Slovenia

Article 6 of ZIUDHPUI names five market-surveillance authorities for the AI Act: the Agency for Communication Networks and Services of the Republic of Slovenia (AKOS), the Information Commissioner, Banka Slovenije, the Agency for Insurance Supervision and the Market Inspectorate of the Republic of Slovenia.

Article 10 divides supervision among them, giving the Information Commissioner the Article 5 prohibited practices and the high-risk systems in points 1, 3 and 6 to 8 of Annex III, Banka Slovenije the point 5(b) systems that credit institutions use, the Agency for Insurance Supervision the point 5(c) systems, and the Market Inspectorate the point 5(b) systems that consumer lenders under its supervision use.

Article 10(5) makes AKOS the market-surveillance authority for the high-risk systems in Annex I section A that are safety components of, or are themselves, products covered by EU harmonisation legislation, for the Annex III systems in points 2 and 4 and in points 5(a) and 5(d) (critical infrastructure, employment, public benefits eligibility and emergency-services triage), and for the Article 50 transparency obligations. Article 7 makes AKOS the single point of contact for the AI Act.

Article 17 makes AKOS responsible for establishing the AI regulatory sandboxes. AKOS can act against a provider, product manufacturer, deployer, authorised representative, importer, or distributor found, during its supervision, to be in breach of the AI Act, and forwards complaints from Slovenian users against providers established elsewhere to the coordinator in that provider's own country.

Article 176(3) punishes, to the same extent as paragraph 2, whoever for themself or another acquires, produces, distributes, sells, imports, exports, or otherwise offers pornographic or other sexual material that involves a minor or a minor's realistic likeness, or whoever possesses such material, gains access to it, or intentionally accesses it by means of information or communication technology, or discloses the identity of a minor depicted in it.

Because the provision reaches material involving a minor's realistic likeness (njihove realistične podobe) and not only material depicting an actual child, it extends to a synthetic, computer-generated, or otherwise artificial depiction that realistically portrays what appears to be a minor.

Paragraph 5 provides that the act in paragraph 3, insofar as it consists of acquiring, producing, possessing, or gaining access by means of information or communication technology to such material, is not unlawful where it is committed between minors of comparable age who agreed to it, matches their mental and physical maturity, and depicts those persons. Paragraph 5 was added, and the wording of paragraph 3 changed, by the 2021 amendment KZ-1I (Uradni list RS No. 186/21, Article 19).

Article 66(1) of the Media Act (ZMed-1) requires any programme content created partly or wholly with generative artificial intelligence systems to be clearly recognisable and set apart from the medium's other programme content. Article 66(2) requires such content to carry clear and systematic labels at the start and at the end of the content.

Article 66(3) requires publishers to tell users how they use AI systems, especially where that use can affect how content is used and understood or where AI systems automatically adapt and create content for different target groups. Under Article 66(4) the information and labels must be in Slovenian or in a language that users in Slovenia readily understand.

Article 66(5) treats the use of AI systems intended for users as misleading where it misleads or might mislead users and would be likely to affect their behaviour or opinion. Article 67 makes the publisher responsible for the accuracy of the statements and data in programme content generated or partly generated with AI systems, and for its compliance with the Act and other laws.

Where a violation is found, the publisher must remove such content as soon as possible and at the latest within one working day of a report. Article 95(2) makes the Agency for Communication Networks and Services (AKOS) the supervisor of Articles 66 and 67, among other provisions. Article 100(1) fines a legal person between EUR 2,000 and EUR 20,000 for the violations it lists.

Those violations include failing to recognise and set apart AI-generated content, failing to label it, failing to tell users how AI systems are used, and failing to give the information and labels in Slovenian or a language users readily understand. Article 116 provides that the Act takes effect on the fifteenth day after its publication in the Uradni list. The Act was published in Uradni list RS 69/2025 on 12 September 2025, so it took effect on 27 September 2025.

ZVOP-2 Part II Chapter 4 regulates the processing of personal data using biometrics and genetic data. Article 81(1) states processing of biometric personal data contrary to this chapter's provisions is prohibited. Article 81(2) requires any other law that provides for biometric processing to set the conditions of its use as well.

Article 81(3) bars linking biometric-data collections with other collections, or enabling their General Data Protection Regulation (GDPR) Article 20 portability, unless another law provides otherwise or the person concerned consents. In the private sector, Article 83(1) allows biometric processing only where it is necessary for the activity, the safety of people or property, or the protection of classified data or trade secrets, and the processing operations must be certified under Article 52.

