Let’s Build Something Great
Tell us about your goals and request a free project estimate.
NIS2 in Slovakia and What It Means for Your Business
NIS2 introduces cybersecurity requirements for organisations that provide services important to the economy and society. Slovakia implemented the directive through Act No. 69/2018 Coll. on Cybersecurity, as amended.
The regulation does not apply to every business. Its scope depends on the organisation’s actual activities, the services it provides, its size and specific statutory conditions. Certain organisations are covered regardless of their size.
This guide explains how businesses and sole traders operating in Slovakia can assess whether NIS2 applies to them, understand their potential obligations and identify the steps required to prepare.
Key Takeaways
- NIS2 does not automatically apply to every company that uses IT systems, operates a website or provides digital services.
- Your actual business activities must match an entity type and service defined in the Slovak Cybersecurity Act. A general industry classification is not enough.
- Under the general size criteria, an organisation must meet at least the medium-sized enterprise threshold. This normally means at least 50 employees, or, with fewer than 50 employees, both annual turnover and annual balance sheet total exceeding €10 million.
- Partner and connected enterprises must be considered when calculating company size. A single year’s change in the figures does not automatically change the company’s classification.
- Certain organisations, including specified telecommunications, DNS, trust service and domain registration providers, can fall within the legislation regardless of company size.
- An organisation that identifies as covered must notify the NBÚ within 60 days of starting the relevant activity. The resulting registration triggers further cybersecurity obligations.
- Covered organisations must implement the applicable security measures, report serious cybersecurity incidents and verify compliance through the required audit or permitted self-assessment process.
What is NIS2 in Slovakia and How is it Implemented?
NIS2 is Directive (EU) 2022/2555. It establishes a common cybersecurity framework across the European Union and aims to improve the resilience of organisations providing essential and important services.
The directive requires covered organisations to manage cybersecurity risks, protect their networks and information systems, prepare for security incidents and report significant incidents to the relevant authorities.
The main Slovak legal instruments are:
- Act No. 69/2018 Coll. on Cybersecurity, as amended. This is the primary national legislation defining the scope and obligations.
- Act No. 366/2024 Coll. This introduced the main amendments implementing NIS2. The relevant provisions took effect on 1 January 2025.
- NBÚ Decree No. 227/2025 Coll. This specifies cybersecurity measures and security documentation.
- NBÚ Decree No. 226/2025 Coll. This specifies incident reporting requirements and related criteria.
The Slovak legislation uses two national classifications:
- Operator of a basic service (prevádzkovateľ základnej služby, PZS).
- Operator of a critical basic service (prevádzkovateľ kritickej základnej služby, PZKS).
An operator of a basic service becomes an operator of a critical basic service when it provides at least one service meeting the criteria in Section 18 of the Act.
These Slovak classifications should not automatically be treated as equivalent to the EU directive’s classifications of essential and important entities. The national classification determines specific supervisory and compliance requirements.
Which Sectors and Activities Can Fall Within NIS2?
The Slovak Cybersecurity Act identifies covered activities in Annex I and Annex II. These annexes distinguish between sectors of high criticality and other critical sectors.
The following tables summarise the relevant areas. They are not exhaustive lists of every covered entity.
Sectors of high criticality
| Sector | Examples of covered activities and entities |
|---|---|
| Energy | Electricity, district heating and cooling, oil, natural gas and hydrogen |
| Transport | Air, railway, waterborne and road transport |
| Banking | Credit institutions |
| Financial market infrastructure | Defined financial market infrastructure operators |
| Healthcare | Specified healthcare providers and health-related entities |
| Drinking water | Drinking water supply |
| Wastewater | Wastewater collection and treatment |
| Digital infrastructure | Internet exchange points, DNS, TLD registries, cloud computing, data centres, content delivery networks, trust services and electronic communications |
| ICT service management | Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs) providing services between businesses |
| Public administration | Specified central and regional public administration organisations |
| Space | Operators of specified ground-based infrastructure supporting space-based services |
Other critical sectors
| Sector | Examples of covered activities and entities |
|---|---|
| Postal and courier services | Postal and courier service providers |
| Waste management | Specified waste traders, brokers and waste transport operators |
| Chemicals | Chemical suppliers, manufacturers and importers |
| Food | Food businesses engaged in wholesale distribution and industrial production or processing |
| Manufacturing | Specified medical devices, electronic and optical products, electrical equipment, machinery, motor vehicles and other transport equipment |
| Digital services | Online marketplaces, internet search engines and social networking platforms |
| Research | Organisations conducting applied research or experimental development for commercial use |
The legal definitions are more specific than these sector descriptions.
