EU AI Act in Slovenia: Who Enforces It Under the ZIUDHPUI

Slovenia is among the first EU Member States to legislate its EU AI Act enforcement in full. Its national implementing act — the ZIUDHPUI, in force since 21 November 2025 — designates not one authority but five market-surveillance bodies, splitting supervision across communications, data protection, banking, insurance, and market inspection. While many states in the region missed the August 2025 deadline, Slovenia's designation is settled in law.

This guide sets out the Slovenian enforcement architecture, the obligations already binding companies, the firmest anchor (the Information Commissioner), the corrected timeline after the Digital Omnibus, and what Slovenian businesses should do now.

---

A Regulation, Not a Directive — but Slovenia Legislated Early

The EU AI Act, Regulation (EU) 2024/1689, applies directly in Slovenia under Article 288 of the Treaty on the Functioning of the European Union. It entered into force on 1 August 2024, and its early obligations bind Slovenian companies regardless of national law: Article 5 prohibited practices and Article 4 AI literacy since 2 February 2025, and general-purpose AI (GPAI) obligations under Chapter V since 2 August 2025.

A Regulation does not need transposition. What Slovenia did — and did early — was designate authorities and create domestic procedures through the ZIUDHPUI: the Zakon o izvajanju Uredbe (EU) o določitvi harmoniziranih pravil o umetni inteligenci (Act on the Implementation of Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence). It was published in the Official Gazette (Uradni list RS) No. 85/25 on 6 November 2025, adopted by the National Assembly on 11 November 2025, and entered into force on 21 November 2025. The load-bearing identifiers are the Slovenian title, the abbreviation ZIUDHPUI, and the gazette reference Uradni list RS 85/25.

---

Who Enforces the EU AI Act in Slovenia?

Five Market-Surveillance Authorities

Rather than name a single supervisor, the ZIUDHPUI designates five market-surveillance authorities, each operating in its own domain:

• AKOS — the Agency for Communication Networks and Services, also designated as Slovenia's single point of contact for the EU AI Office and central coordinating authority (and the AI regulatory-sandbox authority).
• The Information Commissioner (Informacijski pooblaščenec) — also Slovenia's data protection authority.
• Banka Slovenije — the Bank of Slovenia, for financial-sector AI.
• The Insurance Supervision Agency (Agencija za zavarovalni nadzor).
• The Market Inspectorate (Tržni inšpektorat, TIRS).

This sector-split model means the relevant supervisor for a given AI system depends on what the system does. A company should identify which of the five covers its use case rather than assume a single national regulator.

The Information Commissioner's Specific AI Remit

The Information Commissioner carries a defined slice of the high-risk and prohibited workload. Under the ZIUDHPUI it supervises prohibited AI systems plus high-risk Annex III systems in the points where fundamental rights are most exposed: point 1 (biometrics), point 3 (education), point 6 (law enforcement), point 7 (migration, asylum, and border control), and point 8 (administration of justice and democratic processes). For a Slovenian deployer in any of those areas, the Information Commissioner is the AI Act supervisor — as well as the GDPR supervisor.

Notifying Authorities, Split by Sector

The ZIUDHPUI also splits the notifying-authority role — the function of designating and overseeing notified bodies. For product-embedded (Annex I) AI, that falls to the ministries for the internal market, infrastructure, and health, by sector. For high-risk biometric systems (Annex III point 1), the notifying authority is the Ministry for Digital Transformation (Ministrstvo za digitalno preobrazbo). Oversight of conformity-assessment bodies sits with the Slovenian Accreditation service.

A Useful Slovenia-Specific Point on Biometrics

Slovenia chose not to legislate the optional law-enforcement exception for real-time remote biometric identification in public spaces. The practical effect: real-time remote biometric identification in public spaces is prohibited in Slovenia, with no national carve-out. For any company contemplating such a system, that door is closed in Slovenia.

The AI Office (Brussels): GPAI Stays at EU Level

General-purpose AI model providers are supervised by the EU AI Office in Brussels under Articles 53 and 55, with fines imposed by the Commission under Article 101 — not by any Slovenian authority. A Slovenian company that merely uses a general-purpose model is a deployer of the system it builds, not a GPAI provider answerable to the AI Office for the model. (As context, Slovenia hosts the UNESCO-affiliated International Research Centre on Artificial Intelligence, IRCAI, in Ljubljana — a research centre, not a regulator.)

---

The Slovenian Enforcement Timeline (After the Digital Omnibus)

The high-risk dates carried a caveat that is now resolved. Under the Digital Omnibus, the European Parliament adopted the deferral in its plenary vote on 16 June 2026 and the Council adopted it on 29 June 2026, deferring stand-alone high-risk Annex III systems to 2 December 2027 and product-embedded high-risk AI to 2 August 2028. The package enters into force on publication in the Official Journal, expected before 2 August 2026 — a formality, since the dates themselves are settled. Plan against 2 December 2027 for stand-alone high-risk Annex III. The deferral is fixed calendar dates — not contingent on harmonised standards.

