In brief
NIS2 (Directive (EU) 2022/2555) requires essential and important entities to take cybersecurity risk management measures (Article 21), report significant incidents (Article 23) and make management accountable (Article 20). In Slovenia, most entities must have the measures in place by 19 December 2026. We help from scope assessment to the evidence supervisors check.
What does NIS2 require?
The core obligations are the risk management measures in Article 21 and incident reporting in Article 23; under Article 20, the management body is accountable for them.
Article 20 – governance
- the management body approves the risk management measures and oversees their implementation;
- it can be held liable for infringements;
- members of the management body must follow training, and entities are encouraged to train employees regularly.
Article 23 – reporting obligations
- early warning within 24 hours of becoming aware of a significant incident;
- incident notification within 72 hours;
- intermediate report on request;
- final report no later than one month after the notification, or a progress report if the incident is still ongoing.
Article 21 – cybersecurity risk management measures
Policies on risk analysis and information system security; incident handling; business continuity, backup management and crisis management; supply chain security; security in acquisition, development and maintenance, including vulnerability handling; assessing the effectiveness of measures; basic cyber hygiene and training; cryptography and encryption; human resources security, access control and asset management; multi-factor authentication and secured communications.
Entities must also submit their details to the competent authority so that it can establish the list of essential and important entities (Article 3(4)). How the Article 21 measures map to ISO/IEC 27001 controls is shown in our ISO 27001 and NIS2 comparison.
Which NIS2 deadlines apply in Slovenia?
For most entities in Slovenia the deadline for measures is 19 December 2026; for some it has already passed. The competent authority is URSIV, the Government Information Security Office.
| Date | Obligation | Who |
|---|---|---|
| national NIS2 rules in force; reporting of significant incidents applies | all essential and important entities | |
| deadline for the first registration with URSIV | entities that already met the criteria when the rules entered into force | |
| deadline for adopting risk management measures | former operators of essential services (NIS1), state administration bodies and electronic communications operators | |
| deadline for adopting risk management measures | all other essential and important entities |
An organisation that meets the criteria later must register with URSIV within 30 days of meeting them. The obligations apply regardless of whether registration has been completed.
How is compliance checked?
Essential entities are subject to proactive supervision, including on-site inspections, random checks and regular and targeted security audits (Article 32); important entities are supervised after the fact, when there are indications of non-compliance (Article 33).
| Entity | In Slovenia | Frequency |
|---|---|---|
| Essential | compliance audit | at least every two years and after a significant incident |
| Important | compliance self-assessment (documented review) | at least every two years and after a significant incident |
We help you prepare the evidence and review compliance ahead of the audit or self-assessment.
How does a NIS2 project work?
The project runs in five phases; each ends with handed-over deliverables.
-
Scope assessment
Type of entity (Annex I or II), size, classification as essential or important, registration and critical services.
Deliverable: scope assessment and defined scope.
-
Gap analysis
Comparison of the current state with Articles 20, 21 and 23.
Deliverable: gap analysis report with a prioritised action plan.
-
Risks and business continuity
Asset inventory, risk methodology and assessment, business impact analysis and technical review.
Deliverable: asset register, risk register, risk treatment plan and business impact analysis.
-
Security documentation and measures
Policies, plans and procedures for the Article 21 measures, including the incident response plan and the protocol for notifying the CSIRT.
Deliverable: security documentation ready for management approval and a security measures plan.
-
Training and evidence for supervision
Staff training, management training, a test of the incident reporting procedure and organised evidence that measures are in place.
Deliverable: evidence of implementation, a report to management and readiness for supervision.
Which path fits your organisation?
In scope, no system yet
We carry out all five phases – from scope assessment to evidence for supervision. The system is designed so that it can later be certified to ISO/IEC 27001.
In scope, with ISO 27001
We extend your existing ISMS with what the certificate does not cover: registration, incident reporting on time, management accountability and training.
Former operator of essential services
Organisations covered by NIS1: in Slovenia the 19 June 2026 deadline has passed. We align existing documentation with Article 21 and prepare evidence for supervision.
What does supervision check?
Supervision does not check whether you have a document, but whether the measures work and whether you can prove it with evidence. Questions quickly move from “do you have a policy?” to “show us how it works”.
| Area | What you must demonstrate |
|---|---|
| Risks | methodology, register, risk treatment and management approvals |
| Business continuity | justified RTO and RPO, plans, tests and improvements |
| Incidents | procedures, records, timelines, exercises and lessons learned |
| Suppliers | list, criticality, contracts, oversight and evaluation |
Most common mistakes
- ISO documentation without the regulatory context – evidence and operational procedures are missing;
- a superficial business impact analysis – RTO and RPO without justification and without testing;
- unclear management accountability – no approvals, recorded decisions or priorities;
- missing evidence – measures “should exist” but cannot be shown;
- incident procedures on paper only – no exercises, records or improvements.
More in Supervision by URSIV – what is checked and, on the consequences, in NIS2 penalties and supervisory measures.
Frequently asked questions about NIS2
How do we find out whether NIS2 applies to us?
An organisation is generally in scope if it is a type of entity listed in Annex I or II of NIS2, qualifies at least as a medium-sized enterprise under Recommendation 2003/361/EC and provides services or carries out activities in the EU (Article 2(1)). Some entities are in scope regardless of size (Article 2(2) to (4)). See Is your company in scope of NIS2?
When must NIS2 measures be in place in Slovenia?
For most essential and important entities by 19 December 2026. For former operators of essential services, state administration bodies and electronic communications operators the deadline was 19 June 2026. Reporting of significant incidents has applied since 19 June 2025 (source: URSIV).
Does NIS2 require an ISO 27001 certificate?
No. NIS2 does not require a certificate, but it does require risk management measures (Article 21) and evidence that they work. A system to ISO/IEC 27001 is a systematic basis for this; registration, reporting of significant incidents and management accountability must be handled separately.
What are the deadlines for reporting a significant incident?
Under Article 23: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, an intermediate report on request, and a final report no later than one month after the notification; if the incident is still ongoing, a progress report. Incidents are reported to the CSIRT or competent authority.
What fines does NIS2 provide for?
For infringements of Articles 21 or 23, Member States must provide maximum fines of at least EUR 10,000,000 or 2% of total worldwide annual turnover for essential entities, and at least EUR 7,000,000 or 1.4% for important entities – whichever is higher (Article 34). More in NIS2 penalties and supervisory measures.
What do you need from us to get started?
Basic information about the organisation (activities, number of employees, turnover and balance sheet total, key services and locations) and existing documentation. On this basis we assess scope and propose the phases.
Sources
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- Commission Recommendation 2003/361/EC – definition of micro, small and medium-sized enterprises, EUR-Lex
- URSIV – guidance on NIS2 implementation in Slovenia, version 1.4 (January 2026, in Slovenian)
Last updated: · Prepared by the Regulus Ai team
Would you like a scope assessment for your organisation?
Book an initial consultation