For example, the food-sector provisions do not automatically cover every restaurant, grocery shop or food retailer. They identify food businesses engaged in wholesale distribution and industrial production or processing.
The waste management category also contains specific exclusions. For example, certain waste-related activities do not qualify when waste management is not the undertaking’s main economic activity.
Research organisations must meet the statutory definition. Educational institutions are excluded from this category.
Manufacturing coverage is limited to the product categories specified in Annex II. It does not automatically extend to every manufacturing business.
The same principle applies across all sectors. An organisation must match the relevant statutory entity and activity criteria.
Does company size determine whether NIS2 in Slovakia applies?
Company size is one of the main criteria used to determine whether an organisation falls within the general sector-based scope.
Under Section 17(1)(e) of the Cybersecurity Act, an organisation carrying out an activity listed in Annex I or Annex II generally needs to meet at least the size requirements of a medium-sized enterprise.
The assessment follows Commission Recommendation 2003/361/EC on the definition of micro, small and medium-sized enterprises.
In practical terms, the following rules determine whether an organisation exceeds the small-enterprise threshold:
| Number of employees | Financial criteria |
|---|---|
| 50 or more | The organisation is no longer classified as a small enterprise under the EU definition |
| Fewer than 50 | Both annual turnover and annual balance sheet total must exceed €10 million |
The financial criteria must be met together when an organisation has fewer than 50 employees.
For example:
- 35 employees, €12 million turnover and €11 million balance sheet total: the organisation exceeds the small-enterprise thresholds.
- 35 employees, €12 million turnover and €8 million balance sheet total: the organisation remains within the small-enterprise thresholds.
- 55 employees: the organisation is no longer a small enterprise based on its employee count.
Meeting the size threshold does not automatically make an organisation subject to NIS2. Its activities must also fall within the statutory scope, unless another specific inclusion criterion applies.
Partner and connected enterprises
Company size cannot always be calculated using the financial information of one legal entity alone.
The EU SME rules require relevant partner and connected enterprises to be considered. Their figures must be included using the applicable calculation method.
The assessment may therefore require reviewing:
- The company’s ownership structure.
- Shareholdings and voting rights.
- Control relationships.
- Relevant partner and connected enterprises.
- Employee and financial data for the relevant accounting periods.
The employee count also follows the EU annual work-unit calculation rather than simply counting people on the payroll on one particular date.
When does a change in company size take effect?
A company does not automatically change its SME classification because it exceeds a threshold in one accounting period.
Under the EU rules referenced by the NBÚ, the threshold must normally be exceeded in two consecutive accounting periods before the classification changes.
The assessment is made annually using the approved annual financial statements. A newly established business that does not yet have an approved annual financial statement must use a good-faith estimate during its financial year.
The NBÚ has published specific guidance on applying these rules. Its guidance is informative rather than a binding interpretation of the law.
Can Small Businesses and Sole Traders Be Subject to NIS2?
Yes. The general company-size threshold is not an absolute exemption.
Section 17 identifies specific organisations that can fall within the legislation regardless of whether they meet the medium-sized enterprise threshold.
Organisations covered regardless of the general size threshold
These include specified entities operating in Annex I or Annex II sectors that provide:
- Public electronic communications networks or services.
- Trust services.
- Top-level domain (TLD) management.
- DNS services.
The legislation also identifies organisations that:
- Are the only provider in Slovakia of a service considered essential to a key function.
- Provide a service whose disruption could significantly affect public order, security or public health.
- Provide a service or hold a position that could create significant systemic risk, particularly where the impact could cross national borders.
- Are critical to a particular sector because of their national or regional importance.
- Have been designated as entities of economic mobilisation.
Other categories listed in Section 17
The Act also includes separate categories of organisations, including:
- Central government authorities and other state authorities with nationwide responsibilities.
- Entities designated as critical under the relevant legislation.
- Specified state authorities operating across at least two districts and higher territorial self-governing units, where disruption could significantly affect public order, security or public health.
- Cities where disruption of their responsibilities could have a significant impact on public order, security or public health.
- Administrators of public administration IT systems subject to at least Category II or Category III security measures.
- Domain name registration service providers, regardless of company size.
- Certain third parties with significant influence over cybersecurity that have a contract with an operator of a basic service operating a critical basic service.
