Slovenia AI Regulation Overview

Overview

Slovenia addresses artificial intelligence through a hybrid governance framework combining directly applicable European Union law with comprehensive national statutory and policy instruments. The centerpiece of Slovenia's binding statutory regime is the Act on the Implementation of the (EU) Regulation on Harmonised Rules on Artificial Intelligence (ZIUDHPUI), adopted by the National Assembly in October 2025 and entered into force in November 2025. ZIUDHPUI provides the national procedural, administrative, and institutional structure required to enforce Regulation (EU) 2024/1689 (the EU AI Act) across the country.

Alongside binding statutory measures, Slovenia guides its artificial intelligence ecosystem through high-level national policy frameworks. These include Digitalna Slovenija 2030 (DSI2030), adopted in March 2023, the Strategy for Digital Public Services 2030, adopted in December 2022, and the National Programme for the Promotion of the Development and Use of Artificial Intelligence in the Republic of Slovenia until 2025 (NpUI), confirmed in June 2021. Together, these frameworks establish national objectives for trustworthy AI deployment, research excellence, public sector digitalization, regulatory sandboxes, and ethical oversight.

Regulatory Approach

Slovenia's regulatory approach is strictly aligned with the risk-based and harmonized framework established at the European Union level. Because Regulation (EU) 2024/1689 applies directly across Member States, Slovenia's national implementing act (ZIUDHPUI) does not alter or duplicate the substantive obligations imposed on providers, deployers, importers, or distributors of AI systems. Instead, ZIUDHPUI concentrates on operationalizing national enforcement, establishing administrative competences, designating market surveillance and notifying authorities, and creating support structures for compliance and innovation.

The national governance model combines horizontal ministerial coordination with specialized sectoral supervision. The Ministry for Digital Transformation acts as the central national coordinator, national contact point, and administrative lead for regulatory sandboxes and SME outreach. Sectoral supervision is distributed among existing regulatory authorities, including the Agency for Communication Networks and Services (AKOS), Banka Slovenije, the Insurance Supervision Agency (AZN), the Information Commissioner, and the Market Inspectorate, preserving agency independence while enforcing AI requirements through established administrative procedure frameworks.

Key AI Legislation

• Act on the Implementation of the (EU) Regulation on Harmonised Rules on Artificial Intelligence (ZIUDHPUI) (2025): National implementing law that allocates administrative competences, designates market surveillance and notifying authorities, establishes the National Council for Ethics in AI, regulates regulatory sandboxes, and sets enforcement rules under Regulation (EU) 2024/1689.
• Digitalna Slovenija 2030 (DSI2030) (2023): Overarching national strategy for digital transformation aligning Slovenia with the EU Digital Compass; encompasses data governance, the national AI ecosystem, gigabit infrastructure, digital skills, and cybersecurity resilience.
• Strategy for Digital Public Services 2030 (2022): Strategic framework defining digital public administration targets, data-sharing protocols, interoperability, eID enablement, and privacy-by-design standards across public institutions.
• National Programme for the Promotion of the Development and Use of Artificial Intelligence until 2025 (NpUI) (2021): Strategic policy document establishing ten strategic goals and six priority sectors (health, Industry 4.0, digital public services, language technologies, sustainable food/environment, and spatial planning) for national AI R&D and uptake.

Governance & Enforcement Bodies

Administrative governance under ZIUDHPUI designates specific competencies based on systemic risks and sector mandates. The Ministry for Digital Transformation serves as the primary national contact point for industry, civil society, and European bodies, and leads the operationalization of national regulatory sandboxes and literacy programmes. Notification of conformity assessment bodies for high-risk AI systems is distributed among responsible ministries and agencies, including the ministry responsible for the internal market, the ministry for infrastructure, the ministry for health, and the Public Agency for Medicines and Medical Devices (JAZMP).

Market surveillance and operational enforcement are carried out by designated sectoral bodies. AKOS acts as a primary market surveillance authority and single contact point for public guidance. Financial AI systems are supervised by Banka Slovenije (banking) and the Insurance Supervision Agency (AZN) (insurance). Fundamental rights and privacy considerations fall under the Information Commissioner, while general product safety and conformity are supervised by the Market Inspectorate. The Inspectorate for the Information Society monitors public sector transparency and publication obligations, and the national accreditation body oversees conformity assessment bodies.

Penalties & Enforcement

ZIUDHPUI integrates enforcement modalities required by Regulation (EU) 2024/1689 into Slovenian administrative and inspection procedures. The national act relies on statutory inspection laws, technical conformity frameworks, and sectoral supervisory statutes to execute investigative and corrective powers. Authorities are empowered to request technical documentation, perform post-market monitoring reviews, conduct compliance inspections, and mandate corrective actions or system withdrawals where non-compliance is identified.