Article 83(2) allows a private person to process biometric data to verify the identity of its customers where another law, the contract or the customer's explicit consent provides for it. Article 84 bans requiring or obtaining biometric personal data in exchange for services in the course of marketing.

Separately, in Chapter 3 (Video Surveillance), Article 80 bans, on public surfaces, automated license-plate-recognition systems and systems processing biometric personal data, backed by Article 105 fines of EUR 5,000 to 20,000, or EUR 10,000 to 30,000 for a medium-sized or large company. Article 80 is entirely a public-video-surveillance provision. Article 5(1) gives the Act's terms the meaning they have in GDPR Article 4, so biometric data takes the GDPR Article 4(14) definition. Article 5(2) adds twelve further definitions, and none concerns voice data or a voiceprint.

A provider of public communications services must notify the Agency for Communication Networks and Services (AKOS) without delay of a personal data security breach. The provider must also notify the affected subscriber or individual without undue delay where the breach is likely to harm their personal data and privacy. That notice is not needed where the provider has satisfactorily shown the agency that it applied appropriate technical protection measures to the data concerned.

The agency may order a provider that has not notified the subscriber or individual to do so. The notice to the subscriber or individual must contain at least a description of the breach, contact points and recommended mitigating measures, and the notice to the agency must also describe the consequences and the measures proposed or taken. Providers must keep a sufficient inventory of personal data breaches.

A controller must notify the Information Commissioner without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms, and must notify the affected individual without undue delay where the breach is likely to result in a high risk.

Separately, ZVOP-2 Article 23(1) applies, with the necessary changes, the Information Security Act's provisions on security measures and incident notification for essential entities to information systems that process data under the laws listed in its point 1, that process the data of more than 100,000 people under a law, that serve a controller or processor whose core activity is large-scale processing of special categories of data, or that process special categories of data of more than 10,000 people, where the controller is not already bound by that Act's measures.

Slovenia adopted ZVOP-2 on 15 December 2022, replacing the original 2004 ZVOP-1. Article 67 of the Information Security Act (ZInfV-1, Official Gazette of the Republic of Slovenia 40/25), in force from 19 June 2025, replaced the words on security requirements in Article 23(1) of ZVOP-2 with words on risk management measures.

A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier.

Separately, ZVOP-2 Article 23(4) bars keeping outside the territory of Slovenia the data collections of the information systems named in Article 23(1), point 1, which process data under the laws on administrative internal affairs, the financial administration, citizenship, the intelligence and security agency, defense, health care, compulsory health insurance, rights from public funds, and criminal and misdemeanor records.

Article 98(1) fines a legal person that keeps them abroad EUR 4,000 to 12,000, or EUR 8,000 to 36,000 where it is a medium-sized or large company.

General Data Protection Regulation (GDPR) Article 22 gives a person in Slovenia the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Slovenia can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.

ZVOP-2 Article 11 lets a person seek judicial protection of these rights against a public or private controller or processor for as long as a violation continues, including damages, without first complaining to the Information Commissioner. Article 69(8) narrows the rights for scientific, historical or statistical research: access and objection remain, and rectification, erasure, restriction and portability apply only where exercising them would not jeopardise the research.

Informacijski pooblascenec (the Information Commissioner) is Slovenia's supervisory authority. ZVOP-2 Articles 114-115 require the misdemeanor-law fining authority to weigh proportionality alongside General Data Protection Regulation (GDPR) Article 83(1) factors, and Article 115 allows a fast-track fine above the statutory minimum. Article 116 requires the processing operations under Article 23(1) to come into compliance with Article 23 within three years of the law's entry into force.

GDPR Article 82 arms an individual with a direct private right of action, exercised through ZVOP-2 Article 11's judicial-protection route.

Article 221 criminalizes unauthorized entry into, or breaking into, an information system, and unauthorized interception of data during its non-public transmission into or out of the system (paragraph 1); it separately criminalizes the unauthorized use, alteration, copying, transfer, or destruction of data in an information system, unauthorized entry of data into one, or obstructing the transfer of or access to data or the operation of the system (paragraph 2).

Paragraph 3 sets a higher penalty where the paragraph 2 act, committed with tools of the kind described in Article 306(3), obstructs operation or otherwise affects three or more information systems.

