NIS2 in Slovakia — transposition status and what’s changed

Slovakia’s registered critical operators — the Slovak essential tier — concentrate in digital infrastructure, energy (Slovenské elektrárne and the regional grid and heat operators), healthcare and public administration, with drinking-water utilities alongside. The large banks (Tatra banka, VÚB, Slovenská sporiteľňa) are registered too, but for banking and finance the Act stands back where DORA applies — DORA governs their security requirements and supervision instead. Annex II important entities span manufacturing, food production, postal services, waste management — the parts of the Slovak industrial base that quietly underpin the supply chains of larger central-European customers.

The practical consequence is that 1,486 entities were newly entered in the register in 2025 because of the amendment — largely mid-market organisations that had never operated a formal cybersecurity programme. Most do not have a dedicated CISO. Most do not have a GRC team. Most are now expected to hold the same shape of evidence that a multinational holds, scaled appropriately — and most are working out what that means in the same year that their customers also work it out.

Act 366/2024 closely mirrors the directive. Beyond the EU medium-enterprise size test, what Slovakia adds is categories regulated regardless of size: state bodies, larger municipalities and regional self-government, public-administration IT, and third parties under contract to a critical operator that have significant influence on its cybersecurity. Entities notify NBÚ within 60 days of starting the regulated activity, by a form via slovensko.sk; NBÚ then enters them in the register of operators of essential services, and the clocks run from that entry — security measures within twelve months, a first audit within two years. Operators registered before 2025 became critical operators automatically, with old-regime measures and audits allowed until 31 December 2026. NBÚ’s decrees are binding and its methodologies are guidance, in Slovak — the Slovak texts are the authority, not English summaries.

Incidents are reported through NBÚ’s JISKB system on the directive cadence (24-hour early warning, 72-hour notification, final report within a month of it), with the report content set by NBÚ Decree 226/2025. NBÚ’s 2025 annual report records 19 inspections of operators, with findings at 14; the most common finding was an inadequate arrangement of the relationship with a third party — above all the absence of a risk analysis of the supplier relationship. Expectations for OT-heavy sectors — utilities, manufacturing — tend to run more prescriptive than the directive baseline, particularly around supply-chain assurance evidence.

Slovak supplier inventories lean heavily non-Slovak at Tier 1 — Czech, German, and Austrian software and IT vendors dominate. Sub-processor visibility into multinational ICT providers headquartered outside Slovakia is a recurring practical gap; you can collect a SOC 2 from the parent, but documenting which sub-processors actually touch your data takes patience and the right contract clauses.

Mid-market Slovak entities lack the in-house GRC capacity to rapidly assess multinational supplier compliance, so the work falls on already-stretched IT leads. Manufacturing supply chains add another wrinkle: SCADA, PLC, and MES vendors often have not historically faced cybersecurity-first procurement, and bringing them up to NIS2 evidence standards is a conversation measured in months, not a quarter-end exercise.

Vittnor — Supply Chain Assurance for the mid-market — is built by a team led from Bratislava by a cybersecurity practitioner, working against Act 366/2024 as NBÚ guidance lands, and calibrated for the segment the act pulled into scope without enterprise GRC infrastructure. The app runs in English and Slovak. NBÚ-aligned evidence templates are being calibrated against the regulator’s published guidance.

Designed so one supplier file supports both Slovak NBÚ review and the questions upstream Czech, Austrian, and German buyers ask — cross-framework routing is on the v2 roadmap. For mid-market buyers without a CISO, the Qualified Manager retainer puts a NIS2-qualified practitioner on the board paper at a fixed monthly fee. A short call is enough to work out whether that retainer or the one-off Exposure Assessment is the better starting point.