NIS2by country

NIS2 in Slovenia

Zakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/25

Law in force since

Law
ZInfV-1
Authority
Government Office for Information Security (URSIV)
Classes
bistveni subjekt (essential), pomembni subjekt (important)
Register
URSIV self-registration form (ursiv.si)
ISO 27001
Helps, not enough alone
Self-check
URSIV self-registration form

Check your company for Slovenia

Get the NIS2 dates for Slovenia

  • 1 date as a calendar file.
  • An alert when the rules change.

This site stores your email and emails you when the NIS2 rules in Slovenia change. Unsubscribe at any time.

The law

ZInfV-1 transposes NIS2. It replaced the Information Security Act of 2018. The law took effect on 2025-06-19, 15 days after publication.

Name
Zakon o informacijski varnosti (ZInfV-1), Uradni list RS, št. 40/25Information Security Act
Published
2025-06-04
In force
2025-06-19
Text
Read the ZInfV-1

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Slovenia differs

  • Article 7(2)(3) ZInfV-1 Public electronic communications network providers with at least 50 employees and EUR 10 million turnover or balance sheet are essential entities. Under the Directive they would be important.
  • Article 7(2)(3) ZInfV-1 Public electronic communications service providers with at least 50 employees and EUR 10 million turnover or balance sheet are essential entities. Under the Directive they would be important.
  • Articles 6(1) and 7(2)(1) ZInfV-1 The Slovenian size test differs. An entity needs at least 50 employees and EUR 10 million turnover or balance sheet to be in scope. An essential entity needs at least 250 employees, or EUR 50 million turnover, or EUR 43 million balance sheet.
  • Article 6(3) ZInfV-1 Cities (mestne občine) are in scope as local public administration. Public sector rules are national, so the checker does not decide them.

Also note

  • Banks and financial market infrastructure follow DORA for risk management and reporting. Chapters IV and IX of ZInfV-1 do not apply to them.
  • The security measures for most entities are due 2026-12-19. Former essential-service operators and electronic communications operators had until 2026-06-19.

Registration

Register within 30 days after you first meet the criteria. Companies in scope on 2025-06-19 had until 2025-12-19, and that date has passed. Report a change of data within 10 working days.

Portal
URSIV self-registration form (ursiv.si)
Rule
Deadline counts from the day you come into scope
Deadline
2025-12-19
Later entrants
30 days after the rules first apply to you
You need
The URSIV digital form. Send the signed PDF and the CSV file by email to gp.uiv@gov.si.
Changes
Report changes to your data within 10 days

Incident reporting

  1. 24 hEarly warning
  2. 72 hIncident notification
  3. 1 monthFinal reportafter the notification

Send the reports to the competent CSIRT by email: SI-CERT (cert@cert.si) for companies, SIGOV-CERT for public bodies.

The 24 and 72 hours run from detection. URSIV guidance of 2026-06 names email as the reporting channel.

Measures and proof

Essential
A compliance assessment at least every 2 years and after a significant incident. An information systems auditor does it, as an audit or as part of an internal audit. The inspector can also order an audit.
Important
A documented self-assessment at least every 2 years and after a significant incident. Write a declaration of compliance if you meet the rules, or a declaration of non-conformity with a plan if you do not.

The dates, in order

  1. Law in force. Incident reporting duties apply from this date.
  2. First self-registration deadline for entities in scope on day 1
  3. Security measures due for former essential-service operators and electronic communications operators
  4. Security measures and security documentation due for all other essential and important entities Next

Duties of management

Responsible persons approve the risk measures and supervise them. They train at least every 4 years. They answer for breaches of their duties. For an essential entity, an inspector can ask for a temporary ban on top management functions.

Fines

The ceiling is the higher of a fixed amount and a share of the annual turnover of the entity itself.

Fine ceilings, Articles 52 and 53 ZInfV-1. The higher amount applies. Each "At EUR" figure is the ceiling at that entity turnover.
Class Ceiling At EUR 20mAt EUR 500mAt EUR 2bn
Essential EUR 10m or 2% EUR 10mEUR 10mEUR 40m
Important EUR 7m or 1.4% EUR 7mEUR 7mEUR 28m

The % applies to the annual turnover of the legal person itself. The range starts at 0.5% (essential) and 0.3% (important), with a minimum of EUR 10,000 and EUR 7,000. A responsible person can be fined EUR 1,000-10,000.