Skip to content

EU country · Central Europe

Slovenia:
What your customers there expect

Slovenia is a small country with a big port. Soybean meal from Brazil comes in through Koper, and the Slovenian NIS2 law gives local companies a deadline that runs out in December 2026.

Official languageSlovene; Italian and Hungarian in some areas
SeaportKoper (1.1 million TEU in 2024, Eurostat)
NIS2ZInfV-1, in force since Jun 19, 2025; measures due by Dec 19, 2026
Data protection authorityInformacijski pooblaščenec (Information Commissioner)
VAT22% standard rate (9.5% and 5% reduced)

Slovenia as a market for South America

According to Eurostat, Slovenia imported goods worth about €570 million from Argentina, Bolivia, Brazil, Chile, Ecuador, Colombia, Paraguay, Peru and Uruguay in 2025. Almost all of it came from Brazil (€466 million). Exports to the region came to about €140 million, more than half of that going to Brazil.

Soybean meal from Brazil makes up more than half of the imports (€311 million). Next come coffee from Brazil and Colombia, bananas from Ecuador and Colombia, and pulp from Brazil, Chile and Uruguay. Soy, coffee and pulp fall under the EUDR, so your Slovenian buyer needs the geolocation data for the plots where they were grown.

The port of Koper on the Adriatic handled about 1.1 million TEU in 2024 (Eurostat). That is why the import figures also depend on where goods are released into free circulation for customs purposes. Not every cargo cleared in Koper stays in Slovenia.

What applies EU-wide and what is Slovenian

Customs, rules of origin, product law and food law are EU law; the basics are in the guide to exporting to the EU. Matters regulated nationally include:

  • Language: The Consumer Protection Act ZVPot-1 (Uradni list RS, No. 130/2022) requires consumer information to be in a language understood in Slovenia. Instructions for use for goods sold in Slovenia must be fully in Slovene (Art. 10). In the municipalities of the Italian and Hungarian communities, Italian and Hungarian are also official languages, but for nationwide sales Slovene remains the benchmark.
  • Packaging: The EU Packaging Regulation (EU) 2025/40 has applied since August 12, 2026. The producer obligations usually fall on the importer.
  • VAT: 22% standard rate, with reduced rates of 9.5% and 5%.

NIS2 in Slovenia

Slovenia transposed the NIS2 Directive with its Information Security Act (Zakon o informacijski varnosti, ZInfV-1, Uradni list RS, No. 40/2025), in force since June 19, 2025. The competent authority is the Government Information Security Office (URSIV). Companies report incidents to SI-CERT, public bodies to SIGOV-CERT. A digital reporting platform was planned for June 2026; according to URSIV guidance from June 2026, reports are still sent by email.

The self-registration deadline ended on December 19, 2025. Most entities must have the security measures under Art. 21 and 22 in place by December 19, 2026. The law lists 17 minimum measures, supply chain security among them, and requires logs with defined minimum content and synchronized time, kept for at least six months. Reporting deadlines: early warning after 24 hours, notification after 72 hours, final report one month later.

After that come regular reviews. Essential entities have their implementation assessed at least every two years by an auditor or internal audit. Important entities assess themselves at the same interval and submit a declaration. Since October 2025, a separate government decree (Uradni list RS, No. 78/2025) has covered training for the people responsible.

In August 2026, URSIV published recommendations on managing supply chain risk. Slovenian customers are working toward their December 19, 2026 deadline and are sending questionnaires to their suppliers right now. Documenting your measures along NIS2, for example in Sightadel, lets you answer them from existing evidence.

Data protection and supply chain

The GDPR is supervised by the Informacijski pooblaščenec, the Information Commissioner of the Republic of Slovenia. Additional rules are in the Personal Data Protection Act ZVOP-2 (Uradni list RS, No. 163/2022).

Slovenia has no supply chain law of its own. What will matter is the CSDDD, which has to be transposed by July 26, 2028.

What Slovenian customers typically ask for

Feed and food manufacturers ask about traceability, lab analyses and a certificate under IFS, BRCGS or FSSC 22000. For soy from Brazil, they also want the EUDR evidence.

If you do engineering or IT work for Slovenian suppliers to German carmakers, you will often be asked about TISAX. For other IT services, ISO 27001 is the usual proof, and industrial customers look for ISO 9001.

A sensible starting point if you have customers in Slovenia:

  1. Ask your customer directly whether it falls under ZInfV-1 and what it will require of suppliers by December 2026.
  2. Back up your questionnaire answers with evidence: policies, logs, test results.
  3. For soy, coffee and pulp, collect the geolocation data for your plots before the buyer asks for it.
  4. Get labels and instructions translated early if your goods are sold to consumers.

The free EU Readiness Check shows you where you stand today.

Where to get help

  • Gospodarska zbornica Slovenije (GZS), the Chamber of Commerce and Industry of Slovenia in Ljubljana.
  • SPIRIT Slovenija, the public agency for entrepreneurship, internationalization and investment.
  • The trade section of your country's embassy responsible for Slovenia.
  • The Enterprise Europe Network in Slovenia.
  • Slovenian customs, part of the financial administration (Finančna uprava Republike Slovenije, FURS).

For goods from Mercosur, the EU-Mercosur Agreement has been provisionally applied since May 1, 2026.

FAQ

When do Slovenian companies have to implement the NIS2 measures?
Most entities by December 19, 2026 (Art. 62 ZInfV-1). Former operators of essential services, state bodies and telecom providers already had a deadline of June 19, 2026.
Do instructions have to be in Slovene?
Yes. For goods sold to consumers in Slovenia that need instructions, ZVPot-1 requires a complete Slovene version.
Where does a Slovenian company report a cyber incident?
To SI-CERT, currently by email. The early warning must arrive no later than 24 hours after the incident is detected.
Which tools help me answer Slovenian supply chain questionnaires?
Most questions concern your security measures and your internet-facing systems. Sightadel keeps the evidence for the measures in one place and is hosted in Germany; a veyrisk report covers the external view.