000 to 7,000

These ceilings come from the directive — see how NIS2 fines are calculated, recent enforcement cases and director personal liability.

Start now in Slovenia: nothing to redo later

Reglyze runs your Slovenia NIS2 compliance on the EU baseline today: scoping, the AI-guided assessment, AI-drafted documents and incident notification to SI-CERT (national CSIRT, operated by ARNES); SIGOV-CERT for public administration.

Your national rules (Zakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/2025) layer national specifics on top of NIS2. When they apply to you, what you have built carries straight over: your scores, your documents and your evidence are kept, not reset. You simply add the national layer (registration with URSIV and local incident notification) onto your existing work. You never start from scratch.

Priority sectors for NIS2 in Slovenia

NIS2 covers 18 sectors across Annex I (essential) and Annex II (important). These are the sectors where Slovenia's transposition and URSIV supervision focus most.

Electronic communications, trust services, TLD and DNS

Caught at any size (Art. 6(2) pt 1): a public network or service provider is at least an important entity, while a qualified trust service provider, a TLD registry or a DNS provider is an essential one (Art. 7(2) pt 2). Trust service providers also notify incidents within 24 hours instead of 72 (Art. 30(2)), and e-communications operators already covered by ZEKom-2 had until 19 June 2026 for the risk-management measures (Art. 62(3)).

Public administration and urban municipalities

Ministries, government offices, administrative units and the Annex 3 agencies are essential entities regardless of size (Art. 6(2) pt 6, Art. 7(2) pt 4); urban municipalities (mestne občine) are in as local public administration (Art. 6(3) pt 4). Both report to SIGOV-CERT rather than SI-CERT (Art. 59).

Mid-sized industry, energy, health and transport operators

Annex 1 and 2 companies enter at 50 employees and EUR 10 million (cumulative, Art. 6(1)) and become essential at 250 employees or EUR 50 million turnover or a EUR 43 million balance sheet (Art. 7(2) pt 1). Operators designated under the 2018 ZInfV before 16 January 2023 stayed essential entities on day one (Art. 61) and had until 19 June 2026 for the Art. 21-22 measures (Art. 62(2)).

Key deadlines

2025-06-19

ZInfV-1 entered into force (Art. 70, fifteenth day after publication in Uradni list RS, št. 40/2025). Incident reporting to the competent CSIRT has applied since this date.

2025-12-19

First self-registration window closed: entities already meeting the criteria on 19 June 2025 had six months to register with URSIV (Art. 60(2)). Any entity that comes into scope later registers within 30 days (Art. 8(2)).

2026-12-19

Risk-management measures of Arts. 21 and 22 (a documented ISMS and BCMS plus the Art. 22(2) measure list) must be in place for most entities: eighteen months after entry into force (Art. 62(1)). Former operators of essential services, the state bodies designated under the 2018 ZInfV and electronic-communications operators had one year, until 19 June 2026 (Art. 62(2) and (3)).

Is your company in scope? Common Slovenia scenarios

Two worked examples of how NIS2 scoping plays out in Slovenia. Not sure where you land? Run the free NIS2 scope checker.

A 5-person Slovenian DNS and web-hosting provider

Depends on the service, not the size

If it runs authoritative DNS for third parties it is an essential entity at any size (Art. 6(2) pt 1, Art. 7(2) pt 2): registration within 30 days, SI-CERT reporting, measures by 19 December 2026. If it only sells hosting, cloud or data-centre capacity it fails the cumulative 50-employee / EUR 10 million test and is outside ZInfV-1 unless the Government designates it (Art. 6(2) pts 2 to 5) or it is a critical entity, though its obliged customers can impose supply-chain requirements on it (Art. 22(2) pt 10).

A 120-employee manufacturer in Novo mesto with EUR 30 million turnover

In scope, important entity

Manufacturing is an Annex 2 sector; at 120 staff and EUR 30 million the cumulative Art. 6(1) test is met and the essential thresholds are not, so it is an important entity (Art. 7(3)). It had to self-register with URSIV by 19 December 2025, has reported significant incidents to SI-CERT since 19 June 2025, must have the Art. 21-22 measures in place by 19 December 2026 and then self-assesses every two years (Art. 25(3)).

