Slovenia transposed NIS2 late, through the Information Security Act (Zakon o informacijski varnosti, ZInfV-1), and the first self-registration deadline has already passed, so in-scope organisations that have not registered with the Government Information Security Office are out of step today. ZInfV-1 was published in the Official Gazette (Uradni list RS) No. 40/2025 on 4 June 2025 and entered into force on 19 June 2025, replacing the earlier ZInfV that implemented the first NIS Directive. It keeps the Directive's split between essential (bistveni) and important (pomembni) entities, adds urban municipalities and services named in civil protection plans, and puts registration, supervision and crisis management in one office, URSIV. This guide covers scope, the authorities and CSIRTs, registration mechanics, the measures, incident reporting, sanctions and what the Act means for service accounts, API keys and AI agents. It is for CISOs, compliance leads and auditors with Slovenian operations. The Directive itself is in the NIS2 Directive Guide and the cross-country picture in the NIS2 Transposition Tracker.
Status, checked 14 November 2026: ZInfV-1 is in force, with publication and entry into force dates confirmed on the Government of Slovenia (GOV.SI) announcements. Registration rules come from URSIV's own form instructions (version 1.3, January 2026) and its ZInfV-1 leaflet. The full official text on the Uradni list and PISRS sites could not be read for this review, so the fine amounts and the measures deadline below each rest on one named secondary source and are attributed in the text: confirm them against the official text before relying on them. The EU has proposed amendments to NIS2 that may lead to Slovenian changes later. This page is not legal advice.
Key takeaways
- Registration was due 19 December 2025: entities already in scope when ZInfV-1 took effect had six months to self-register; newcomers have 30 days from meeting the criteria or from a designation decision (Art. 8).
- One office does most of the work: URSIV is the competent authority, single point of contact and crisis body, with the Information Security Inspectorate, SIGOV-CERT and the NCC-SI inside it; SI-CERT at ARNES handles other entities.
- Measures may be due by 19 December 2026: a vendor wiki reports this deadline for most entities, with earlier dates for former NIS1 operators; confirm with URSIV.
- Fines reported up to EUR 10 million: PwC Legal reports caps of EUR 10 million for essential and EUR 7 million for important entities, with personal fines for responsible persons.
- Machine identities sit inside the measures: MFA, identity and access management, logging and supplier rules in URSIV's own list reach service accounts, API keys, certificates and AI agents.
Scope: essential and important entities
ZInfV-1 applies to entities carrying out at least one activity in Annex 1 (high-criticality sectors) or Annex 2 (other critical sectors) that meet the size test, plus entities brought in regardless of size. One listed activity is enough, even if it is not the entity's main registered activity, according to URSIV's form instructions.
| Category | Who (ZInfV-1) | Article |
|---|---|---|
| In scope (size test) | Annex 1 or 2 entities with at least 50 employees and turnover or balance sheet of at least EUR 10 million | Art. 6(1) |
| In scope regardless of size | For example domain name registration service providers and urban municipalities (mestne občine) | Art. 6(2) and (3) |
| Essential entity | Annex 1 entities with at least 250 employees, or turnover of at least EUR 50 million, or balance sheet of at least EUR 43 million; qualified trust service providers, TLD registries and DNS service providers regardless of size; qualifying public electronic communications providers; state-level public administration bodies; critical infrastructure entities; others designated by the Government | Art. 7(2) |
| Important entity | Annex 2 entity types; entities designated by Government decision; services of state importance in civil protection plans | Art. 7(3) |
| Outside the registration duty | Banking and financial market infrastructure entities (covered by DORA, Art. 3(1)); the Bank of Slovenia (Art. 6(5)); entities under Art. 6(4) that apply Art. 27 | Arts. 3, 6 |
URSIV's leaflet lists the high-criticality sectors as energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration and space, and the other critical sectors as postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research and municipalities.