---

Penalties: What Slovenian Companies Actually Face

The penalty framework is Article 99 of the Regulation, applied in Slovenia through the ZIUDHPUI and the five designated authorities. The ceilings are EU-wide; Slovenian law supplies the procedure. Three tiers, each "whichever is higher" of a fixed sum or a percentage of total worldwide annual turnover:

• €35,000,000 or 7% — for breaching the Article 5 prohibitions.
• €15,000,000 or 3% — for most other breaches: high-risk requirements (Articles 9–15), provider duties (Article 16), deployer duties (Article 26), and Article 50 transparency.
• €7,500,000 or 1% — for supplying incorrect, incomplete, or misleading information to a notified body or authority.

The third tier is 1%, not 1.5% — there is no 1.5% tier in the Regulation, and no Slovenia-specific fine amounts. For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed amount or the percentage. A Slovenian company with €4 million turnover does not face a €15 million fine for a high-risk breach — 3% of €4 million is €120,000, and that is the ceiling.

GPAI-specific fines are separate: up to €15 million or 3%, imposed by the Commission under Article 101 on the model provider, not by any Slovenian authority.

---

Worked Example: A Ljubljana Biometric-Access Company

Consider Vstop d.o.o., a fictional Ljubljana firm — about 25 employees, roughly €3 million annual turnover — that sells an AI facial-verification system for secure building access to Slovenian employers.

Biometric systems are an Annex III high-risk use case (point 1). Because Vstop builds the system and places it on the market under its own name, it is a provider under Article 16: Article 9 risk management, Annex IV technical documentation, an Article 43 conformity assessment, Article 14 human oversight, and Article 49 registration. Annex III point 1 systems route through the more demanding notified-body conformity path.

Slovenia's setup gives Vstop a clear map. Its AI Act supervisor for biometrics is the Information Commissioner, and the notifying authority for biometric systems is the Ministry for Digital Transformation. Because the system processes biometric personal data, the Information Commissioner also supervises it under the GDPR, and a GDPR Article 35 Data Protection Impact Assessment is required. One caution: Vstop must keep its product to verification and access control — real-time remote biometric identification in public spaces is prohibited in Slovenia, with no national exception. The sensible path: build the documentation now against the 2 December 2027 high-risk date, engage the notified-body route early, and keep the AI Act and GDPR assessments aligned. On €3 million turnover, its worst-case high-risk exposure is 3% — about €90,000.

---

How Confir Helps Slovenian Companies

A Slovenian compliance team has a documentation-heavy obligation set: an AI inventory, Article 6 classification with the Annex III logic, role assignment, Article 9 risk records, the Annex IV technical file, the Article 27 fundamental-rights impact assessment where it applies, and Article 72 post-market monitoring.

Confir is EU-hosted compliance software built for this work. Its classification engine is rule-based and deterministic — it encodes Articles 5 and 6 with Annex III logic as explicit rules, so the same intake always yields the same finding with a human-readable explanation of which rule fired. It generates the Annex IV technical-documentation pack and the Article 47 / Annex V Declaration of Conformity, and runs the Article 27 assessment. The structured review spans four areas: risk classification, data and technical robustness, transparency and human oversight, and governance and post-market monitoring.

---

What Slovenian Companies Should Do Now

Immediately: Audit for any Article 5 prohibited practice — enforceable since February 2025. Remember that Slovenia legislated no national exception for real-time remote biometric identification in public spaces, so that practice is closed. If a system fits a prohibited category, stop or restructure it.

Before 2 August 2026: Bring chatbots, voice assistants, and AI content tools into line with Article 50 transparency — users must be told when they are interacting with AI or with synthetic content.

Through 2026–2027: Build the AI inventory, classify systems under Article 6 with the Article 6(3) filter, assign provider or deployer roles, and begin high-risk documentation, planning against 2 December 2027. Identify which of the five market-surveillance authorities covers your use case.

Ongoing: Watch the Information Commissioner's guidance — given its remit over prohibited and fundamental-rights-sensitive AI, it is likely to be among the most active. For financial or insurance AI, track the Bank of Slovenia and Insurance Supervision Agency respectively.

---

Related guides

• Who enforces the EU AI Act
• EU AI Act fundamentals
• EU AI Act penalties explained
• Provider vs deployer obligations
• Article 27 fundamental rights impact assessment
• Compliance guide for small businesses
• The EU AI Act in Austria