NIS2 in Slovakia

The law

Slovakia changed its existing cybersecurity act instead of passing a new one. Act 366/2024 took effect on 2025-01-01 and brought in the NIS2 rules.

Name

Zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti, v znení zákona č. 366/2024 Z. z.Act 69/2018 on Cybersecurity, as amended by Act 366/2024

Published

2024-12-19

In force

2025-01-01

Text

Read the Act 69/2018

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Slovakia differs

• § 18(1)(f) Act 69/2018 Medium-sized public electronic communications network providers run a critical essential service. Under the Directive they would be important.
• § 18(1)(f) Act 69/2018 Medium-sized public electronic communications service providers run a critical essential service. Under the Directive they would be important.
• § 17(1)(c) and § 18(1)(g) Act 69/2018 A sole provider of a key service in Slovakia, or an entity that is critical for its sector, is in scope at any size. It counts as a critical operator.
• § 17(1)(f) Act 69/2018 Cities are in scope when a disruption could harm public order, safety or health. Public sector rules are national, so the checker does not decide them.

Also note

• Slovak law does not use the terms essential and important entity. It has operators of an essential service. The subset that runs a critical essential service gets the stricter audit and the higher fine.
• Operators registered before 2025-01-01 count as operators of a critical essential service. NBU can change this status until 2026-12-31.
• NBU Decree 227/2025 on security measures applies from 2025-09-01.

Registration

Notify NBU within 60 days after you start an activity in scope. NBU enters you in the register and confirms in JISKB and in your mailbox. Your duties start on the date in the entry notice, at the earliest 30 days after the entry. Report a change of registered data within 14 days (the law also says 30 days in another provision, so use 14).

Portal

NBU registration form (filed through the central government portal)

Rule

Deadline counts from the day you come into scope

Later entrants

60 days after the rules first apply to you

You need

An active electronic mailbox (elektronická schránka) and the NBU notification form, filed through the central public administration portal.

Changes

Report changes to your data within 14 days

Incident reporting

1. 24 hEarly warning
2. 72 hIncident notification
3. 1 monthFinal reportafter the notification

Send the reports to NBU, through the unified cybersecurity information system (JISKB).

The 24 and 72 hours run from detection.

Measures and proof

Essential

An audit by a certified cybersecurity auditor within 2 years after the register entry. Then repeat the audit at the interval NBU sets. Send the final report and the remediation plan to NBU within 30 days after the audit.

Important

A self-assessment in JISKB, done by the cybersecurity manager, at the legal interval. An audit by a certified auditor is still due within 5 years after the register entry. No self-assessment happens in the year an audit is due.

The date

1. 2026-12-31 Last day to follow the pre-2025 security and audit rules (transition period) Next

Duties of management

The operator must run a mechanism that informs the statutory body and the responsible managers early about threats, vulnerabilities and incidents. The statutory body also appoints a cybersecurity manager who is independent of IT operations.

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

The 2% ceiling applies to operators of a critical essential service. Minimum fines are EUR 500 (critical) and EUR 300. Lesser breaches, for example a late notice of registration, carry a ceiling of EUR 500,000.