Where we work · Slovakia
ISO and GRC certification consulting in Slovakia
Achieve ISO and GRC certification in Slovakia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Slovakia
Clients include
ISO and GRC certification in Slovakia at a glance
Slovak demand for ISO and GRC certification comes from a manufacturing economy with a strong automotive base, a cyber security law that took its present form on 1 January 2025 and a financial sector supervised by the National Bank of Slovakia. The National Security Authority administers Act No. 69/2018 on cyber security, amended by Act No. 366/2024 to transpose NIS 2, while the Office for Personal Data Protection supervises Act No. 18/2018 beside the GDPR. Large enterprises can meet their energy-efficiency duties with a certified energy or environmental management system, and public buyers refer to certificates issued by accredited bodies. SNAS, the Slovak National Accreditation Service, is the national accreditation body, and ŠÚKL and ŠVPS regulate medicines, devices and food. Sterling's Frankfurt office supports Slovak organisations on site where the work needs it and remotely otherwise, with 8,100+ client engagements in 60+ countries, 20+ years of experience, and Effivity and Sterling Academy included with the engagement. Certification itself comes from accredited certification bodies, never from Sterling.
ISO and GRC standards Sterling delivers in Slovakia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Slovakia (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Slovak Act on personal data protection Úrad na ochranu osobných údajov Slovenskej republiky (the Office for Personal Data Protection of the Slovak Republic) — a state administration body with national jurisdiction that supervises personal data protection and acts independently; its president is elected by the National Council on the Government's proposal | The Office lists the Act, the GDPR and its own Decree No. 158/2018 Coll. on the procedure for data protection impact assessment as the national framework. The Act supplements the Regulation and also covers supervision of processing by competent authorities for criminal-proceedings purposes. The Office's menu lists approved codes of conduct. | |
| Whistleblower protection and corporate criminal liability Úrad na ochranu oznamovateľov (the Whistleblower Protection Office) for whistleblower protection; courts and prosecutors for criminal liability | The whistleblower Act requires employers within its scope to run an internal system for examining reports and says it transposes the EU acts listed in its annex. The criminal liability Act relieves a legal entity of liability where it shows it made every effort that could fairly be required to prevent the offence, in particular through effective control mechanisms. | |
| NBÚ (Národný bezpečnostný úrad, the National Security Authority) — the authority under the Act, which keeps the register of operators of essential services Operators of essential services in the sectors the cyber security Act covers (the Slovak NIS2 implementation) | Zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti (Act No. 69/2018 Coll. on cyber security), amended by Zákon č. 366/2024 Z. z., approved on 28 November 2024, promulgated on 19 December 2024 and in force from 1 January 2025; its Annex 3 lists Directive (EU) 2022/2555 among the EU acts the Act transposes. | ISO/IEC 27001, ISO 22301 |
| NBS (Národná banka Slovenska, the National Bank of Slovakia) — says it has supervised the banking, capital market, insurance and pension fund sectors since 2006 and monitors compliance with binding EU legal acts that apply to supervised entities Financial entities (banks, insurers, investment firms, pension fund managers, payment institutions and others in DORA's scope) | Regulation (EU) 2022/2554 (DORA), applying from 17 January 2025; the amended cyber security Act says it does not apply to the security requirements for networks and information systems of the financial sector under the special regulation, its footnote naming DORA. | |
| ŠÚKL (Štátny ústav pre kontrolu liečiv, the State Institute for Drug Control) — the state administration body for human pharmacy; it carries out state market surveillance of medical devices and keeps a record of medical device manufacturers and a database of devices on the Slovak market Medicines, medical devices and drug precursors | Zákon č. 362/2011 Z. z. o liekoch a zdravotníckych pomôckach (Act No. 362/2011 Coll. on medicines and medical devices) and Regulation (EU) 2017/745 (MDR). | ISO 13485 |
| ŠVPS (Štátna veterinárna a potravinová správa Slovenskej republiky, the State Veterinary and Food Administration) — its own site covers the quality and safety of food of animal and plant origin, official controls, and lists of approved and registered establishments Food business operators and the food chain | Regulation (EC) No 852/2004 on the hygiene of foodstuffs: food business operators maintain permanent procedures based on the HACCP principles. | HACCP, ISO 22000 |
| Ministerstvo hospodárstva Slovenskej republiky (the Ministry of Economy), the ministry the Act names Large enterprises under the energy efficiency Act | Zákon č. 321/2014 Z. z. o energetickej efektívnosti (Act No. 321/2014 Coll. on energy efficiency): a large enterprise has an energy audit carried out periodically, or introduces a certified energy management system (footnote example STN EN ISO 50001) or a certified environmental management system (footnote example STN EN ISO 14001) matching the audit scope; Directive (EU) 2023/1791 Article 11 sets the EU rule on certified energy management systems. | ISO 50001, ISO 14001 |
| Labour inspectorates (inšpektoráty práce), which the Act names for inspection Employers: occupational health and safety | Zákon č. 124/2006 Z. z. o bezpečnosti a ochrane zdravia pri práci (Act No. 124/2006 Coll. on safety and health at work); the consolidated text does not name ISO 45001. |
Accreditation and recognition
- SNAS (Slovenská národná akreditačná služba, the Slovak National Accreditation Service): National accreditation body — SNAS describes itself as a public-law institution set up by Act No. 53/2023 Z. z. on accreditation of conformity assessment bodies, in force from 1 April 2023 and replacing Act No. 505/2009 Z. z., and as the single national accreditation body in Slovakia within the meaning of Regulation (EC) No 765/2008; the Office of Standards, Metrology and Testing monitors compliance with the Act.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under Zákon č. 343/2015 Z. z. o verejnom obstarávaní (Contracting authorities (verejní obstarávatelia) under the Act; the Public Procurement Office (Úrad pre verejné obstarávanie) is the authority the Act names): Each contracting authority sets its own conditions. Where it asks for a quality management system certificate from an independent institution, it refers to quality management according to technical standards certified by an accredited person, and it recognises equivalent certificates from other Member States. For environmental management it may refer to EMAS or another system based on EU acts or international standards, certified by an accredited certification body.
