Two things matter together: whether your activity is in Annex 1 or 2 to Act No. 69/2018 Coll. on Cybersecurity, and whether you are at least medium-sized, generally having at least 50 employees or both annual turnover and balance-sheet total above EUR 10 million. If so, you must identify this yourself and notify the National Security Authority within 60 days of starting the activity. Exceptions matter: some entities register regardless of size, and group companies count towards size.
NIS2 is not a separate Slovak Act. Amendment No. 366/2024 Coll. transposed Directive (EU) 2022/2555 into Act No. 69/2018 Coll. on Cybersecurity from 1 January 2025. The real question is therefore whether you are an operator of an essential service under that Act.
Sector and size both matter
Under Section 17(1)(e) of Act No. 69/2018 Coll., the register covers a person meeting at least the medium-sized enterprise conditions and operating in a sector in Annex 1 or 2. The annexes reach far beyond traditional critical infrastructure, including medical device manufacturing and food production, processing and distribution. The size threshold is generally at least 50 employees or both annual turnover and balance-sheet total above EUR 10 million, based on the EU definition of micro, small and medium-sized enterprises in Recommendation 2003/361/EC.
The Act relies on self-identification. Assessing whether you are in scope is primarily your responsibility, rather than the authority’s:
Anyone carrying on an activity under paragraph 1 must notify the authority within 60 days of starting that activity.
— Section 17(2) of Act No. 69/2018 Coll. (unofficial English translation)
Notification uses a form through the central public administration portal. The authority subsequently notifies registration. Rights and duties arise on the date in the notice, no earlier than the thirtieth day after registration (Section 17(4) and (5)).
Common mistakes
Size is not always decisive. Under Section 17(1)(c) and (h), entities registered regardless of size include public electronic communications network and service providers, trust service providers, TLD registries, DNS and domain registration providers, and a sole provider of a key service in Slovakia.
The group counts. Size is not assessed in isolation: SME rules include partner and linked enterprises, so a Slovak subsidiary of a large foreign group may qualify as medium-sized despite having only a handful of its own employees. NBÚ addresses cross-border structures and parent-managed services in specific interpretative opinions. A foreign registered office is no protection in itself: digital service providers, including cloud, DNS, online marketplaces and social networks, may be registered without a Slovak office (Section 2(2)).
Finally, actual activity matters. The period runs from when you really began the regulated activity, rather than its entry among your registered business activities.
What follows registration?
Registration is the start. The Act requires security measures detailed in NBÚ Decree No. 227/2025 Coll. and reporting of cybersecurity incidents. In practice, this means internal documentation, allocation of responsibilities and incorporation of requirements into IT supplier contracts.
If you also operate in Czechia
Czechia adopted an entirely new statute: Act No. 264/2025 Coll. on Cybersecurity, effective from 1 November 2025. Assessment and registration with NÚKIB follow separate rules. A group operating in both countries therefore needs two separate assessments.
How we can help
We assess coverage under the annexes and prepare registration and compliance arrangements through NIS2 and cybersecurity. Internal rules and policies cover the internal documents, and we include supplier security requirements in service agreements and SLAs.
If you recently crossed the size thresholds, contact us promptly: the sixty-day period runs from the start of the activity.
This answer provides general information on the law as at 10 September 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.
