Current position
Overview
AI legislation has been enacted.
Key legislation & sources
EU AI Act (Regulation 2024/1689)
AKOS (Agency for Communication Networks and Services) — proposed single point of contact
EU AI Act National Implementation Tracker
Council of Europe Framework Convention on AI (CETS 225)
EU AI ACT
The EU AI Act (Regulation 2024/1689) applies directly across all member states. Prohibitions on unacceptable-risk AI systems have been in force since 2 February 2025; GPAI model rules since 2 August 2025. High-risk AI obligations are due from 2 August 2026, subject to the Digital Omnibus proposal which may defer enforcement. For the full implementation timeline, governance structure, and current status, see the European Union overview.
The Agency for Communication Networks and Services (AKOS) has been proposed as market surveillance authority. MSA and notifying authority designation procedures are ongoing.
Regulatory developments
Latest updates
Latest event import:
Updates sourced from Digital Policy Alert ↗. The latest available entries for this jurisdiction.
adoption
Act implementing Regulation (EU) 2024/1689 of European Parliament on laying down harmonised rules on artificial intelligence was adopted by Parliament
Source: Digital Policy Alert · View update ↗
On 21 August 2025, the Government of the Republic of Slovenia adopted the Draft Act on the Implementation of Regulation (EU) 2024/1689 of the European Parliament on laying down harmonised rules on artificial intelligence (AI). The Act applies to providers, deployers and other operators of high-risk AI systems. The Act designates ministries and agencies as notifying authorities, and tasks the Agency for Communications Networks and Services with maintaining a public register of high-risk AI systems. The Act introduces fines ranging from EUR 25,000 to EUR 450,000, with severe breaches reaching up to EUR 7,500,000. It will enter into force 15 days after publication in the Official Gazette of Slovenia.
outline
Information Commissioner issued opinion on validity of child consent for personal data processing in online prize draws (No. 07121-1/2025/922)
Source: Digital Policy Alert · View update ↗
On 24 July 2025, the Slovenian Information Commissioner adopted an opinion clarifying that children under 15 cannot validly consent to the processing of personal data for online prize draws without parental approval. However, it was highlighted that children aged 15 and above may consent independently if the activity does not significantly impact their lives. The opinion applies to organisers of direct marketing and promotional prize games involving children’s data and highlights that consent under the General Data Protection Act and Slovenia’s Personal Data Protection Act must be informed, freely given, and clearly communicated in child-friendly language.
outline
Information Commissioner adopted opinion on the obligation to keep records of processing activities (No. 07121-1/2025/912)
Source: Digital Policy Alert · View update ↗
On 23 July 2025, the Slovenian Information Commissioner issued an opinion on the records of processing activities under the General Data Protection Regulation and Slovenia's personal data protection Act. It was highlighted that companies and organisations with fewer than 250 employees are generally exempt. It was however, emphasised that the companies must still keep records if the processing poses risks to individuals’ rights and freedoms, is not occasional, or involves special categories of personal data or data on criminal convictions and offences. Records must be written or electronic and include the elements in Article 30 of the General Data Protection Regulation. The opinion also highlighted that the duty to assess compliance lies with the controller or processor.
outline
Information Commissioner adopted opinion on exercising the right to access personal data through an authorised representative, including obligations of the operator (No. 07120-1/2025/328)
Source: Digital Policy Alert · View update ↗
On 23 July 2025, the Information Commissioner of Slovenia issued an opinion on access to personal data by proxy. It was highlighted that individuals may exercise this right directly, through a legal representative, or through an authorised representative. It was also specified that the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2) do not regulate proxy requests in detail, so the General Administrative Procedure Act (ZUP) applies. Under the General Administrative Procedure Act, authorisations may be written or oral, and controllers must verify their validity. If authenticity is doubtful, a certified authorisation may be required. It was also highlighted that the responsibility lies with controllers, while the Information Commissioner may only act in supervisory proceedings.
outline
Information Commissioner adopted opinion on the transmission of personal data within the Internal Market Information System (No. 07120-1/2025/326)
Source: Digital Policy Alert · View update ↗
On 22 July 2025, the Slovenian Information Commissioner adopted an opinion on the transmission of personal data within the Internal Market Information System (IMI) to competent authorities in EU Member States. It was highlighted that any such transfer must be based on an appropriate legal basis provided in EU legislation, including the IMI Regulation, or in national law, and carried out in accordance with sector-specific procedural rules. The opinion reiterated that IMI participants may process personal data only for the purposes set out in the Union acts listed in the Regulation’s Annex, must ensure confidentiality, and must respect the original purpose for which the data was provided. The Commissioner emphasised that it cannot determine the legality of a transfer in a specific case, as this responsibility rests solely with the personal data controller.
Showing 5 of 6 available API entries. Dates and summaries are supplied by Digital Policy Alert.