Where we work · Slovenia
ISO and GRC certification consulting in Slovenia
Achieve ISO and GRC certification in Slovenia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Slovenia
Clients include
ISO and GRC certification in Slovenia at a glance
Slovenian demand for ISO and GRC certification comes from an export-oriented industrial base, a regulated financial sector and a recently adopted cyber security law. The Information Security Act, ZInfV-1, published in the Official Gazette No. 40/25 and in force from 19 June 2025, transposes NIS2 under the Government Office for Information Security and asks essential and important entities for a documented information security and business continuity system. The Information Commissioner supervises the GDPR alongside ZVOP-2, JAZMP oversees medical devices, and the food administration enforces HACCP-based procedures under Regulation (EC) No 852/2004. Banks work under DORA rather than the national Act's measures. Certificates come from certification bodies accredited by SA, the national accreditation body, never from Sterling. Demand is strongest in automotive supply, electrical and machinery industries, pharmaceuticals and medical devices, ICT and food production. Sterling serves Slovenian clients from its Frankfurt office, with 8,100+ client engagements in 60+ countries, 20+ years of experience, and Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Slovenia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Slovenia (9)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2) Informacijski pooblaščenec (the Information Commissioner of the Republic of Slovenia) — its site lists inspection supervision of the rules on processing and protection of personal data and of transfers out of Slovenia, appeals against refused access requests, and misdemeanour powers among its competences | The Commissioner explains that the GDPR sets uniform rules but leaves some substantive and procedural questions to Member States, and that in Slovenia these are regulated by ZVOP-2. Its site lists help with unlawful processing, with refused data-subject requests, with data breaches, and in cases that need prior approval such as biometrics, data transfers or data linking. It notes that no English translation of ZVOP-2 is available. | |
| Reporting Persons Protection Act (ZZPri) Komisija za preprečevanje korupcije (KPK, the Commission for the Prevention of Corruption) | The Commission analyses compliance with the obligations that arise from ZZPri, including the establishment of internal reporting channels and the submission of annual statistical data, and runs electronic forms for reporting that data. Internal reporting channels hold personal data, so they sit beside GDPR work. | |
| Urad Vlade Republike Slovenije za informacijsko varnost (URSIV, the Government Office for Information Security), the competent national authority; its Information Security Inspection is the supervisory unit; the Office's FAQ names SIGOV-CERT (within the Office) and SI-CERT (at the Academic and Research Network of Slovenia, ARNES) as the CSIRTs under the transitional provision Essential and important entities in the sectors listed in the Information Security Act (the Slovenian NIS2 implementation), including public administration, digital infrastructure, ICT service management, manufacturing and digital providers | Zakon o informacijski varnosti (ZInfV-1, the Information Security Act), published in Uradni list Republike Slovenije No. 40/25 on 4 June 2025; the government notice says it takes effect on 19 June 2025 and transposes Directive (EU) 2022/2555 (NIS 2). Its listed novelties are a wider circle of obliged entities, self-registration, further risk-management measures, conformity assessment and self-assessment, regular training of responsible persons, coordinated vulnerability disclosure and trust in ICT products. The Office's FAQ says essential and important entities establish and maintain a documented information security management system and a business continuity management system based on an all-hazards approach, that significant incidents go to the competent CSIRT, and that the Office's inspection supervises obliged entities. | ISO/IEC 27001, ISO 22301 |
| Banka Slovenije (the Bank of Slovenia), the banking supervisor within the Single Supervisory Mechanism Banks and financial market infrastructure | Regulation (EU) 2022/2554 (DORA). The Office's FAQ on the Information Security Act says the Act's chapters on risk-management measures and on supervision do not apply to essential and important entities in banking and financial market infrastructure, and that Banka Slovenije is not an obliged entity under it. Banka Slovenije's own page sets out its supervisory objectives. Neither source names ISO/IEC 27001. | |
| JAZMP (Javna agencija Republike Slovenije za zdravila in medicinske pripomočke, the Agency for Medicinal Products and Medical Devices of the Republic of Slovenia) Manufacturers, importers and distributors of medical devices | Regulation (EU) 2017/745 on medical devices. JAZMP's medical devices section covers registers, economic operators and their registration, registration of devices, vigilance, clinical investigations and a notified body section. Its pages do not name ISO 13485 as a legal requirement. | |