These are specific statutory categories. They do not mean that every small business providing services to a large organisation automatically becomes subject to NIS2 in Slovakia.
What about sole traders?
The legal form of a business does not determine NIS2 applicability by itself.
A sole trader is not automatically covered simply because they provide professional services. Equally, operating as an individual entrepreneur does not create an automatic exemption.
The actual activity, applicable size criteria and any relevant size-independent conditions must be assessed.
For a typical independent freelancer, web developer or graphic designer, the general sector and size criteria are usually the starting point. The statutory exceptions must still be checked.
Does NIS2 Apply to Web Development and IT Companies?
This distinction is particularly relevant to digital agencies, software developers and IT service providers.
Providing web design, graphic design, website development or custom software development does not automatically make a company subject to NIS2 in Slovakia.
However, the legislation specifically includes the ICT service management sector, covering Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs).
These services are defined by what the provider actually does.
Managed Service Provider (MSP)
An MSP provides services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or other network and information systems.
The work may involve assistance or active administration, either at the customer’s premises or remotely.
Managed Security Service Provider (MSSP)
An MSSP is a managed service provider that performs or assists with activities related to cybersecurity risk management.
How does this affect digital agencies and developers?
Consider the following examples:
- Designing and building a website as a development project does not automatically make a company an MSP.
- Delivering a custom application does not, by itself, establish that the developer is an MSP.
- Providing ongoing administration, operation or maintenance of a customer’s ICT systems or applications may fall within the MSP definition.
- Providing managed cybersecurity services may qualify as an MSSP activity.
The service contract, scope of responsibility, support model and actual operational activities should be examined.
Importantly, the ICT service management category in Annex I concerns managed services provided between businesses. The organisation must also meet the applicable size requirements or a separate statutory inclusion criterion.
Other digital infrastructure activities, such as cloud computing, data centre services, DNS and domain registration, are listed separately.
An IT company should therefore assess each relevant service rather than assume that all software, hosting or maintenance activities have the same regulatory status.
How Can You Check Whether NIS2 Applies to Your Business?
The Slovak framework follows the principle of self-identification. Organisations must assess whether their activities meet the statutory criteria.
You can perform an initial assessment internally using the following process.
Step 1. Identify your actual business activities
List the services your organisation provides.
Do not rely exclusively on the company’s registered name, main business activity or marketing description.
Compare your actual services with the specific entity types and activities in Annex I and Annex II of the Cybersecurity Act.
Step 2. Check the company-size criteria
Determine:
- The number of employees, calculated under the applicable EU rules.
- Annual turnover.
- Annual balance sheet total.
- Relevant partner and connected enterprises.
Apply the two-consecutive-accounting-period rule when assessing a change in company classification.
Step 3. Check the size-independent categories
Review the specific criteria in Section 17.
Pay particular attention to:
- Public electronic communications providers.
- Trust service providers.
- DNS providers and TLD managers.
- Domain name registration service providers.
- Unique or nationally critical service providers.
- Organisations designated as critical or as entities of economic mobilisation.
- Third parties with significant influence on the cybersecurity of a critical basic service operator.
Step 4. Check your regulatory status
Review the NBÚ’s official information and public register of operators of basic services.
Check whether your organisation has already received a registration notification.
Absence from the register should not be treated as definitive proof that the law does not apply. The legislation places an initial identification and notification responsibility on the organisation.
Step 5. Use the official NBÚ self-assessment tool
The National Security Authority provides a free indicative questionnaire to help organisations assess whether they may qualify as operators of basic services.
The result is informative only. It does not constitute a binding legal determination and does not replace an assessment of the applicable legislation.
The questionnaire is a useful starting point, but its result should not be treated as a substitute for checking all relevant statutory categories and exceptions.
For complex cases involving ownership structures, special inclusion criteria or uncertain service classifications, a legal and cybersecurity review may be necessary.
Check Whether NIS2 Applies to Your Organisation
What Must You Do If Your Business Is Covered?
Once an organisation identifies that it meets the statutory criteria, it must follow the notification and registration procedure.
Notify the NBÚ within 60 days
Under Section 17(2), an organisation carrying out a regulated activity must notify the NBÚ within 60 days of starting that activity.
The organisation submits the completed notification form through the Slovak Central Public Administration Portal.
The NBÚ then enters the organisation into the register of operators of basic services after consulting the relevant central authority. Registration can follow the NBÚ’s own initiative, a justified request or a proposal from the competent authority.