Paragraph 4 sets a higher penalty where the paragraph 2 act causes significant damage, is committed in a criminal association (hudodelska združba), is committed against the information system of a critical infrastructure operator, or is committed against the information system of a person bound by the law on information security. The current wording comes from the 2021 amendment KZ-1I (Uradni list RS No. 186/21, Article 29), which changed all four paragraphs.

Article 65 of the Zakon o informacijski varnosti (ZInfV-1) replaced Article 115 of the Zakon o elektronskih komunikacijah (ZEKom-2, Electronic Communications Act) so that operators' security duties run through the information security law.

Article 115(1), as replaced, requires an operator to establish and maintain a documented information security management system (SUVI) and a continuity management system (SUNP) and to take appropriate, effective and proportionate technical, operational and organizational measures to ensure the integrity, authenticity, confidentiality and availability of the network and information systems it uses and to prevent or reduce the impact of incidents on recipients of its services.

The operator must treat the SUVI and SUNP as a business secret, and must review the part of the SUNP that covers emergency communication at least once a year, with prior approval of the competent bodies for its adoption and any change. Article 115(4) has the national agency issue a general act prescribing special technical guidance and technical and organizational measures for operators where ENISA documents or Commission guidelines show that sector-specific measures are needed.

Under Article 62(3) of the ZInfV-1, an essential or important entity that is an operator adopts the risk-management measures of Articles 21 and 22 of that Act within one year of its entry into force, and until then the security measures of chapter VII of the ZEKom-2 apply. The ZInfV-1 entered into force on the fifteenth day after its publication in the Uradni list, which was 4 June 2025, so on 19 June 2025.

Article 116(1) of the ZEKom-2 adds further security requirements and restrictions for operators of mobile communications networks that supply those networks to critical infrastructure operators, essential service providers, government bodies or holders of key parts of the state security system.

Article 22(1) requires an essential or important entity to adopt technical, operational and organisational measures to secure the integrity, authenticity, confidentiality and availability of the network and information systems it uses for its work or to provide its services, and to prevent or reduce the impact of an incident on the recipients of its services and other services.

Article 22(2) requires those measures to follow an all-hazards approach covering at minimum management support for information and cybersecurity, personnel integrity checks before, during and after employment (cross-referencing Article 23), basic cyber-hygiene practices and training, human-resources security and access-rights management, backup management, the logging duty of Article 24, supply-chain security with minimum requirements for key suppliers, cryptography and encryption policy, and further items through point 17 of paragraph 2.

Article 20 assigns responsibility for these measures to the entity's odgovorna oseba (responsible person, the individual who leads, supervises or manages a legal person's business, or is otherwise legally charged with ensuring its lawful operation, or the head of a public-administration body), who must approve the Article 22 measures, oversee their implementation, complete cybersecurity risk-management training at least every four years, and ensure regular staff training.

Article 6(1) binds an entity within Priloga 1 (Annex 1, highly critical sectors) or Priloga 2 (Annex 2, other critical sectors) that has at least 50 employees and an annual turnover or balance-sheet total of at least EUR 10 million; Article 6(2) drops that threshold for, among others, a public electronic-communications or trust-service provider, a top-level domain (TLD) registry or DNS provider, a sole national provider of the service, and a public-administration body.

Article 62(1) gives essential and important entities eighteen months from the Act's entry into force to adopt these measures.

Article 62(2) gives an essential entity already designated as an essential-service operator under Article 6 of the predecessor Zakon o informacijski varnosti, and a state-administration body designated under that Act's Article 9, one year from the Act's entry into force to adopt them, and until that year ends the security requirements, security documentation, security measures and associated supervision and penal provisions of the predecessor Act and of the regulation referred to in Article 69(2) continue to apply to them.

Article 62(3) gives an essential or important entity that is an operator under the Zakon o elektronskih komunikacijah (Electronic Communications Act) the same one year, and until that year ends the security measures of Chapter VII of that Act and the general act on the security of networks, services and data named in Article 69(3) continue to apply to it. The Act entered into force on 19 June 2025, so the eighteen months run to 19 December 2026 and the one year to 19 June 2026.

This Act, the ZInfV-1, by its own Article 69(1) repeals the predecessor Zakon o informacijski varnosti (Uradni list RS, št. 30/18, 95/21, 130/22, 18/23 and 49/23), Slovenia's NIS1-era transposition, together with four implementing regulations and two general acts that carried the risk-management and security-documentation duties under it.

