EU AI Act in Slovakia: Who Enforces It, and What Slovak Companies Must Do

If you want to know which Slovak authority will inspect your AI system, the honest mid-2026 answer is: it is not yet finally designated. Slovakia missed the EU's 2 August 2025 deadline to name its market-surveillance authority, the body expected to lead — the Ministry of Investments, Regional Development and Informatization (MIRRI) — is earmarked only in a draft bill that has not been adopted, and the European Commission's list of national contact points still shows Slovakia blank. What is certain is the obligation set itself, because the EU AI Act, Regulation (EU) 2024/1689, applies directly in Slovakia regardless.

This guide separates what binds Slovak companies now from what Slovakia still has to put in place, states clearly what is verified versus undecided, and gives the corrected timeline after the Digital Omnibus.

---

A Regulation, Not a Directive: Slovakia Does Not "Transpose" It

The EU AI Act is a Regulation. It entered into force on 1 August 2024 and, under Article 288 of the Treaty on the Functioning of the European Union, applies directly in Slovakia without being rewritten into Slovak law. Slovak companies do not wait for a national statute before obligations bite.

The early obligations are already live:

• Article 5 prohibited practices have applied since 2 February 2025.
• Article 4 AI literacy has applied since the same date.
• General-purpose AI (GPAI) obligations under Chapter V have applied since 2 August 2025.

What Slovakia still has to provide is the national scaffolding: a designated market-surveillance authority, domestic penalty procedures, and the inspection machinery. That is where Slovakia is behind.

---

Who Enforces the EU AI Act in Slovakia?

The Article 70 Authority Is Not Yet Finally Designated

Article 70 required each Member State to designate, by 2 August 2025, a national competent authority — a market-surveillance authority, a notifying authority, and a single point of contact for the EU AI Office. Slovakia did not meet that deadline. The European Commission's own list of national single points of contact, last updated in late 2025, shows no Slovak designation — Slovakia is not even marked as "pending final adoption", unlike several other states.

The body widely expected to take the lead is MIRRI — the Ministerstvo investícií, regionálneho rozvoja a informatizácie SR (Ministry of Investments, Regional Development and Informatization). MIRRI is Slovakia's lead digital and AI policy coordinator, and a 2025 draft implementing bill would make it the general national market-surveillance authority for AI. But that bill has not been adopted, and as of late 2025 there was no Slovak "AI Act" in the official Collection of Laws. The precise position: MIRRI is expected to / has been earmarked as the lead AI market-surveillance authority, but the full Article 70 designation is still being finalised. Do not state that MIRRI "is" the designated authority — it is not yet, in law.

What Slovakia Has Enacted

Slovakia has not been entirely idle. Act No. 318/2025 Coll., effective from 1 January 2026, amends Slovakia's existing market-surveillance and product-conformity law (Act No. 56/2018 Coll.) to reference and enable enforcement of certain EU AI Act obligations and penalties. This is a real, in-force amendment — but it is not a free-standing national AI Act, and it does not by itself settle the Article 70 designation.

In the meantime, several Slovak bodies carry market-surveillance roles under pre-existing mandates, and these are the authorities most likely to act in practice until the AI-specific designation is finalised:

• The Slovak Trade Inspection (Slovenská obchodná inšpekcia) — the lead market-surveillance authority for consumer products and services.
• The National Security Authority (Národný bezpečnostný úrad) — the national cybersecurity authority, which from 1 January 2026 also handles market surveillance for products with digital elements under the Cyber Resilience Act.
• The National Bank of Slovakia — the financial-sector supervisor.

The Firmest Anchor: ÚOOÚ, the Data Protection Authority

The most settled institution in Slovakia's picture is its data protection authority — the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky, ÚOOÚ). It is the independent supervisor for personal-data processing — including automated decision-making and profiling — under the GDPR and Slovakia's national Act No. 18/2018 Coll. For any AI system that processes personal data, which covers most Annex III high-risk use cases, ÚOOÚ is the authority a Slovak company is most certain to encounter, through the GDPR if not yet through the AI Act.

The AI Office (Brussels): GPAI Stays at EU Level

General-purpose AI model providers are supervised not by any Slovak authority but by the EU AI Office in Brussels under Articles 53 and 55, with fines imposed by the Commission under Article 101. A Slovak company that merely uses a general-purpose model is a deployer of the system it builds, not a GPAI provider answerable to the AI Office for the model itself.