The NBÚ notifies the organisation of its registration through the Unified Cybersecurity Information System and delivers the notification to its electronic mailbox. A separate administrative decision is not issued.
The organisation’s rights and obligations under the Act begin on the date specified in the registration notification, but not earlier than the 30th day following its entry in the register.
If an operator of a basic service also provides at least one critical basic service under Section 18, it must notify the NBÚ of that status.
Implement the required security measures
Under Section 19, an operator of a basic service generally has 12 months from its registration to adopt and implement the required general security measures.
The measures must be based on a cybersecurity risk analysis and must address the organisation’s actual systems, operations and risks. Applicable sector-specific measures must also be implemented where prescribed.
Section 20 identifies the main areas that must be covered.
| Area | Practical requirements |
|---|---|
| Security governance | Establish responsibilities, policies and documented procedures. |
| Risk and asset management | Identify assets, vulnerabilities, threats and cybersecurity risks. |
| Incident management | Detect, record, report and respond to cybersecurity incidents. |
| Business continuity | Maintain backups, disaster recovery, continuity and crisis management procedures. |
| Secure development and maintenance | Protect systems, applications, networks and configurations during acquisition, development and maintenance. |
| Security assurance | Assess the effectiveness of controls, compliance and security procedures. |
| Cryptography | Establish appropriate cryptographic measures and rules for using cryptography. |
| Identity and access | Control identities, accounts, permissions and access to systems. |
| System and network protection | Secure system operations, networks and communications, including protection against malicious code and unwanted content. |
| Monitoring and logging | Monitor, record and report relevant security events. |
| Physical and endpoint security | Protect premises, equipment, the operating environment and endpoint devices. |
| Information protection | Protect records and privacy and classify information appropriately. |
| Human resources | Establish security responsibilities, required competences, education and training. |
| Supplier security | Manage cybersecurity risks throughout the supply chain. |
| Certified ICT products and services | Address the acquisition and use of certified ICT products, services and processes. |
The organisation must maintain approved security documentation that reflects its actual security arrangements.
Decree No. 227/2025 Coll. provides detailed requirements for these measures and the related documentation.
Assign cybersecurity responsibilities
Section 20(4) establishes minimum organisational requirements.
These include:
- Appointing a cybersecurity manager who meets the required knowledge standards.
- Ensuring that the cybersecurity manager is independent of the management structure responsible for IT operations and service development when designing, adopting and enforcing security measures.
- Establishing procedures for detecting, recording and handling cybersecurity incidents.
- Appointing a contact person to receive and record reports.
- Connecting to the relevant communication and early-warning systems.
- Assigning responsibilities and ensuring appropriate training for all established roles.
- Designating the individuals responsible for approving, supervising, checking and auditing security measures.
- Providing adequate resources and building cybersecurity awareness.
The cybersecurity manager does not automatically have to be an external consultant. The required knowledge and independence conditions must, however, be satisfied.
Manage security requirements for third parties
NIS2 also affects certain suppliers and contractors.
Under Section 19(2), an operator of a basic service must enter into a written contract with a third party when that third party performs an activity directly related to the availability, confidentiality or integrity of the operator’s network and information systems.
The contract must cover the applicable security measures and notification obligations for the duration of the activity. A risk analysis is required when the contract is concluded.
The third party must follow the agreed security measures and can be subject to checks by the operator of the basic service. Where the contract concerns an operator of a critical basic service, the NBÚ may also carry out checks.
There are statutory exceptions. The contract requirement under this provision does not apply when the third party is itself an operator of a basic service or when the relevant risk is low.
A further distinction applies to suppliers with significant influence on cybersecurity. A third party with such influence that has a contract with an operator of a basic service providing a critical basic service can itself fall within Section 17.
This does not mean every supplier or IT contractor becomes an NIS2-regulated entity.
What Are the Cybersecurity Incident Reporting Requirements?
Operators of basic services must report every serious cybersecurity incident to the NBÚ through the Unified Cybersecurity Information System.
The obligation does not apply to every routine IT issue or minor security event.
Under Section 24, a serious cybersecurity incident includes a large-scale incident or an incident that:
- Causes or could cause serious disruption to the operation of the operator of a basic service.
- Causes or could cause substantial financial damage, other harm or lost profit.
- Affects or could affect other persons by causing substantial damage, harm or lost profit.
Decree No. 226/2025 Coll. specifies the relevant reporting criteria and details.