Authorities and CSIRTs
| Body | Role under ZInfV-1 |
|---|---|
| URSIV (Urad Vlade Republike Slovenije za informacijsko varnost) | Competent national authority, single point of contact, large-scale incident and crisis management body, keeper of the entity register |
| Information Security Inspectorate (within URSIV) | Inspections, corrective orders, misdemeanour procedures |
| SIGOV-CERT (within URSIV) | CSIRT for public administration entities and trust service providers |
| SI-CERT (within ARNES) | CSIRT for all other entities and for voluntary reporters |
| NCC-SI (within URSIV) | National Cybersecurity Coordination Centre |
Sector regulators stay competent where a sector law applies instead, most notably DORA for finance. See the DORA and NIS2 Overlap Mapping Guide.
Registration with URSIV
Self-registration is the first practical duty. URSIV's instructions (version 1.3, January 2026) set three clocks under Art. 8: entities already meeting the criteria on 19 June 2025 had until 19 December 2025; entities that meet the criteria later register within 30 days; and entities served with a designation decision register within 30 days of service. An entity that falls below the thresholds can notify URSIV at its balance-sheet date under Art. 8(6).
- Complete the online form on ursiv.si (URSIV estimates about three minutes). Public law entities skip the company-size step.
- Download the CSV and PDF the form produces.
- Sign the PDF electronically by the organisation's contact person.
- Email both files to URSIV at the address in the instructions. Registration is complete only when both are sent. URSIV says direct submission will replace email once the mechanism is fully live.
The data asked for goes beyond a company profile: sector and subsector, size data, an information security contact and deputy, public IP address blocks, autonomous system numbers, domain names and the EU Member States where services are provided. Treat that inventory as a controlled record, because it is also a map of your attack surface. Keep it current: the instructions say entities must report changes within the Art. 8 deadlines, and a vendor wiki (nisd2.eu) reports a 10 working day window for changes.
Timeline and deadlines
| Date | Event | Source |
|---|---|---|
| 7 May 2025 | European Commission reasoned opinion to Slovenia, among 19 Member States, for incomplete transposition | nisd2.eu; NIS2 Transposition Tracker |
| 23 May 2025 | National Assembly adopts ZInfV-1 | GOV.SI |
| 4 June 2025 | Published in Uradni list RS No. 40/2025 | GOV.SI |
| 19 June 2025 | Entry into force | GOV.SI |
| 19 December 2025 | First self-registration due for entities already in scope | URSIV instructions |
| 19 June 2026 | Measures due for former NIS1 operators, state bodies and telecoms operators, as reported by nisd2.eu | Single secondary source |
| 19 December 2026 | Measures (Directive Arts. 21 and 22) due for other entities, as reported by nisd2.eu | Single secondary source |
Key obligations
URSIV's leaflet lists the measures entities must take, proportionate to risk exposure, size, likelihood and severity of incidents. For digital infrastructure and ICT service providers, Commission Implementing Regulation (EU) 2024/2690 applies directly; see the NIS2 Implementing Regulation 2024/2690 Guide.
- Technical: secure software, vulnerability management, malware protection, MFA and secure communications, secure cloud management, backups, log retention, cryptography, traffic management, physical protection.
- Organisational: identity verification and access management, clear responsibilities, cyber hygiene and regular staff training, supplier security requirements. See the NIS2 Supply Chain Security Guide.
- Review cycle: check compliance and correct gaps at least once a year, and whenever vulnerabilities are found.
- Management body: approves and oversees the measures and can be held liable (Art. 20(1), as reported by nisd2.eu), and takes part in regular training for responsible persons (URSIV leaflet). See the NIS2 Management Liability Executive Briefing.
- Standards: PwC Legal reports that entities must follow ENISA guidance and European and international standards, which URSIV publicises.