| The Administration of the Republic of Slovenia for Food Safety, Veterinary Sector and Plant Protection (UVHVVR), within the Ministry of Agriculture Food and feed businesses | Regulation (EC) No 852/2004 requires food business operators to put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles. The Administration states that it is responsible for the safety, quality and labelling of foodstuffs and feed, carries out official controls through food inspectors, official veterinarians and phytosanitary inspectors, and covers materials in contact with food. Neither source makes a third-party certificate compulsory. | HACCP |
| EU framework; national implementing arrangements are for the competent Slovenian authorities to confirm Large energy users | Directive (EU) 2023/1791 on energy efficiency requires Member States to ensure that enterprises above a stated average annual energy consumption implement an energy management system certified by an independent body in accordance with the relevant European or international standards, and that enterprises above a lower threshold which have no such system are subject to energy audits. It is a directive; the national measures decide who is caught. | ISO 50001 |
| Komisija za preprečevanje korupcije (KPK, the Commission for the Prevention of Corruption) Public bodies and organisations managing corruption and integrity risk | The Commission's Integrity Plan guidance describes the plan as a tool for managing corruption and integrity risks and says certain public-sector organisations must manage those risks with the aid of Integrity Plans; once the head signs the measures into force they become mandatory guidelines for staff. The Commission also oversees ZZPri reporting obligations. The pages do not name ISO 37001 or ISO 37301. | |
| EU framework; the national supervisory arrangements are for the competent Slovenian authorities to confirm Providers and deployers of AI systems | Regulation (EU) 2024/1689 (Artificial Intelligence Act), which lays down harmonised rules on artificial intelligence. It is a regulation, not a certification scheme, and it does not name ISO/IEC 42001. |
Accreditation and recognition
- SA (Slovenska akreditacija, listed by EA as Slovenian Accreditation): National accreditation body for Slovenia, as the EA directory lists it.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Public Procurement Act (Zakon o javnem naročanju) and Directive 2014/24/EU (Contracting authorities (naročniki): state bodies, local self-governing communities and other bodies governed by public law, plus public utilities in infrastructure sectors): Each contracting authority sets its own conditions. The government's procurement page names the Act and its e-JN information system, and lists strategic and green public procurement among its themes. Directive 2014/24/EU says that where authorities require certificates from independent bodies on quality assurance standards they refer to quality assurance systems based on the relevant European standards certified by accredited bodies, and that for environmental management they refer to EMAS or other recognised systems or standards certified by accredited bodies, while recognising equivalent certificates from other Member States.
Economic zones
- Slovenian automotive supplier base: automotive, components, mobility
- Life sciences, pharmaceuticals and medical technology: pharmaceuticals, medical devices, biotechnology
- Electrical, electronics, metal processing and machinery industries: electrical and electronics, metal processing, machinery, ICT
- Woodworking, food and beverages and tourism: woodworking and furniture, food and beverages, tourism
Sterling in Slovenia
Sterling delivers in Slovenia from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Slovenia clients ask
Are certification audits in Slovenia held in Slovenian or English?
Either can work, and the audit language is agreed with the certification body when you apply. Slovenian is the official language and English is widely used in business, so many audits mix the two. Say early which language your records and controlled documents are in, and follow any language rule written into a customer contract or set by a regulator.
Is Slovenia's NIS2 law in force?
Yes. Per the government notice on ZInfV-1, the Information Security Act appeared in the Official Gazette No. 40/25 on 4 June 2025, with effect from 19 June 2025, and brings Directive (EU) 2022/2555 into Slovenian law. The Government Office for Information Security is the competent authority. Whether your organisation is covered is for the Office or your counsel to confirm.
Who supervises the GDPR in Slovenia?
The Information Commissioner, Informacijski pooblaščenec. Its site says the GDPR is supplemented in Slovenia by the Personal Data Protection Act, ZVOP-2, Official Gazette No. 163/22, and lists inspection supervision, appeals on refused access requests and help with breaches among its tasks. It adds that no English translation of ZVOP-2 exists, so read the Slovenian text with counsel.
Which body accredits certification bodies in Slovenia?
SA, Slovenska akreditacija. EA's directory lists it as an EA MLA signatory with management system certification, product certification, inspection, testing and calibration among its scopes. Accreditation is by scope, so before you apply, check that the certification body's SA scope covers your standard and sector. The national standards body, SIST, writes standards and does not accredit.
Do banks fall under the Slovenian NIS2 law?
