Slovenia

(a) What is the NIS2 implementation status?

NIS2 has not been implemented yet. The transposition deadline has been missed, as well as the governmental timeline of the end of 2024. On April 10th 2025 the Government approved a draft law (ZInfV-1). The Government has submitted the proposal of law to the National Assembly under the urgent procedure.

(b) What is the envisaged NIS2 implementation timeline?

From the Head of the Information and Cybersecurity Divison at the Government Information Security Office we received information that they anticipate the government's consideration of the draft law by the end of February 2025 and its discussion and adoption in the National Assembly of the Republic of Slovenia by the end of May 2025.

(c) What does the NIS2 mean for other national cybersecurity legislation?

It is expected to be an upgrade of the existing Information Security Act.

In line with the Directive, the law provides, among other things, for the extension of the number of obliged entities that are required to take measures to ensure cyber security, to include both public sector and business entities. Obligors will be required to prepare, among other things, risk assessments and cyber incident management plans.

(d) Who will be the supervisory authority and how are they preparing the market?

The Government Information Security Office.

(e) What should you be doing/on the lookout for?

Normally, for such technical directives, we expect the national law to, more or less, strictly follow the wording of the directive and not deviate from substantive obligations under NIS2. The already published draft of the new Information Security Act (ZInfV-1) does not majorly deviate from the directive.