Incident reporting
Significant incidents go to the competent CSIRT. URSIV's leaflet sets out the stages: an early warning after detection, with an initial assessment and any cross-border impact; an incident notification with severity, impact and indicators; an interim report on CSIRT request; a progress report one month after notification if the incident is still running; and a final report one month after notification or after resolution. The leaflet does not state hour limits; nisd2.eu reports that Slovenia keeps the Directive's 24 hours and 72 hours, and that reports go by email to SI-CERT or SIGOV-CERT until URSIV's single reporting platform is live. Voluntary reports of incidents, threats and near misses are accepted, and URSIV states they are not penalised or treated as admissions.
| Stage | Content | Timing |
|---|---|---|
| Early warning | Initial assessment, cross-border impact | After detection; 24 hours under Directive Art. 23 |
| Incident notification | Assessment, severity, impact, indicators of compromise | 72 hours under Directive Art. 23 |
| Interim report | Status update | On CSIRT request |
| Progress report | Status of an ongoing incident | One month after notification |
| Final report | Detail, impact, measures taken | One month after notification or resolution |
Supervision and sanctions
The Information Security Inspectorate can order corrective measures, require a compliance audit in extraordinary inspections and order public disclosure of violations, according to URSIV's leaflet. The leaflet mentions misdemeanour fines for serious or repeated violations without amounts. The figures below are as reported by PwC Legal (March 2026), a single secondary source:
| Who | Legal entity cap | Responsible person |
|---|---|---|
| Essential entity | Up to EUR 10,000,000, or between 0.5% and 2% of total annual turnover | Up to EUR 10,000 |
| Important entity | Up to EUR 7,000,000, or between 0.3% and 1.4% of total annual turnover | Up to EUR 7,000 |
| Breach of Regulation (EU) 2019/881 | Up to EUR 50,000 | Up to EUR 5,000 |
What it means for AI agents and non-human identities
URSIV's measure list names MFA, identity verification and access management, log retention and supplier requirements. Each reaches machine identities directly.
- Access management: service accounts, API keys, OAuth clients and agent credentials need owners, least privilege and rotation. See the Non-Human Identity (NHI) Guide.
- MFA gaps: machine identities cannot do MFA, so compensate with workload identity, short-lived tokens and network binding, and document that decision for inspectors.
- Logging: keep authentication and API logs for non-human identities long enough to support the one-month final report.
- Registration data: the IP blocks, ASNs and domains you register should match the inventory your machine identities actually use.
Common failure patterns
- Assuming finance rules cover the group: DORA exempts banking entities, not their non-financial subsidiaries in Annex sectors.
- Registering once and forgetting: new IP ranges, domains or a change of contact person must be reported.
- Waiting for the platform: email reporting applies now; an incident during the interim still has a clock.
- Relying on secondary summaries: fine figures and deadlines differ between commentaries; read the Uradni list text.
- Leaving machine identities out of scope: access control duties apply to every account, not just staff.
Practitioner checklist
- Confirm Annex activity and size test, and whether you are essential or important.
- Check that registration with URSIV was completed and both files were sent.
- Set an owner and process for reporting registration changes.
- Confirm your CSIRT (SI-CERT or SIGOV-CERT) and rehearse early warning, notification and final report.
- Map controls to URSIV's measure list and, where it applies, Regulation 2024/2690.
- Schedule the annual compliance review and management training.
- Inventory service accounts, API keys and AI agents with owners.
- Verify fines and measure deadlines against the official ZInfV-1 text.
Standards and references
- GOV.SI: Zakon o informacijski varnosti (ZInfV-1) objavljen v Uradnem listu
- GOV.SI: Državni zbor sprejel nov Zakon o informacijski varnosti
- URSIV: Navodila za izpolnjevanje obrazca (v1.3)
- URSIV: Zloženka ZInfV-1
- PwC Legal: NIS 2 Slovenia
- nisd2.eu: NIS 2 status Slovenia
Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Transposition Tracker · Croatia NIS2 Implementation Guide · NIS2 Readiness Checklist. This guide summarises the Slovenian Information Security Act (ZInfV-1) as it stood on 14 November 2026 and is not legal advice.