What Slovenia businesses need to know

Slovenia transposed NIS2 with a new Information Security Act, ZInfV-1, adopted by the Državni zbor on 23 May 2025, published in Uradni list RS, št. 40/2025 on 4 June 2025 and in force since 19 June 2025. It repealed the 2018 ZInfV (Art. 69), whose security rules kept applying for one more year to the operators it already covered (Art. 62); the European Commission closed its infringement case INFR(2024)0298 on 30 January 2026.
The general size test is cumulative: an Annex 1 or 2 entity is in scope only with at least 50 employees AND an annual turnover or balance-sheet total of at least EUR 10 million (Art. 6(1)), the reading URSIV also gives. Public e-communications providers, trust service providers, TLD registries and DNS providers are in at any size (Art. 6(2)); so are state-level public administration (Art. 6(2) pt 6), critical entities, domain registrars and urban municipalities (Art. 6(3)).
Essential entities are Annex 1 types with at least 250 employees OR EUR 50 million turnover OR a EUR 43 million balance sheet, qualified trust service providers, TLD registries and DNS providers of any size, e-communications providers from 50 staff and EUR 10 million, state-level public administration, critical entities and entities designated by Government decision (Art. 7(2)). The other obliged entities are important entities (Art. 7(3)); domain registrars are obliged but belong to neither class (Art. 7(1)).
Entities self-register with URSIV within 30 days of meeting the criteria (Art. 8(2)), through URSIV's official digital form, currently returned by e-mail as a signed PDF plus a CSV file and available in Slovenian only; entities already in scope on 19 June 2025 had until 19 December 2025. Changes are notified within 10 working days (Art. 8(5)). Missing or late registration carries its own fine band: EUR 3,000 to 15,000 for essential and EUR 1,000 to 10,000 for important entities.
Significant incidents go to the competent CSIRT: SI-CERT for companies, SIGOV-CERT for public administration (Art. 59). Early message within 24 hours of detection, notification within 72 hours, final report one month after the notification (Art. 30(1)); trust service providers notify within 24 hours (Art. 30(2)). Until the national platform exists, reports are sent by e-mail (Art. 60(6)).
Management approves and supervises the risk-management measures (Art. 20(2)) and trains at least every four years (Art. 20(3)) in a free course run by URSIV of at least eight teaching hours (Uredba 78/2025); ICT system administrators train every year (Art. 20(5)). Inspectors can request a temporary ban on management functions at an essential entity (Art. 46(3)).
The measures have an 18-month transition for most entities, until 19 December 2026 (Art. 62(1)); former operators of essential services, designated state bodies and e-communications operators had one year, until 19 June 2026 (Art. 62(2) and (3)). Essential entities then undergo a conformity assessment at least every two years, important entities a self-assessment with a declaration of conformity (Art. 25); compliance with the measures is checked at least yearly (Art. 22(5)) and logs are kept for at least six months (Art. 24(4)).

How URSIV enforces NIS2 in Slovenia

URSIV is the single competent authority (Art. 10(1)) and inspects through its internal Information Security Inspectorate; it also runs the self-registration mechanism, whose list is protected data that is never published, so obligations arise from the law itself, not from being listed. Inspectors can order corrective measures, request a temporary ban on management functions at an essential entity (Art. 46(3)) and impose coercive fines of up to EUR 10,000 per round for essential and EUR 7,000 for important entities (Arts. 46 and 47). Misdemeanour fines are stated as ranges: 0.5% to 2% of turnover between EUR 10,000 and EUR 10 million for essential entities (Art. 52), 0.3% to 1.4% between EUR 7,000 and EUR 7 million for important ones (Art. 53), with separate smaller bands for registration, training and information duties and personal fines for the responsible person. The risk-management measures are enforceable from 19 December 2026 for most entities, and since 19 June 2026 for former operators of essential services, designated state bodies and e-communications operators (Art. 62); URSIV already issues binding threat assessments and orders under Art. 37, as it did on 21 October 2026 for a PHP vulnerability wave.

NIS2 in Slovenia: frequently asked questions

Is NIS2 in force in Slovenia?: Yes. The Zakon o informacijski varnosti (ZInfV-1) was published in Uradni list RS, št. 40/2025 on 4 June 2025 and entered into force on 19 June 2025 (Art. 70), repealing the 2018 ZInfV, whose rules survived one year for the operators it already covered (Art. 62). Incident reporting and self-registration have applied since then; the risk-management measures of Arts. 21 and 22 have an 18-month transition and must be in place by 19 December 2026 (Art. 62(1)), one year for former operators of essential services and e-communications operators (Art. 62(2) and (3)). The European Commission closed its infringement case against Slovenia on 30 January 2026.
Which Slovenian companies are in scope of ZInfV-1?: Annex 1 and 2 entities with at least 50 employees and at least EUR 10 million of annual turnover or balance-sheet total, both conditions together (Art. 6(1)). Public e-communications providers, trust service providers, TLD registries and DNS providers are in at any size, as are state-level public administration, critical entities, domain registrars and urban municipalities. Banka Slovenije is excluded, and banks and financial-market infrastructures follow DORA instead of the act's measures and incident chapters (Art. 3).
When and how do entities register with URSIV?: Within 30 days of meeting the criteria (Art. 8(2)), through URSIV's official digital form, whose output is currently e-mailed to the office as a signed PDF plus a CSV file; the form exists only in Slovenian. Entities already in scope on 19 June 2025 had until 19 December 2025. Changes are notified within 10 working days. Failing to register is a separate offence: EUR 3,000 to 15,000 for essential and EUR 1,000 to 10,000 for important entities.
Where does a Slovenian company report a significant incident, and how fast?: To SI-CERT by e-mail ([email protected]); public administration and state-run trust services report to SIGOV-CERT (Art. 59). The clock runs from detection: early message within 24 hours, notification within 72 hours, final report one month after the notification, with a progress report if the incident is still ongoing (Art. 30(1)). Trust service providers notify within 24 hours. A national reporting platform is foreseen (Art. 30(10)) but reporting stays by e-mail until it exists.
How high are NIS2 fines in Slovenia?: ZInfV-1 states fines as ranges. An essential entity risks 0.5% to 2% of its total annual turnover, not less than EUR 10,000 and not more than EUR 10 million (Art. 52(1)); an important entity 0.3% to 1.4%, between EUR 7,000 and EUR 7 million (Art. 53(1)). The responsible manager personally risks EUR 1,000 to 10,000 or EUR 1,000 to 7,000, and inspectors can request a temporary ban on management functions at an essential entity (Art. 46(3)).

Official sources

Primary references for NIS2 in Slovenia — verify the latest text and deadlines directly with the authority.

Ready to become NIS2 compliant in Slovenia?

Reglyze is the AI-powered NIS2 compliance platform built for European SMEs. Start free — scoping, gap assessment, and policy generation tailored to URSIV requirements.

NIS2 in other EU countries