---

The Slovak Enforcement Timeline (After the Digital Omnibus)

The high-risk dates carried a caveat that is now resolved. Under the Digital Omnibus, the European Parliament adopted the deferral in its plenary vote on 16 June 2026 and the Council adopted it on 29 June 2026, deferring stand-alone high-risk Annex III systems to 2 December 2027 and product-embedded high-risk AI to 2 August 2028. The package enters into force on publication in the Official Journal, expected before 2 August 2026 — a formality, since the dates themselves are settled. Plan against 2 December 2027 for stand-alone high-risk Annex III. The deferral is fixed calendar dates — not contingent on harmonised standards.

---

Penalties: What Slovak Companies Actually Face

The penalty framework is Article 99 of the Regulation. Slovakia's pending designation affects who imposes fines and how, not the ceilings — those are EU-wide. Three tiers, each "whichever is higher" of a fixed sum or a percentage of total worldwide annual turnover:

• €35,000,000 or 7% — for breaching the Article 5 prohibitions.
• €15,000,000 or 3% — for most other breaches: high-risk requirements (Articles 9–15), provider duties (Article 16), deployer duties (Article 26), and Article 50 transparency.
• €7,500,000 or 1% — for supplying incorrect, incomplete, or misleading information to a notified body or authority.

The third tier is 1%, not 1.5% — there is no 1.5% tier in the Regulation, and no Slovakia-specific fine amounts. For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed amount or the percentage. A Slovak company with €6 million turnover does not face a €15 million fine for a high-risk breach — 3% of €6 million is €180,000, and that is the ceiling.

GPAI-specific fines are separate: up to €15 million or 3%, imposed by the Commission under Article 101 on the model provider, not by any Slovak authority.

---

Worked Example: A Košice Manufacturing-AI Company

Consider Výroba s.r.o., a fictional Košice industrial-software firm — about 70 employees, roughly €11 million annual turnover — that builds an AI system controlling a safety function on factory machinery it supplies to manufacturers.

This is the product-embedded route. Where AI is a safety component of machinery covered by the Machinery Regulation (EU) 2023/1230, it falls into the Annex I / high-risk category — and it faces the longer 2 August 2028 deadline and the most demanding conformity pathway under Article 43: third-party assessment by a notified body, not self-assessment. Because Výroba builds the system and places it on the market under its own name, it is a provider under Article 16.

Who supervises it? Until Slovakia finalises its Article 70 designation, the firm cannot point to a confirmed AI market-surveillance authority — but as a product-safety matter it already sits within the orbit of the Slovak Trade Inspection and the sectoral product rules, and Act No. 318/2025 Coll. has begun wiring AI obligations into that existing market-surveillance framework. The sensible move: identify a notified body early — capacity is a known constraint — build the Article 9, Annex IV, and Article 43 documentation now, and track MIRRI's implementing bill to confirm the eventual authority. On €11 million turnover, its worst-case high-risk exposure is 3% — about €330,000.

---

How Confir Helps Slovak Companies

A Slovak compliance team facing a pending designation still has a fixed obligation set to document: an AI inventory, Article 6 classification with the Annex III logic, role assignment, Article 9 risk records, the Annex IV technical file, the Article 27 fundamental-rights impact assessment where it applies, and Article 72 post-market monitoring.

Confir is EU-hosted compliance software built for this work. Its classification engine is rule-based and deterministic — it encodes Articles 5 and 6 with Annex III logic as explicit rules, so the same intake always yields the same finding with a human-readable explanation of which rule fired. It generates the Annex IV technical-documentation pack and the Article 47 / Annex V Declaration of Conformity, and runs the Article 27 assessment. The structured review spans four areas: risk classification, data and technical robustness, transparency and human oversight, and governance and post-market monitoring.

---

What Slovak Companies Should Do Now

Immediately: Audit for any Article 5 prohibited practice — enforceable since February 2025, regardless of Slovakia's pending designation. If a system fits a prohibited category and no exemption applies, stop or restructure it.

Before 2 August 2026: Bring chatbots, voice assistants, and AI content tools into line with Article 50 transparency — users must be told when they are interacting with AI or with synthetic content.

Through 2026–2027: Build the AI inventory, classify systems under Article 6 with the Article 6(3) filter, assign provider or deployer roles, and begin high-risk documentation, planning against 2 August 2026 until the Omnibus deferral becomes law. For machinery-embedded AI, identify a notified body early.

Ongoing: Track MIRRI's implementing bill and the eventual Article 70 designation — that is what will confirm which authority inspects your AI. Until then, treat ÚOOÚ and the GDPR, and the Slovak Trade Inspection's existing product-safety role, as the firmest fixed points.

---

Related guides

• Who enforces the EU AI Act
• EU AI Act fundamentals
• EU AI Act penalties explained
• Provider vs deployer obligations
• Compliance guide for small businesses
• The EU AI Act in the Czech Republic
• The EU AI Act in Austria