Largely not. The Government Office's FAQ says the Act's risk-management and supervision chapters do not apply to essential and important entities in banking and financial market infrastructure, and that Banka Slovenije is not an obliged entity. Those firms work under DORA instead. Where a group has non-bank entities, each entity needs its own check with counsel.
Can Slovenian public buyers ask for ISO certificates?
Yes, tender by tender. Contracting authorities set their own conditions, and Directive 2014/24/EU says that when they require quality assurance certificates they refer to systems certified by accredited bodies, with EMAS or equivalent certified systems for environmental management. Nothing makes a certificate a standing requirement, so read each notice carefully, and take legal advice on a specific contract.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2) — ip-rs.si; eur-lex.europa.eu (accessed 18 Oct 2026)
- Reporting Persons Protection Act (ZZPri) — kpk-rs.si (accessed 18 Oct 2026)
- Zakon o informacijski varnosti (ZInfV-1, the Information Security Act), published in Uradni list Republike Slovenije No. 40/25 on 4 June 2025; the government notice says it takes effect on 19 June 2025 and transposes Directive (EU) 2022/2555 (NIS 2). Its listed novelties are a wider circle of obliged entities, self-registration, further risk-management measures, conformity assessment and self-assessment, regular training of responsible persons, coordinated vulnerability disclosure and trust in ICT products. The Office's FAQ says essential and important entities establish and maintain a documented information security management system and a business continuity management system based on an all-hazards approach, that significant incidents go to the competent CSIRT, and that the Office's inspection supervises obliged entities. — gov.si (accessed 18 Oct 2026)
- Regulation (EU) 2022/2554 (DORA). The Office's FAQ on the Information Security Act says the Act's chapters on risk-management measures and on supervision do not apply to essential and important entities in banking and financial market infrastructure, and that Banka Slovenije is not an obliged entity under it. Banka Slovenije's own page sets out its supervisory objectives. Neither source names ISO/IEC 27001. — bsi.si; gov.si; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulation (EU) 2017/745 on medical devices. JAZMP's medical devices section covers registers, economic operators and their registration, registration of devices, vigilance, clinical investigations and a notified body section. Its pages do not name ISO 13485 as a legal requirement. — jazmp.si; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulation (EC) No 852/2004 requires food business operators to put in place, implement and maintain a permanent procedure or procedures based on the HACCP principles. The Administration states that it is responsible for the safety, quality and labelling of foodstuffs and feed, carries out official controls through food inspectors, official veterinarians and phytosanitary inspectors, and covers materials in contact with food. Neither source makes a third-party certificate compulsory. — gov.si; eur-lex.europa.eu (accessed 18 Oct 2026)
- Directive (EU) 2023/1791 on energy efficiency requires Member States to ensure that enterprises above a stated average annual energy consumption implement an energy management system certified by an independent body in accordance with the relevant European or international standards, and that enterprises above a lower threshold which have no such system are subject to energy audits. It is a directive; the national measures decide who is caught. — eur-lex.europa.eu (accessed 18 Oct 2026)
- The Commission's Integrity Plan guidance describes the plan as a tool for managing corruption and integrity risks and says certain public-sector organisations must manage those risks with the aid of Integrity Plans; once the head signs the measures into force they become mandatory guidelines for staff. The Commission also oversees ZZPri reporting obligations. The pages do not name ISO 37001 or ISO 37301. — kpk-rs.si (accessed 18 Oct 2026)
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), which lays down harmonised rules on artificial intelligence. It is a regulation, not a certification scheme, and it does not name ISO/IEC 42001. — eur-lex.europa.eu (accessed 18 Oct 2026)
- SA (Slovenska akreditacija, listed by EA as Slovenian Accreditation) — european-accreditation.org; sist.si (accessed 18 Oct 2026)
- Public procurement under the Public Procurement Act (Zakon o javnem naročanju) and Directive 2014/24/EU — gov.si; eur-lex.europa.eu (accessed 18 Oct 2026)
- Slovenian automotive supplier base — sloveniabusiness.eu (accessed 18 Oct 2026)
- Life sciences, pharmaceuticals and medical technology — sloveniabusiness.eu (accessed 18 Oct 2026)
- Electrical, electronics, metal processing and machinery industries — sloveniabusiness.eu (accessed 18 Oct 2026)
- Woodworking, food and beverages and tourism — sloveniabusiness.eu (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice