Cybersecurity after NIS2: does your company fall under the Act?

Amendment No. 366/2024 Coll. transposed the NIS2 Directive into the Slovak Cybersecurity Act. The circle of regulated companies has grown considerably — it covers medium-sized and large enterprises in the defined sectors, as well as some entities regardless of size. A company assesses for itself whether it is in scope and, if it is, must register with the National Security Authority (Národný bezpečnostný úrad, NBÚ).

Key points

Scope: defined sectors (energy, transport, finance, health, digital infrastructure, ICT services, postal services, food, manufacture of selected products, digital providers and others).

Size criterion: medium-sized enterprise and above under Commission Recommendation 2003/361/EC; some entities regardless of size.

A new entity registers with the NBÚ within 60 days of starting its activity (Section 17(2)).

Security measures: within 12 months of entry in the register (Section 19(1)).

Incidents: early warning within 24 h, notification within 72 h, final report within 1 month (Section 24(3)).

Fines of up to €7 million or 1.4% of worldwide turnover for selected breaches.

Who is regulated

Act No. 69/2018 Coll. on cybersecurity, as amended by Act No. 366/2024 Coll., works with the concept of an operator of an essential service (prevádzkovateľ základnej služby) and distinguishes critical operators (corresponding to “essential entities” under NIS2) from other operators (“important entities”).

Two questions decide whether you are in scope:

Sector. Does your activity belong to the sectors listed in the Act? Besides traditional infrastructure (energy, transport, banking, health, water), they include ICT services, digital infrastructure, postal services, waste management, the manufacture of food, chemicals or medical devices, and digital providers (e.g. online marketplaces).
Size. As a rule, a medium-sized enterprise or larger under Commission Recommendation 2003/361/EC (number of employees and annual turnover or balance sheet total). Some entities — for example providers of DNS, trust services or public electronic communications — are covered regardless of size.

The Act leaves the assessment to the company. The National Security Authority (NBÚ) provides a guidance tool.

Obligations and deadlines

Obligation	Deadline	Provision
Registration with the NBÚ	within 60 days of starting the activity	Section 17(2)
Notifying changes in data	within 14 days	Section 17(6)
Adopting security measures	within 12 months of registration	Section 19(1)
Early warning of a serious incident	within 24 hours of detection	Section 24(3)(a)
Incident notification	within 72 hours of detection	Section 24(3)(b)
Final report	within 1 month of the notification	Section 24(3)(d)

Under the transitional rules, existing entities were supposed to register by 2 March 2025. Anyone who missed this should register without delay.

The effectiveness of the measures is verified by a certified cybersecurity auditor within 2 years of registration and regularly after that; other (non-critical) operators can use self-assessment under the conditions set by the Act.

Penalties

According to available summaries, the Act provides for fines from €300 to €500,000 for administrative breaches and from €300 to €7,000,000 or 1.4% of total worldwide annual turnover for more serious breaches, such as failing to report a serious incident.

If you are not in scope

Even a company outside the scope of the Act can be affected indirectly: regulated customers must deal with supply chain security and will require their IT and other suppliers to make contractual commitments, report incidents and follow basic security hygiene.