Economic zones
- Industrial parks and zones: industrial and manufacturing sites
- Regional investment aid: manufacturing, significant and strategic investments
- Automotive-led manufacturing base: automotive, components and tooling, engineering
Sterling in Slovakia
Sterling delivers in Slovakia from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Slovakia clients ask
Are certification audits in Slovakia conducted in Slovak or English?
Either is possible, and you settle it with the certification body when you apply. Slovak is the official language, English is commonly used in business, and a single audit may move between the two. Tell the body early which language its auditors will need for your records and controlled documents, and honour any language clause in a customer contract or regulator procedure.
Is the Slovak NIS2 law in force?
Yes, in the form of an amended cyber security Act. Slov-Lex, the official collection, shows Act No. 366/2024 taking effect on 1 January 2025 and changing Act No. 69/2018, whose Annex 3 names Directive (EU) 2022/2555 as a transposed EU act. The National Security Authority administers it. Ask that Authority or your lawyer whether you count as an operator of an essential service.
Which authority supervises the GDPR in Slovakia?
The Office for Personal Data Protection of the Slovak Republic is the supervisory body. It lists Act No. 18/2018 Coll. beside the Regulation as the national framework, together with its own decree on impact assessment, and it says it acts independently. For treatment of a specific processing activity, ask the Office or your counsel.
Which body accredits certification bodies in Slovakia?
SNAS, the Slovak National Accreditation Service, which calls itself the single national accreditation body under Act No. 53/2023 Coll. EA's directory lists it as an MLA signatory with management system certification among its scopes. Recognition is by scope, so confirm that the certification body you choose holds accreditation for your standard and sector.
Can ISO 14001 or ISO 50001 help a large Slovak company with its energy duties?
Yes, for large enterprises. Act No. 321/2014 Coll. lets a large enterprise either have an energy audit carried out periodically or introduce a certified energy management system, with ISO 50001 given as a footnote example, or a certified environmental management system with ISO 14001 as the example, matching the audit scope. Confirm the choice with your energy counsel or the Ministry of Economy.
Does having a compliance system protect a Slovak company from criminal liability?
It can help, but it does not guarantee protection. Act No. 91/2016 Coll. says an offence is not attributed to a legal entity that shows it made every effort that could fairly be required to prevent it, in particular through effective control mechanisms over management and decision-making. Whether a particular system meets that test is for the courts, so take legal advice.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Slovak Act on personal data protection — dataprotection.gov.sk; static.slov-lex.sk; eur-lex.europa.eu (accessed 18 Oct 2026)
- Whistleblower protection and corporate criminal liability — static.slov-lex.sk (accessed 18 Oct 2026)
- Zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti (Act No. 69/2018 Coll. on cyber security), amended by Zákon č. 366/2024 Z. z., approved on 28 November 2024, promulgated on 19 December 2024 and in force from 1 January 2025; its Annex 3 lists Directive (EU) 2022/2555 among the EU acts the Act transposes — static.slov-lex.sk; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), applying from 17 January 2025; the amended cyber security Act says it does not apply to the security requirements for networks and information systems of the financial sector under the special regulation, its footnote naming DORA — nbs.sk; eur-lex.europa.eu; static.slov-lex.sk (accessed 18 Oct 2026)
- Zákon č. 362/2011 Z. z. o liekoch a zdravotníckych pomôckach (Act No. 362/2011 Coll. on medicines and medical devices) and Regulation (EU) 2017/745 (MDR) — sukl.sk; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulation (EC) No 852/2004 on the hygiene of foodstuffs: food business operators maintain permanent procedures based on the HACCP principles — svps.sk; eur-lex.europa.eu (accessed 18 Oct 2026)
- Zákon č. 321/2014 Z. z. o energetickej efektívnosti (Act No. 321/2014 Coll. on energy efficiency): a large enterprise has an energy audit carried out periodically, or introduces a certified energy management system (footnote example STN EN ISO 50001) or a certified environmental management system (footnote example STN EN ISO 14001) matching the audit scope; Directive (EU) 2023/1791 Article 11 sets the EU rule on certified energy management systems — static.slov-lex.sk; eur-lex.europa.eu (accessed 18 Oct 2026)
- Zákon č. 124/2006 Z. z. o bezpečnosti a ochrane zdravia pri práci (Act No. 124/2006 Coll. on safety and health at work); the consolidated text does not name ISO 45001 — static.slov-lex.sk (accessed 18 Oct 2026)
- SNAS (Slovenská národná akreditačná služba, the Slovak National Accreditation Service) — snas.sk; european-accreditation.org (accessed 18 Oct 2026)
- Public procurement under Zákon č. 343/2015 Z. z. o verejnom obstarávaní — static.slov-lex.sk; eur-lex.europa.eu (accessed 18 Oct 2026)
- Industrial parks and zones — priemyselneparkyslovenska.sk (accessed 18 Oct 2026)
- Regional investment aid — static.slov-lex.sk; mhsr.sk (accessed 18 Oct 2026)
- Automotive-led manufacturing base — oecd.org (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice