Does Slovenia have a post-quantum cryptography (PQC) law?

No. Nothing published for Slovenia carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Urad Vlade Republike Slovenije za informacijsko varnost (URSIV), Office of the Government of the Republic of Slovenia for Information Security.

What is Slovenia's PQC migration deadline?

None. No migration deadline has been published for Slovenia by any regulator we checked, including Urad Vlade Republike Slovenije za informacijsko varnost (URSIV), Office of the Government of the Republic of Slovenia for Information Security.

Does Slovenia require a Cryptographic Bill of Materials (CBOM)?

No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.

SIGuidance

Slovenia

Slovenia's URSIV has issued a non-binding May 2026 recommendation (adapted from the EU NIS Cooperation Group's PQC Roadmap FAQ) urging entities under the Information Security Act, and others, to begin transitioning to post-quantum cryptography, but the source sets no deadline, no defined sector scope, and no inventory/CBOM or enforcement requirement.

Slovenia's post-quantum cryptography posture is classified as guidance, led by Urad Vlade Republike Slovenije za informacijsko varnost (URSIV), Office of the Government of the Republic of Slovenia for Information Security. It scores 10/100 on this tracker's rubric, guidance only, with little binding force yet, and that is not a measure of how secure or advanced the country actually is.

What's verified

URSIV (Urad Vlade Republike Slovenije za informacijsko varnost / Office of the Government of the Republic of Slovenia for Information Security) recommends, in the introduction to its May 2026 document "Načrt Evropske unije za postkvantno kriptografijo: Pogosta vprašanja" (EU Roadmap on PQC: FAQ, an unofficial Slovenian translation/adaptation of the European Commission's "EU Roadmap on PQC – Frequently Asked Questions," prepared by the NIS Cooperation Group), that all entities bound by Slovenia's Information Security Act (ZInfV-1), as well as entities not directly bound by that law, begin activities to transition to post-quantum cryptography (PQC), citing growing risk from quantum computing development and "harvest now, decrypt later" ("shrani danes, dešifriraj kasneje") scenarios.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	0/20	The source uses 'priporoča' (recommends): URSIV recommends that ZInfV-1-bound entities and non-bound entities alike begin PQC transition activities. This is explicitly non-binding recommendation language, not a statutory mandate, so 0.
Deadline concreteness	0/20	The provided evidence contains no specific year(s) or phased timeline language for PQC transition, only a general risk framing around 'harvest now, decrypt later,' so 0.
Scope of coverage	0/20	The recommendation targets entities bound by the Information Security Act (ZInfV-1) plus unspecified 'entities not directly bound,' but no specific regulated sector (banking, telecom, etc.) or economy-wide/critical-infrastructure scope is named in the evidence, so scope is undefined per the rubric's 0 case.
Inventory/CBOM requirement	0/20	The evidence text describes only a general recommendation to 'begin activities for transition to post-quantum cryptography' with no mention of a cryptographic inventory, CBOM, or asset-mapping requirement, explicit or implied, so 0.
Regulatory activity	10/20	URSIV is a named authority (Office of the Government of the Republic of Slovenia for Information Security) issuing this document, but the source shows only a recommendation with no enforcement mechanism (fines, audits, certification) visible, matching the 10 case.
Total	10/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Bank of Slovenia (Banka Slovenije)
Not yet addressed, a gap to watch
Not yet addressed directly. Targeted English- and Slovenian-language searches for post-quantum cryptography, quantum computing, and cryptographic-inventory circulars returned nothing.
ATVP (Slovenian Securities Market Agency)
Not yet addressed, a gap to watch
Not yet addressed directly. Targeted searches returned nothing, and ATVP's own site could not be directly crawled (403), so this result rests on broader search coverage rather than a full page-by-page check of its archive.

FAQ: Slovenia and PQC

Does Slovenia have a post-quantum cryptography (PQC) law?: No. Nothing published for Slovenia carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is Urad Vlade Republike Slovenije za informacijsko varnost (URSIV), Office of the Government of the Republic of Slovenia for Information Security.
What is Slovenia's PQC migration deadline?: None. No migration deadline has been published for Slovenia by any regulator we checked, including Urad Vlade Republike Slovenije za informacijsko varnost (URSIV), Office of the Government of the Republic of Slovenia for Information Security.
Does Slovenia require a Cryptographic Bill of Materials (CBOM)?: No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.