Article 29(3) of this Act, in the companion notification row, confirms that a provider of an online marketplace, an online search engine or a social-networking-services platform is among the essential or important entities this Article 6 scope reaches, naming them for variant notification treatment; that same population is bound by this row's Article 22 risk-management duty.

Article 29(1) requires an essential or important entity to notify its competent computer security incident response team (CSIRT) group of every incident that has a significant impact on the provision of its services, an incident that is significant (pomemben incident) where it has caused, or could cause, the entity serious operational disruption or financial loss, or has affected, or could affect, another natural or legal person by causing substantial material or non-material damage.

Article 30(1) sets the notification clock: an early warning without delay, at latest within 24 hours of detecting the significant incident, indicating where relevant whether the incident is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect; a full notification without delay, at latest within 72 hours, updating that information with an initial assessment of the incident's severity and impact and, where available, threat indicators; an interim report on the CSIRT group's request; and a final report, at latest one month after the 72-hour notification, describing the incident, its severity and impact, the likely threat or root cause, mitigating measures taken or under way, and any cross-border effect, with a progress report substituting where the incident is still ongoing and the final report then due within one month of resolution.

Article 29(3) applies a variant scope to a DNS service provider, top-level domain (TLD) registry, cloud, data-centre or content-delivery-network provider, a managed-service or managed-security-service provider, and a provider of an online marketplace, an online search engine or a social-networking-services platform, directing them to the European Commission's NIS2 implementing acts for the particular cases in which an incident counts as significant for their service.

Article 29(6)-(7) requires the entity to inform the recipients of its services, without delay, of a significant incident likely to adversely affect them, and to communicate to a recipient potentially affected by a significant cyber threat the measures it can take in response. Unlike the companion risk-management-measures row, Article 62 phases in only Articles 21 and 22, so this notification duty binds from the Act's own commencement on 19 June 2025.

Article 226, paragraph 1 of the Electronic Communications Act (ZEKom-2) allows automated calling and communication systems that make calls to a subscriber's telephone number without human intervention (for example automatic dialers, SMS and MMS), telefaxes and electronic mail to be used for direct marketing only with the subscriber's or user's prior consent.

Article 226, paragraph 2 lets a natural or legal person who obtains a buyer's e-mail address from the buyer of its products or services use it for direct marketing of its own similar products or services, if the buyer is clearly and expressly offered a free and simple way to refuse such use when the contact details are obtained and with every message, where the buyer did not refuse at the start. Article 226, paragraph 4 applies paragraphs 1 and 3 to subscribers who are natural persons.

Article 226, paragraph 5 bans sending e-mail for direct marketing, contrary to the law on electronic commerce, that hides or disguises the identity of the sender on whose behalf the message is sent, or that has no valid address to which the recipient can send a request to stop such messages. Article 226, paragraph 5 also bans sending direct-marketing e-mail that invites recipients to visit websites that are contrary to that law.

Article 226, paragraph 6 lets a natural or legal person use the e-mail address of natural persons where a legal person publishes that address publicly as its contact e-mail address. Article 226, paragraph 7 gives every natural or legal person harmed by a violation, including a service provider protecting its business interests and those of its customers, a legal interest to bring a civil action or seek an interim order against the violator.

Article 301, paragraph 1 fines a legal person EUR 200 to EUR 1,000, or EUR 1,000 to EUR 20,000 where it is a medium-sized or large company, for the breaches it lists. Article 301, paragraph 1 lists using automated calling and communication systems, telefaxes or e-mail for direct marketing without consent, and using a buyer's e-mail address without offering a free and simple refusal, among those breaches.

Article 301, paragraph 1 also lists hidden or disguised identity, an invalid address, and inviting recipients to websites contrary to the law on electronic commerce among those breaches. Article 229 has the Agency supervise the provisions of its chapter, except articles 216, 220, 221, 223 and 225, which the Information Commissioner supervises.

Article 230 establishes the Agency for Communication Networks and Services of the Republic of Slovenia (Agencija za komunikacijska omrežja in storitve) as a legal person under public law. Article 323 provides that the Act takes effect on the thirtieth day after its publication in Uradni list, which was on 11 October 2022.

Article 225, paragraph 1 of the Electronic Communications Act (Zakon o elektronskih komunikacijah, ZEKom-2) allows storing data in, or gaining access to data stored in, the terminal equipment of a subscriber or user only on condition that the subscriber or user consented after being clearly and comprehensively informed in advance about the controller and the purposes of processing, in accordance with the personal data protection rules.

