SloveniaZakon o izvajanju uredbe (EU) o določitvi harmoniziranih pravil o umetni inteligenci (ZIUDHPUI), Designation of AI Act Market Surveillance Authorities
Zakon o izvajanju uredbe (EU) o določitvi harmoniziranih pravil o umetni inteligenci (ZIUDHPUI) Uradni list RS No. 85/2025 (implementing Regulation (EU) 2024/1689)
In force since .
An AI governance rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- If you provide a high-risk AI system used in critical infrastructure (Annex III point 2), or are its authorised representative, submit the Annex VIII Section A registration data to AKOS, which keeps Slovenia's register of those systems (Article 18).
These lines are LexLint's reading of the law's text. Also read by: Agencija za komunikacijska omrežja in storitve Republike Slovenije (AKOS) (guidance, recorded ).
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
Who enforces it
Enforcement body
Five market-surveillance authorities under ZIUDHPUI Article 6: Agencija za komunikacijska omrežja in storitve Republike Slovenije (AKOS), Informacijski pooblaščenec (the Information Commissioner), Banka Slovenije, Agencija za zavarovalni nadzor (the Agency for Insurance Supervision) and Tržni inšpektorat Republike Slovenije (the Market Inspectorate); AKOS is also the single point of contact.
Settledness
AKOS describes its role under the Act and lists the areas of Annex III that it supervises; it does not address the overlaps between authorities.
- As of
- Guidance link
- https://www.akos-rs.si/en/umetna-inteligenca/raziscite/general
- Guidance body
- Agencija za komunikacijska omrežja in storitve Republike Slovenije (AKOS)
- Open questions
- Which authority supervises a high-risk system under Annex III point 5(b) that a deployer other than a credit institution or a consumer lender uses, given that Article 10(2) and (3) name only Banka Slovenije and the Market Inspectorate for those two deployers and Article 10(5) gives AKOS only points 5(a) and 5(d)?
- Which authority supervises a high-risk system that is both a safety component under Annex I section A, which Article 10(5) gives to AKOS, and a biometric system under Annex III point 1, which Article 10(1) gives to the Information Commissioner?
What it makes you log
Logging duty
Article 20 does not itself create the duty to draw up or keep the Article 18 technical documentation the EU AI Act imposes on a provider of a high-risk AI system; that duty is the Regulation's own. It adds a national continuation duty for the Article 18(1) retention period: if a provider or its authorised representative established in Slovenia enters bankruptcy or ceases business before that period ends, paragraph 2 requires it to hand the documentation to the Agency for Communication Networks and Services (AKOS) within 30 days, and paragraph 3 has AKOS continue holding it, once the Article 18(1) period expires, under Slovenia's own law on protecting documentary and archival material, which does not itself state a further period here.
- Kind
- Implicit
- As of
- Provision
- Člen 20(1)-(2) (implementing Article 18(1) of Regulation (EU) 2024/1689)
- Trigger
- high_risk_systems
What this law does
Article 6 of ZIUDHPUI names five market-surveillance authorities for the AI Act: the Agency for Communication Networks and Services of the Republic of Slovenia (AKOS), the Information Commissioner, Banka Slovenije, the Agency for Insurance Supervision and the Market Inspectorate of the Republic of Slovenia.
Article 10 divides supervision among them, giving the Information Commissioner the Article 5 prohibited practices and the high-risk systems in points 1, 3 and 6 to 8 of Annex III, Banka Slovenije the point 5(b) systems that credit institutions use, the Agency for Insurance Supervision the point 5(c) systems, and the Market Inspectorate the point 5(b) systems that consumer lenders under its supervision use.
Article 10(5) makes AKOS the market-surveillance authority for the high-risk systems in Annex I section A that are safety components of, or are themselves, products covered by EU harmonisation legislation, for the Annex III systems in points 2 and 4 and in points 5(a) and 5(d) (critical infrastructure, employment, public benefits eligibility and emergency-services triage), and for the Article 50 transparency obligations. Article 7 makes AKOS the single point of contact for the AI Act.
Article 17 makes AKOS responsible for establishing the AI regulatory sandboxes. AKOS can act against a provider, product manufacturer, deployer, authorised representative, importer, or distributor found, during its supervision, to be in breach of the AI Act, and forwards complaints from Slovenian users against providers established elsewhere to the coordinator in that provider's own country.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .