NIS2 Compliance in Slovenia

NIS2 covers 18 sectors: Annex I (highly critical — energy, transport, banking, financial markets, health, water, digital infrastructure, ICT service management, public administration, space) and Annex II (other critical — postal services, waste management, chemicals, food, manufacturing, digital providers, research). Transposed via the Information Security Act (ZInfV, 2024); SI-CERT serves as national CSIRT and the Information Commissioner oversees compliance.

In Slovenia, the primary competent authority is SI-CERT / Information Commissioner. The national CSIRT is SI-CERT, which handles significant incident notifications and cybersecurity coordination.

Organisations must submit an early warning to SI-CERT within 24 hours of a significant incident, a formal notification within 72 hours, and a final report within one month — per NIS2 Article 23.

Essential entities face fines up to €10 million or 2% of global annual turnover. Important entities face up to €7 million or 1.4% of global annual turnover. Exact enforcement varies by national transposition.