Article 225, paragraph 2 allows technical storage of or access to data solely to carry a message over an electronic communications network, or where strictly necessary to provide an information society service that the subscriber or user expressly requested. Article 225, paragraph 3 provides that, where technically feasible and effective and in line with data protection rules, the user can also express consent through suitable browser or other application settings.

Article 225, paragraph 4 applies this Act where a breach of the information and consent rules is also a breach of the data protection rules. Article 225, paragraph 5 has the Information Commissioner carry out inspection supervision of the article. Article 301, paragraph 1 fines a legal person EUR 200 to EUR 1,000, or EUR 1,000 to EUR 20,000 where it is a medium-sized or large company, for the breaches it lists.

Article 301, paragraph 1 lists processing a user's data obtained as article 225, paragraph 1 describes, without the user's prior consent and without clear and comprehensive prior information, among those breaches. Article 229 has the Agency supervise the provisions of its chapter, except articles 216, 220, 221, 223 and 225, which the Information Commissioner supervises.

Article 230 establishes the Agency for Communication Networks and Services of the Republic of Slovenia (Agencija za komunikacijska omrežja in storitve) as a legal person under public law. Article 323 provides that the Act takes effect on the thirtieth day after its publication in Uradni list, which was on 11 October 2022.

Article 137, paragraph 1 of the Criminal Code (Kazenski zakonik, KZ-1) punishes with a fine or imprisonment of up to one year whoever, without justification, uses special devices to listen to a conversation or statement not meant for them or to record its sound, or who relays such a conversation or statement to a third person, plays such a recording to them or otherwise lets them become directly acquainted with it.

Article 137, paragraph 2 equally punishes whoever records the sound of a confidential statement of another person addressed to them, without that person's consent, in order to misuse it, or relays such a statement or plays such a recording to a third person. Article 137, paragraph 3 raises the penalty to imprisonment of three months to five years where an official commits either offence by abusing their official position or rights.

Article 137, paragraph 4 starts prosecution of the first offence on a proposal and of the second on a private lawsuit. Article 381 provides that the Code takes effect on 1 November 2008.

Article 214, paragraph 1 of the Electronic Communications Act (ZEKom-2) extends the confidentiality of communications to their content, to the traffic and location data connected with them, and to facts and circumstances concerning an interrupted connection or a connection that was not established. Article 214, paragraph 2 requires the operator and everyone who takes part in its activity to protect the confidentiality of communications even after the activity ends.

Article 214, paragraph 3 lets those bound obtain information about communications only to the extent strictly needed to provide certain public communications services, and use or pass it on only for providing those services.

Article 214, paragraph 4 requires operators that must obtain the content of communications, or record or store communications and related traffic data, to tell the subscriber or user so when the subscription contract is concluded or the service begins, and to delete the content as soon as it is technically feasible and no longer needed for the service.

Article 214, paragraph 5 prohibits all forms of monitoring or interception of communications by third persons who are not users taking part in the communication, such as listening, intercepting, recording, storing and passing on, without the consent of the users concerned, except as paragraph 4 and articles 220 and 228 allow or where strictly needed to carry the message.

Article 214, paragraph 6 prohibits users too from recording and storing communications without the prior consent of the participants where such processing is not usual and the participants cannot expect it because of the nature of the communication.

Article 214, paragraph 7 allows recording of communications and the related traffic data in the course of lawful business practice to provide evidence of a market transaction or any other business communication, on condition that the parties are told in advance about the recording, its purpose and how long the recording is kept.

Article 214, paragraph 7 requires the recorded message to be deleted immediately, and at the latest when the time in which the transaction can lawfully be challenged runs out. Article 214, paragraph 8 requires the notice of recording to be given by the same type of medium and in the same form as the recorded communication. Article 299, paragraph 1 fines a legal person EUR 1,000 to EUR 20,000, or EUR 50,000 to EUR 400,000 where it is a medium-sized or large company, for the breaches it lists.

Article 299, paragraph 1 lists among those breaches obtaining information on communications beyond what is strictly needed, failing to notify the subscriber or delete content, monitoring or intercepting communications where this Act does not expressly allow it, recording and storing communications contrary to paragraph 6, and failing to notify the parties of a recording or deleting the recording on time.