Administrative sanctions and financial penalties for violations of AI requirements operate in direct harmony with the administrative fine caps prescribed in the EU AI Regulation. Proceedings follow national administrative procedure legislation, ensuring procedural safeguards, rights of appeal, and judicial review for affected entities through Slovenian courts.

Data Protection Framework

Data protection within Slovenia's AI landscape is governed by the EU General Data Protection Regulation (GDPR) and overseen by the Information Commissioner (Informacijski pooblaščenec). Under ZIUDHPUI, the Information Commissioner is explicitly designated as a market surveillance authority for AI systems that process personal data or impact fundamental rights, ensuring seamless oversight at the intersection of privacy laws and AI technologies.

National strategic instruments, including DSI2030 and the Strategy for Digital Public Services 2030, reinforce strict data stewardship rules. Public sector AI deployments and data-sharing platforms must embed privacy-by-design, data minimisation, and semantic interoperability. The corpus holds no record of standalone national data localization requirements beyond GDPR-aligned cross-border data transfer rules.

Sector-Specific Rules

Slovenia's regulatory framework applies sector-differentiated supervision as mapped out by ZIUDHPUI and national policy documents. In healthcare and medical technology, high-risk AI systems and conformity assessments fall under the joint domain of the Ministry of Health and the Public Agency for Medicines and Medical Devices (JAZMP). Financial sector deployments are supervised directly by Banka Slovenije for banking entities and the Insurance Supervision Agency (AZN) for insurance providers.

The National Programme for AI (NpUI) identifies six priority application sectors for reference projects and targeted public investments: healthcare, Industry 4.0 / advanced manufacturing, digital public services, Slovenian language technologies, sustainable food production and environment, and spatial planning. Each sector is encouraged to establish tailored pilots, pre-commercial procurements, and data governance frameworks aligned with broader European single-market rules.

International Alignment

Slovenia's artificial intelligence policies are explicitly anchored in European and international norms. The national legal regime is built directly upon EU Regulation 2024/1689 (EU AI Act), ensuring total harmonization with the European legal framework. National strategies such as DSI2030 and Digital Public Services 2030 are designed around the European Union's Digital Compass and 'Path to the Digital Decade' political goals.

At the policy level, NpUI adopts OECD and EU definitions for AI systems and adheres to international guidelines on human-centric, trustworthy AI. Slovenian supervisory bodies participate in EU-wide coordination mechanisms, including the European AI Board and the European AI Office, exchanging supervisory findings and feeding data into the centralized EU high-risk AI system database.

Future Developments

With ZIUDHPUI entering into force in November 2025, Slovenia's administrative priorities center on operationalizing regulatory sandboxes, establishing the National Council for Ethics in AI, and aligning supervisory agency budgets and statutes. Sectoral authorities are mandated to adjust their operational workflows and secure state budget resources to fulfill expanded market surveillance duties.

On the strategic front, public authorities are updating national action plans tied to DSI2030 and Digital Public Services 2030. As the National Programme for AI (NpUI) reaches the conclusion of its 2021–2025 implementation window, national authorities and cross-ministerial working groups are conducting evaluation reviews to inform successor AI strategic initiatives and long-term research infrastructure funding.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Ministry for Digital Transformation (Ministrstvo za digitalno preobrazbo)	Central national coordinator, contact point, regulatory sandbox lead, and SME outreach authority under ZIUDHPUI and DSI2030.	Operates regulatory sandboxes, coordinates line ministries, prepares annual national action plans, and manages public awareness programmes.
Agency for Communication Networks and Services (AKOS)	Designated market surveillance authority and single contact point for public information under ZIUDHPUI.	Market surveillance, technical inspection, and provision of industry guidance and sandbox access coordination.
Information Commissioner (Informacijski pooblaščenec)	Market surveillance authority for fundamental rights and privacy/data protection aspects of AI systems.	Data protection enforcement, statutory administrative inspection, and oversight of AI data processing compliance.
Banka Slovenije	Sectoral market surveillance authority for AI systems deployed in the banking sector.	Banking supervision, administrative inspection, and enforcement of sectoral financial regulatory requirements.
Insurance Supervision Agency (Agencija za zavarovalni nadzor / AZN)	Sectoral market surveillance authority for AI systems deployed in the insurance sector.	Insurance market surveillance, administrative inspection, and supervisory enforcement under insurance law.
Market Inspectorate (Tržni inšpektorat)	Market surveillance authority for product safety and technical conformity of AI systems.	Technical conformity inspection, documentation review, and market enforcement actions.
Inspectorate for the Information Society (Inšpektorat RS za informacijsko družbo)	Supervisory body for public sector transparency, AI literacy, and publication duties under ZIUDHPUI and digital strategies.	Administrative inspection of public sector digital compliance and publication obligations.
Public Agency for Medicines and Medical Devices (JAZMP)	Sectoral notifying authority for medical device-related high-risk AI systems.	Evaluation, notification, and conformity assessment oversight for medical AI technologies.