Reporting deadlines
| Deadline from detection | Requirement |
|---|---|
| Within 24 hours | Submit an early warning. |
| Within 72 hours | Submit the incident notification with an initial assessment. |
| Within one month after the incident notification | Submit the final incident report. |
The early warning must identify, among other things, whether the incident may have resulted from unlawful conduct or may have a cross-border impact.
The 72-hour notification must provide an initial assessment of the incident, its severity and its consequences.
Special rule for trust service providers: If the operator of a basic service is a trust service provider, the incident notification that would normally have a 72-hour deadline must instead be submitted without undue delay and no later than 24 hours after detection.
The final report must describe the incident, its severity and consequences, the likely cause, the measures taken or planned and any cross-border impact.
If a serious incident with cross-border impact remains unresolved when the final report is due, the Act requires an updated final report within 30 days after normal operation has been restored. If the incident is still ongoing when the first final report is submitted, further information must be provided and the updated final report submitted within 30 days after the incident is resolved.
Organisations should therefore establish incident detection, escalation and reporting procedures before an incident occurs.
Is an External Cybersecurity Audit Mandatory?
The Cybersecurity Act requires operators of basic services to verify whether their security measures meet the applicable requirements.
Under Section 29, the initial verification must generally be completed within two years of registration.
A cybersecurity audit must be performed by a certified cybersecurity auditor.
Can an organisation perform a self-assessment instead?
Yes, but only under specific conditions.
An operator of a basic service that is not classified as an operator of a critical basic service may use a self-assessment through the Unified Cybersecurity Information System instead of the audit at the applicable verification interval.
The self-assessment must be performed by the organisation’s cybersecurity manager.
This is not a permanent exemption from external audits. The organisation must undergo a certified cybersecurity audit within five years of registration and subsequently follow the audit intervals prescribed by law. A self-assessment cannot replace an audit when an actual audit is due.
Operators of critical basic services cannot use this general self-assessment alternative.
After an audit, the organisation must submit the final audit report, corrective measures and deadlines for addressing identified deficiencies to the NBÚ within 30 days of the audit’s completion.
An additional rule applies to operators subject to the Digital Operational Resilience Act, Regulation (EU) 2022/2554 (DORA). Their verification of security measures follows the applicable DORA requirements, as specified in Section 29(9).
NIS2 in Slovakia does not automatically require an organisation to obtain ISO/IEC 27001 certification. An information security management system can support compliance, but certification alone does not demonstrate fulfilment of every statutory obligation.
What Does the 31 December 2026 Deadline Actually Mean?
The date 31 December 2026 is sometimes presented as a general deadline for NIS2 compliance in Slovakia. That interpretation is incorrect.
Section 34b contains transitional provisions for specific organisations that were already regulated before 1 January 2025.
Organisations previously registered as operators of basic services
An organisation registered as an operator of a basic service under the legislation effective until 31 December 2024 is treated as an operator of a critical basic service under the amended Act from 1 January 2025.
The NBÚ may decide by 31 December 2026 that an organisation in this group does not meet the current criteria for critical basic service status.
These previously registered operators may also continue applying the previous cybersecurity measures and audit rules until 31 December 2026, subject to the transitional provisions.
Organisations previously registered as digital service providers
A digital service provider registered under the former legislation is treated as an operator of a basic service under the amended Act.
The NBÚ may determine by 31 December 2026 that such an organisation does not meet the current registration criteria.
This transitional classification does not give former digital service providers the same general extension for using the previous security measures and audit rules that applies to the former operators of basic services under Section 34b(1).
Transitional self-assessment for certain audits
Section 34b(8) also provides a specific option for operators of basic services with Category I or Category II networks and information systems.
Where an audit was due in 2025 or 2026, the operator may fulfil that particular obligation through a self-assessment performed by its cybersecurity manager in the Unified Cybersecurity Information System. The result must be submitted to the NBÚ without delay.
This is a transitional provision. It should not be confused with the general self-assessment option available to eligible non-critical operators under Section 29.
31 December 2026 is therefore a transitional deadline for specified previously regulated organisations. It is not a universal NIS2 compliance deadline for every business in Slovakia.
Newly registered organisations follow the applicable deadlines under the amended legislation.
What Happens If an Organisation Does Not Comply?
The NBÚ has supervisory and enforcement powers under the Cybersecurity Act.
The applicable penalty depends on the organisation’s classification and the specific administrative offence.
Examples of statutory fine ranges include:
| Violation | Statutory fine range |
|---|---|
| Failure by an operator of a basic service to notify the commencement of a regulated activity, among other specified administrative offences | €300 to €500,000 |
| Specified breaches of core cybersecurity obligations by an operator of a basic service | €300 to €7 million or 1.4% of total worldwide annual turnover for the previous financial year, whichever is higher |
| The same specified breaches by an operator of a critical basic service | €500 to €10 million or 2% of total worldwide annual turnover for the previous financial year, whichever is higher |
These are statutory ranges for specified violations, not automatic fines for every compliance failure.
The NBÚ determines whether an administrative offence has occurred and the applicable penalty under the relevant provisions of the Act.
What If Your Business Is Not Subject to NIS2?
If an organisation does not meet the statutory conditions, it does not become an operator of a basic service simply because it uses IT systems, operates a website or provides digital services.
However, this does not remove its other legal and contractual responsibilities. Data protection requirements, sector-specific regulations and commercial agreements may still impose security obligations.
There is also an important supply-chain consideration.
A smaller software developer, hosting provider, IT service company or maintenance contractor may provide services directly related to the availability, confidentiality or integrity of a regulated customer’s systems.
In that situation, Section 19(2) may require the regulated customer to establish a written contract covering security measures and notification obligations, following a risk analysis.
A supplier may therefore have contractual cybersecurity duties without automatically becoming an operator of a basic service itself.
A separate statutory inclusion criterion can apply when a supplier has significant influence on cybersecurity and has a qualifying contract with an operator of a basic service that operates a critical basic service.
The direct regulatory status of the supplier and the contractual obligations imposed by a regulated customer must be assessed separately.
Can You Handle the Initial NIS2 Assessment Yourself?
Yes. A business can perform its initial scope assessment internally using the Cybersecurity Act, NBÚ guidance and the official indicative questionnaire.
It can also prepare some documentation and implement security improvements using its own resources, provided it has the necessary knowledge and capabilities.
However, establishing full compliance requires more than completing a questionnaire or purchasing a collection of security documents.
The organisation must understand its information systems, assess risks, assign responsibilities, implement appropriate controls, maintain security documentation, manage relevant suppliers and verify that its security measures work.
External assistance may be appropriate when:
- The organisation cannot determine whether its activities fall within the statutory scope.
- Its ownership structure makes the company-size assessment difficult.
- It lacks the internal expertise to conduct a cybersecurity risk analysis.
- Its infrastructure requires technical security improvements.
- It needs a certified cybersecurity auditor to perform the required audit.
The legislation does not require every covered organisation to purchase an all-in-one NIS2 consultancy package. The appropriate level of external support depends on the organisation’s regulatory status, internal capabilities and security risks.
Resources
- Directive (EU) 2022/2555 (NIS2)
- Slovak Cybersecurity Act No. 69/2018 Coll. – Consolidated version effective from 30 April 2026
- Act No. 366/2024 Coll. – Amendment implementing NIS2
- NBÚ – NIS2 Frequently Asked Questions
- NBÚ – Methodologies and guidance
- NBÚ – Indicative self-assessment tool
- NBÚ – Guidance on company-size assessment
- NBÚ Decree No. 227/2025 Coll. – Security Measures
- NBÚ Decree No. 226/2025 Coll. – Incident Reporting
- Commission Recommendation 2003/361/EC – Definition of micro, small and medium-sized enterprises
This article provides general information about the Slovak NIS2 regulatory framework. It does not constitute a legal determination of an individual organisation’s status or replace a professional legal and cybersecurity assessment. The applicable requirements must be assessed against the current legislation and the organisation’s actual activities.
Zsolt Oroszlány
More Insights
Choosing a Graphic Design Agency: What Reddit Discussions Reveal
Reddit discussions highlight common problems involving unclear creative briefs, revision limits, source-file delivery and production specifications. Learn how to evaluate design capabilities, define project deliverables and prevent scope misunderstandings before work begins.
Choosing a Digital Marketing Agency: What Reddit Discussions Reveal
Reddit discussions highlight recurring concerns about agency performance, unclear deliverables, misleading metrics and restricted account access. Learn how to evaluate marketing strategies, verify implementation, compare contracts and measure results against qualified leads, sales and business objectives.
AI Should Empower Professionals, Not Replace Them
This article distinguishes task automation from occupational replacement and examines what AI changes across design, software development and marketing. It also explores productivity evidence, professional skill retention, and the infrastructure choices that affect access to AI.