Article 229 has the Agency supervise the provisions of its chapter, except articles 216, 220, 221, 223 and 225, which the Information Commissioner supervises. Article 230 establishes the Agency for Communication Networks and Services of the Republic of Slovenia (Agencija za komunikacijska omrežja in storitve) as a legal person under public law. Article 323 provides that the Act takes effect on the thirtieth day after its publication in Uradni list, which was on 11 October 2022.

Article 7, paragraph 2 of the Whistleblower Protection Act (Zakon o zaščiti prijaviteljev, ZZPri) requires an oral report to be entered in the register of reports by an accurate record of its content. Article 7, paragraph 2 allows an oral report to be recorded as audio also, with the whistleblower's consent. Article 7, paragraph 2 allows a report made by telephone to be documented by recording the call, after prior notice and with the whistleblower's consent.

Article 7, paragraph 2 gives the whistleblower the chance, if they wish, to check, correct and confirm with their signature the record of the oral report. Article 9, paragraph 1 requires an internal reporting channel to be set up by designating a dedicated e-mail address and telephone number or other contact details for receiving reports, measures to prevent disclosure of the whistleblower's identity, and a trusted person.

Article 9, paragraph 2 makes entities in the public and private sector with 50 or more employees obliged to set up an internal reporting channel. Article 33, paragraph 2 gives private-sector obliged entities with up to 249 employees until 17 December 2023 to set up their internal reporting channels. Article 35 provides that the Act takes effect on the fifteenth day after its publication in Uradni list, which was on 7 February 2023.

Article 226, paragraph 1 of the Electronic Communications Act (ZEKom-2) allows automated calling and communication systems that make calls to a subscriber's telephone number without human intervention (for example automatic dialers, SMS and MMS) to be used for direct marketing only with the subscriber's or user's prior consent.

Article 226, paragraph 3 allows the use of means for direct marketing by electronic communications other than those in paragraphs 1 and 2 only with the consent of the subscriber or user. Article 226, paragraph 3 requires refusing consent to be free of charge for the subscriber or user. Article 226, paragraph 3 also requires paragraphs 3, 4 and 5 of article 217 to be respected when a voice communications service is used.

Article 217, paragraph 3 gives subscribers the option to prohibit the use of their personal data for calls with a commercial or research purpose, for either purpose or both, when entered in a directory or at any later time. Article 217, paragraph 5 requires persons making calls with a commercial or research purpose to respect at each call the prohibition marked in the latest published electronic directory, if it differs from the marking in the printed directory of the same publisher.

Article 226, paragraph 4 applies paragraphs 1 and 3 to subscribers who are natural persons. Article 301, paragraph 1 fines a legal person EUR 200 to EUR 1,000, or EUR 1,000 to EUR 20,000 where it is a medium-sized or large company, for the breaches it lists.

Article 301, paragraph 1 lists using other means of direct marketing by electronic communications without consent, making refusal of consent chargeable, and not respecting article 217, paragraphs 3, 4 and 5 in voice calls, among those breaches. Article 300, paragraph 1 fines a legal person EUR 500 to EUR 15,000, or EUR 20,000 to EUR 50,000 where it is a medium-sized or large company, for the breaches it lists.

Article 300, paragraph 1 lists using a subscriber's personal data for commercial or research calls despite the subscriber's prohibition among those breaches. Article 229 has the Agency supervise the provisions of its chapter, except articles 216, 220, 221, 223 and 225, which the Information Commissioner supervises.

Article 230 establishes the Agency for Communication Networks and Services of the Republic of Slovenia (Agencija za komunikacijska omrežja in storitve) as a legal person under public law. Article 323 provides that the Act takes effect on the thirtieth day after its publication in Uradni list, which was on 11 October 2022.

Article 17(1) provides that, where the procedural options for removing illegal content under the Regulation are exhausted and no other law provides otherwise, the District Court in Ljubljana (Okrožno sodišče v Ljubljani) decides on the removal of illegal content. Article 17(2) has the court decide on the motion of a recipient of the service.

Article 17(3) lets the court order a hosting provider to remove, disable or restrict access to the online interface, order a mere-conduit provider to restrict access or display a warning about the infringement on the interface, and order domain registries or registrars to delete a domain name or temporarily delete its name servers. Article 17(7) requires the court to choose the measure that least burdens the provider of intermediary services and only to the extent necessary to achieve the goal.

Article 17(8) requires the court to decide on the motion within 30 days of receiving it and provides that an appeal does not suspend execution. Article 11 has a single judge of the competent district court decide on a supervisory body's request for a temporary restriction of access under Article 51(3) of the Regulation.

