NIS2 Slovakia: Amended Cybersecurity Act (Act No. 69/2018 Coll.)
See how Slovakia has transposed the NIS2 Directive through a 2024 amendment to the Cybersecurity Act (Act No. 69/2018 Coll.), effective from 1 January 2025, expanding obligations to thousands of essential and important entities supervised by the National Security Authority (NBÚ) and the National Cybersecurity Centre SK-CERT.
Introduction: NIS2 Directive & the Slovak context
Slovakia has had a dedicated Cybersecurity Act since 2018. Act No. 69/2018 Coll. on Cybersecurity established minimum cybersecurity requirements, incident-handling rules and the role of the National Security Authority (NBÚ) as the central player in national cyber governance.
The adoption of Directive (EU) 2022/2555 (NIS2) required Slovakia to substantially revise this framework. The result is a 2024 amendment that modernises the Act, broadens the scope to thousands more entities and aligns Slovak law with the EU’s latest cybersecurity baseline.
NIS2 implementation in Slovakia
NIS2 is implemented in Slovakia through an Amendment to Act No. 69/2018 Coll. on Cybersecurity, adopted as Act No. 366/2024 Coll.. The amendment was approved by Parliament in late 2024 and entered into force on 1 January 2025, formally transposing Directive (EU) 2022/2555 into Slovak law.
According to the European Commission and several legal trackers, Slovakia is now listed as “transposed” for NIS2, with the Cybersecurity Act (as amended) serving as the single horizontal NIS2 framework.
The amendment significantly extends the number of regulated entities: estimates range from around 7,000 to more than 10,000 organisations now falling under the Slovak NIS2 regime, including both public and private operators.
Status
NIS2 is fully transposed. The amended Cybersecurity Act has been in force since 1 January 2025, with additional implementing decrees and ordinances being rolled out during 2025.
Legal structure
The NIS2 regime is embedded in Act No. 69/2018 Coll. on Cybersecurity, as amended by Act No. 366/2024 Coll., complemented by secondary legislation defining detailed security measures, reporting and sector-specific rules.
Supervisory approach
The National Security Authority (NBÚ) leads supervision and coordination, while the National Cybersecurity Centre SK-CERT handles incident management and technical support, with additional roles for sectoral authorities.
NIS2 Slovakia: what you need to know about compliance
The amended Cybersecurity Act mirrors the NIS2 distinction between essential and important entities. In Slovak terminology, operators of essential services are split into critical essential service providers (essential entities) and other operators of essential services (important entities).
Who is in scope?
- Operators in sectors covered by NIS2 (energy, transport, ICT, electronic communications, banking, financial market infrastructures, health, water, digital infrastructure, public administration, etc.).
- Medium and large organisations meeting NIS2 size/turnover criteria, plus some size-independent providers (DNS, domain name registration, cloud, data centre, content delivery, managed and security services).
- Additional entities designated by NBÚ as operators of “basic” or “critical basic” services under national criteria.
Core obligations
- Implement risk-based cybersecurity measures aligned with NIS2 Article 21 and NBÚ’s detailed security-measures ordinance.
- Maintain policies, procedures and governance structures for cyber risk management, including board-level responsibility and oversight.
- Ensure detection, handling and reporting of significant incidents and certain cyber threats within the 24h / 72h / 30-day ladder required by NIS2.
- Manage supply-chain and vendor risk, including contractually defined security requirements and notification duties for key suppliers.
- Provide regular staff and management training and keep documentation and evidence ready for audits and inspections.
Registration & timelines
Entities in scope have strict deadlines after 1 January 2025: in-scope entities must register with NBÚ within a short period (typically by early spring 2025), and then implement management measures within 12 months of registration and complete the first audit or self-assessment within 24 months. For many essential entities, full implementation deadlines cluster around late 2026.
NIS2 timeline & key dates (Slovakia)
Sector-specific notes for Slovakia
- Energy: electricity, gas and other critical energy operators are treated as key essential entities with strict resilience and incident-reporting duties.
- Electronic communications & ICT: telecoms, internet and other ICT services are central to the Cybersecurity Act’s scope, reflecting Slovakia’s reliance on digital infrastructure.
- Industry & manufacturing: sectors like pharmaceuticals, metallurgy and chemicals are explicitly mentioned in the Act’s sector list and are often designated as essential or important entities.
- Healthcare: hospitals and other healthcare providers remain in scope as operators of essential services, with increased attention to cyber resilience and incident management.
- Public administration & critical infrastructure: selected public bodies and critical infrastructure operators remain covered by the Cybersecurity Act and related critical-infrastructure regulations.
Penalties for non-compliance
The Slovak NIS2 regime is backed by a robust sanctions framework, closely aligned with the Directive’s ceilings and reinforced by national mechanisms for repeated or serious breaches.
- For essential entities: fines up to €10 million or 2% of total worldwide annual turnover, whichever is higher, for the most serious infringements.
- For important entities: fines up to €7 million or 1.4% of total worldwide annual turnover.
- Additional fines for operational breaches, such as failure to register, failure to complete required audits or self-assessments, or failure to implement corrective measures on time.
- Public naming and enhanced supervision in serious cases, as well as possible temporary bans or disqualification of directors for repeated negligence.
How to prepare for NIS2 in Slovakia
- Determine if you are in scope: map your organisation’s sector and size against NIS2 Annex I & II and Slovak categories for operators of basic and critical basic services.
- Confirm registration status: check whether you have already been registered or re-registered under the amended Cybersecurity Act and whether any NBÚ notifications or deadlines apply to you.
- Run a structured gap assessment: compare your current controls with NIS2 Article 21 and NBÚ’s security-measures ordinance, covering governance, technical controls, monitoring, incident response and documentation.
- Plan for 12- and 24-month milestones: ensure you can implement management measures within 12 months of registration and complete your first audit or self-assessment within 24 months.
- Strengthen incident readiness: align internal incident-response procedures with SK-CERT guidance and the 24h / 72h / 30-day reporting ladder; test escalation and communications regularly.
- Manage supply-chain risk: identify critical suppliers and update contracts with explicit cybersecurity, audit and incident-notification clauses consistent with Slovak and EU requirements.
- Use recognised frameworks: align your ISMS with ISO/IEC 27001, NIST CSF or similar to structure NIS2 compliance and make audits smoother.
- Engage leadership and boards: brief senior management on their responsibilities and potential personal exposure under the Slovak NIS2 regime and ensure cybersecurity is integrated into enterprise risk management.