Is Slovenia's PQC recommendation binding?

No. URSIV uses 'priporoca' (recommends): it recommends that entities bound by Slovenia's Information Security Act (ZInfV-1), as well as entities not directly bound by that law, begin PQC transition activities. That is explicitly non-binding recommendation language.

What risk does Slovenia's guidance cite?

Harvest-now-decrypt-later -- the risk that encrypted data intercepted today could be decrypted once sufficiently powerful quantum computers exist. The document uses the Slovenian phrase 'shrani danes, desifriraj kasneje' (save today, decrypt later).

Slovenia's Information Security Act, the national law implementing NIS2-equivalent cybersecurity obligations. URSIV's May 2026 recommendation addresses entities bound by ZInfV-1 directly, plus other entities not formally bound by it -- but names no specific regulated sector or binding compliance deadline.

Does Slovenia set a PQC migration deadline?

No specific year or phased timeline appears anywhere in the document. The only framing is general risk urgency around harvest-now-decrypt-later, not a dated commitment.

Does Slovenia require a cryptographic inventory or CBOM?

No. The recommendation describes only a general instruction to 'begin activities for transition to post-quantum cryptography,' with no mention of a cryptographic inventory, CBOM, or asset-mapping requirement, explicit or implied.

pqcsloveniaursivnis2eu-roadmap

Slovenia's PQC Guidance Is a Translated FAQ From Brussels, Not a National Standard

URSIV recommends ZInfV-1-bound entities begin PQC transition activities, citing harvest-now-decrypt-later risk -- but the document itself is an unofficial Slovenian adaptation of the EU NIS Cooperation Group's roadmap FAQ, not independent national guidance.

PQC Security EditorialOctober 18, 20263 min read

When a government's national PQC guidance is footnoted as an adaptation of someone else's FAQ, that tells you something real about where the actual policy work is happening -- and it isn't in that country yet.

A relay, not a source

URSIV (Urad Vlade Republike Slovenije za informacijsko varnost), Slovenia's Office for Information Security, published "Načrt Evropske unije za postkvantno kriptografijo: Pogosta vprašanja" in May 2026. Translated, that's "EU Roadmap on Post-Quantum Cryptography: Frequently Asked Questions" -- and the document is exactly what the title says: an unofficial Slovenian translation and adaptation of the European Commission's own "EU Roadmap on PQC – Frequently Asked Questions," originally prepared by the EU's NIS Cooperation Group.

That's a meaningfully different thing from independent national guidance. Several EU member states on this tracker (Germany, the Netherlands, France) have published their own detailed, nationally-specific PQC guidance with domestic legal grounding. Slovenia's contribution, as of this document, is to relay the EU-level FAQ in Slovenian, with a recommendation layered on top rather than new domestic analysis underneath it.

The recommendation itself

What URSIV adds is a direct instruction, in its introduction: entities bound by Slovenia's Information Security Act (ZInfV-1) -- the national law implementing NIS2-equivalent obligations -- "as well as entities not directly bound by that law," should begin activities to transition to post-quantum cryptography. The justification cited is the standard harvest-now-decrypt-later risk, rendered in Slovenian as "shrani danes, dešifriraj kasneje" (save today, decrypt later): the concern that data encrypted and intercepted today could be decrypted retroactively once quantum computers mature.

The verb matters here too. URSIV "priporoča" (recommends) -- not requires, not mandates. This is recommendation language layered onto a translated FAQ, which is about as far from a binding national PQC standard as a government document can get while still being a real, dated, named-authority publication.

What's still missing

No specific sector is named -- "entities bound by ZInfV-1" is broad by statute, but no particular regulated industry (banking, telecom, energy) gets PQC-specific treatment, and "entities not directly bound" is left undefined. No deadline exists anywhere in the text: no year, no phase, no milestone, just the general urgency of the harvest-now-decrypt-later framing. No cryptographic inventory or CBOM requirement appears, explicit or implied. Checks of Banka Slovenije and ATVP (the securities market regulator) found no PQC-specific publications from either -- though ATVP's own site returned a 403 on direct crawling, so that negative result rests on broader search coverage rather than a confirmed page-by-page check of its archive.

What to do with this

If you operate in Slovenia, treat URSIV's document as exactly what it is: a translated relay of EU-level guidance with a non-binding local recommendation attached, not a Slovenia-specific standard. The practical content worth acting on is the EU roadmap itself, which this document is adapting -- read that directly rather than relying on the Slovenian intermediary for anything beyond the recommendation to begin. ZInfV-1-bound entities already have binding NIS2-equivalent cybersecurity obligations independent of this PQC-specific document; folding cryptographic risk into that existing risk-management work is the more immediate, already-enforceable action available.

The Slovenia country page tracks URSIV's recommendation and the regulators checked with no publication, against primary sources.

Frequently asked questions

Does Slovenia have its own post-quantum cryptography guidance?: Not independently. URSIV (Office of the Government of the Republic of Slovenia for Information Security) published a May 2026 document, but it's an unofficial Slovenian translation and adaptation of the European Commission's 'EU Roadmap on PQC - Frequently Asked Questions,' prepared by the EU's NIS Cooperation Group -- relayed guidance, not domestically originated guidance.
Is Slovenia's PQC recommendation binding?: No. URSIV uses 'priporoca' (recommends): it recommends that entities bound by Slovenia's Information Security Act (ZInfV-1), as well as entities not directly bound by that law, begin PQC transition activities. That is explicitly non-binding recommendation language.
What risk does Slovenia's guidance cite?: Harvest-now-decrypt-later -- the risk that encrypted data intercepted today could be decrypted once sufficiently powerful quantum computers exist. The document uses the Slovenian phrase 'shrani danes, desifriraj kasneje' (save today, decrypt later).
What is ZInfV-1?: Slovenia's Information Security Act, the national law implementing NIS2-equivalent cybersecurity obligations. URSIV's May 2026 recommendation addresses entities bound by ZInfV-1 directly, plus other entities not formally bound by it -- but names no specific regulated sector or binding compliance deadline.
Does Slovenia set a PQC migration deadline?: No specific year or phased timeline appears anywhere in the document. The only framing is general risk urgency around harvest-now-decrypt-later, not a dated commitment.
Does Slovenia require a cryptographic inventory or CBOM?: No. The recommendation describes only a general instruction to 'begin activities for transition to post-quantum cryptography,' with no mention of a cryptographic inventory, CBOM, or asset-mapping requirement, explicit or implied.