Article 53(1) requires a publisher that allows the public to comment within its medium to draw up commenting rules and publish them in a suitable place in the medium. Article 53(2) requires the rules to set how a comment is signed, to prohibit inciting violence or hatred toward a group of persons on the listed grounds, to allow a complaint about a breach of the rules, and to set a procedure for handling complaints.

Article 53(3) requires the publisher to remove a comment that does not follow the published rules as soon as possible after a report, and at the latest within one working day. Article 101(1) punishes a legal person that fails to draw up or publish the commenting rules, whose rules lack the required content, or that does not remove a non-compliant comment in time, with a fine of EUR 1,000 to 10,000. Article 116 provides that the Act takes effect on the fifteenth day after its publication.

Article 3(1) makes the Agency for Communication Networks and Services (AKOS) the body that performs the tasks of the digital services coordinator, and Article 3(2) makes the Information Commissioner (Informacijski pooblaščenec) the other competent authority under Article 49 of the Regulation. Article 7(1) has the Agency supervise the Regulation, except Articles 26(1) and (3) and 28, which the Information Commissioner supervises.

Article 8(2) lets the supervisory body, after the provider has replied or the time to reply has passed, demand that the infringement stop immediately or within a reasonable time and take appropriate and proportionate measures. Article 9(1) lets a provider of intermediary services that is subject to supervision proceedings propose commitments to ensure compliance with the relevant provisions of the Regulation.

Article 10(3) lets the supervisory body impose a monetary penalty of up to EUR 50,000 on a provider that does not follow its order. Article 10(4) lets the supervisory body repeat those penalties until their sum reaches 5 percent of average daily worldwide turnover or income per day.

Article 20(1) sets the fine for a legal person that breaches the listed provisions of the Regulation as a provider of intermediary services at EUR 2,000 to 20,000, or EUR 50,000 to 400,000 for a legal person that counts as a medium-sized or large company. Article 20(5) sets the fine for a legal person that commits a particularly serious breach, because of the damage caused, the unlawful gain or intent, at up to 6 percent of annual worldwide turnover.

Article 21(1) sets a fine of EUR 500 to 15,000, or EUR 20,000 to 50,000 for a medium-sized or large company, for giving an authorized person of the Agency incorrect, incomplete or misleading information, failing to give written explanations or documentation on request, failing to correct information, or obstructing an inspection. Article 25 ends the application of Articles 8, 9, 10 and 11 of the Zakon o elektronskem poslovanju na trgu on the day the Act takes effect. Article 26 provides that the Act takes effect on the eighth day after its publication.

Article 155(1) makes whoever puts into circulation a thing it made, which because of a defect threatens persons or things with harm, liable for the damage that the defect causes. Article 155(2) makes the producer liable also for the dangerous properties of a thing if it did not do everything needed to prevent the foreseeable harm by a warning, safe packaging or another suitable measure.

The government's explanatory text for the draft replacement Act says the former rule of the Zakon o obligacijskih razmerjih on the producer's liability for a thing with a defect passed into Article 155 of the OZ. The same text says that objectively designed liability of the producer for a product with a defect was already regulated in the former Zakon o obligacijskih razmerjih. The Obligacijski zakonik was published in the Uradni list RS, number 83/2001, on 25 October 2001. Article 1062 brings the Code into force on 1 January 2002.

Article 58(1) makes the producer of goods liable for damage that a defect in the goods causes by death, bodily injury or injury to health, or by damage to another thing. Article 58(2) makes the producer pay for damage to another thing where the thing is ordinarily meant for private use and the injured person mainly used it privately, with the injured person bearing a share of EUR 500 in that damage.

Article 58(3) treats every supplier as the producer where neither the producer nor the importer can be identified, unless the supplier tells the injured person within a reasonable time who the producer or importer is or who supplied the goods. Article 59 defines goods for the chapter as any movable thing, even where it is part of another movable thing or connected with an immovable, including electricity.

Article 60(1) makes goods defective when their safety is not what a consumer may justifiably expect, judged on the presentation of the goods, their foreseeable use in a reasonable manner and the time they were put into circulation. Article 60(2) provides that goods are not defective only because better goods were put into circulation later. Article 61 requires the injured person to prove the defect, the damage and the causal link between them.

