NIS2 obligations in Slovakia

Competent authority & CSIRT Legal ref: Annex 1, 2

• Competent Authorities for different sectors ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Annex 1, 2

• Sectors and subsectors in addition to NIS2: ecs-org.eu · 28 Oct 2026 · secondary source
• Thermal power engineering subsector (added to the energy sector). ecs-org.eu · 28 Oct 2026 · secondary source
• Banking, financial market infrastructure and public finance management systems (combined under a finance sector). ecs-org.eu · 28 Oct 2026 · secondary source
• Water and atmosphere sector (combines drinking water and wastewater and includes meteorological service and water structures as other subsectors). ecs-org.eu · 28 Oct 2026 · secondary source
• Four categories of digital infrastructure with the Ministry of Transport, National Security Authority, Ministry of Interior and Ministry of Defence as competent authorities . ecs-org.eu · 28 Oct 2026 · secondary source
• Three public administration categories with the Ministry of Interior, Ministry of Finance and Ministry of Investments, Regional Development and Informatisation as competent authorities. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 21

• Entities that fall into the scope of the regulation are required to notify the Competent Authority via the Unified Cyber Security Information System and provide: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector classification. ecs-org.eu · 28 Oct 2026 · secondary source
• Address (in all Member States, if applicable). ecs-org.eu · 28 Oct 2026 · secondary source
• Address of the registered office, permanent residence or place of business of the representative. ecs-org.eu · 28 Oct 2026 · secondary source
• Contact details of the entity and its legal representative. ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 24

• Reporting of significant cybersecurity incidents should be carried out via the Unified Cybersecurity Information System, providing the following details: ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours of becoming aware of the incident (specifying if it was caused by unlawful conduct or if it has cross-border impact). ecs-org.eu · 28 Oct 2026 · secondary source
• Incident notification within 72 hours (improvising initial assessment of severity and impact). ecs-org.eu · 28 Oct 2026 · secondary source
• Intermediate report on relevant status updates at the request of the National CSIRT within a specified period. ecs-org.eu · 28 Oct 2026 · secondary source
• Final report not later than 1 month after the submission of the incident notification (containing the type of threat, root cause and implemented measures). ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Significant cyber threats should also be reported via the Unified Cybersecurity Information System if the entity: ecs-org.eu · 28 Oct 2026 · secondary source
• Managed to avert a threat that may have caused a significant incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Identified a vulnerability of publicly accessible networks and information systems operated by it, which may have caused a significant incident, and the entity did not have the capacity to take action to eliminate or reduce the risk within an adequate time. ecs-org.eu · 28 Oct 2026 · secondary source
• A significant cyber security incident is considered to be a large-scale cyber security incident and a cyber security incident that: ecs-org.eu · 28 Oct 2026 · secondary source
• Has caused or may cause serious disruption to the functioning of the operator of the essential service or significant loss of profit. ecs-org.eu · 28 Oct 2026 · secondary source
• Has affected or may affect other persons by causing them damage or significant loss of profit. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 29(l)(n), 31

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Additional fines for service operators and failure to comply with inspection and registration obligations. For instance, up to 1,500 EUR (failure to comply with inspection obligations; up to a total of 15,000 EUR if the fines were imposed repeatedly). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 18

• Reference to international standards. ecs-org.eu · 28 Oct 2026 · secondary source
• Slovakia requires structured, risk-based cybersecurity assessments covering critical systems, third-party components, and sector-specific dependencies. Annual reviews are mandatory, and formal audits begin within 24 months of registration under NBU supervision. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final Text

What changed recently

1. 22 Jan 2025
   National NIS2 law enters into force (per tracker) ecs-org.eu secondary source