Article 62 treats goods as put into circulation when the producer made them available or in use, or sent them out, whatever the legal basis. Article 63 ties the producer's liability to a ten-year period running from the day it put the defective goods into circulation.

Article 64(1) excuses the producer who proves that it did not put the goods into circulation, that it follows from the circumstances that the defect did not exist when it did, or that the defect results from compliance with mandatory rules. Article 64(1) also excuses a producer that made only a component or a raw material, where the defect arose from the design of the goods it went into or from the instructions of the producer of those goods.

Article 64(1) keeps the development-risk defense: the producer is excused where the state of science and technical progress when it put the goods into circulation did not allow the defect to be discovered. Article 64(1) also excuses a producer that did not make the goods for sale or another form of distribution for economic purposes, and did not make or put them into circulation in the course of its activity. Article 64(2) bars limiting or excluding liability under the chapter by contract.

Article 65 gives the rights under the chapter also to persons who are not consumers under the Act. Article 3(1) applies the law on obligations to relations that the consumer-protection laws do not govern. The Državni zbor adopted the Act on 29 September 2022. The Act was published in the Uradni list RS, number 130/2022, on 11 October 2022. Article 249 brings the Act into force on the fifteenth day after its publication and applies it three months after it enters into force.

The government's explanatory text for the draft replacement Act describes the previous ZVPot as having set the liability of the producer for a product in its Articles 4 to 11.a.

Under Article 14 as amended by ZAvMS-B (Uradni list RS No. 204/2021 of 28 December 2021), a provider of an audiovisual media service in Slovenia must classify content that could harm a child's physical, mental or moral development into one of five bands, the most restrictive being adult content covering unjustified violence and pornography.

Adult content on a non-linear service must sit behind a default-locked, PIN-code-equivalent technical control that only an adult who understands its purpose can unlock. Any personal data of a child collected through that control may be processed only to verify the user's age.

Programme content that could seriously harm the physical, mental or moral development of children, such as pornography and unjustified violence, may be offered in the media only so that children cannot normally access it. The Act gives an appropriate technical means or technical protection as an example of how to do this. The media are also barred from harming the physical, mental or moral development of children.

The rule on protecting children applies to all forms of communication addressed to the general public, including the activity of influencers, whether or not they count as media under the Act, unless the communication is exclusively private between individuals. The Act applies to audiovisual media services only on questions that the law on audiovisual media services does not regulate, unless the Act provides otherwise.

A legal person that offers such content in a way children can normally access commits a more serious offence (hujši prekršek). That offence carries a fine of 2,000 to 20,000 euros for a legal person. The Inspectorate of the Republic of Slovenia for Culture and Media supervises the application of the Act. The communications agency AKOS supervises Article 52 where it concerns radio programmes. The Act takes effect on the fifteenth day after its publication in the Uradni list. It was published in Uradni list RS number 69/2025 of 12 September 2025, so it took effect on 27 September 2025.

A video-sharing platform provider within Slovenian jurisdiction must adopt appropriate measures to protect children from content that could harm their physical, mental or moral development. The statute names an age-verification system for platform users and a user-managed parental-control system as example measures.

The provider must also publish rules that set out how users can report breaches, how reports are handled, which measures remove unlawful content, and how complaints against those measures are handled. Data collected under these measures may be processed only to verify a user's age.

A media publisher established in the European Union holds an exclusive right to reproduce its media publication and to make it available to the public for use by an information-society-service provider.

The right excludes private or non-commercial use by individual users, the act of inserting a hyperlink, and use of individual words or very short extracts from the publication, and it does not affect the rights of the authors or related-rights holders whose works or subject matter the publication incorporates. It runs two years from the publication's first lawful publication.

An author is separately entitled to an appropriate share of the revenue the publisher receives from an information-society-service provider under this right, a share the author cannot waive.

Article 57.a permits, without authorization, reproduction of works lawfully accessed for text-and-data-mining purposes, defined as any automated analytical technique for analyzing text and data in electronic form to generate information such as patterns, trends, and correlations.

That general exception does not apply where the author has expressly and appropriately reserved use of the work, in particular through internationally recognized, standardized, machine-readable means carrying metadata and terms of use for a work publicly available online. Any contractual provision contrary to this article is void.

Article 57.b creates a separate, unconditional exception, without that reservation mechanism, for research organizations, public archives, libraries, museums, film or audio heritage institutions, and public broadcasters carrying out text and data mining for scientific research on works they lawfully access.