Categorisation under Decree 184/2026 Coll. of the Ministry of Investments, Regional Development and Informatisation of the Slovak Republic classifies the managing body, not the information system. The minimum security measures in Annex 2 are divided into Category One, Category Two and Category Three within the individual areas of cyber and information security, and a body implements measures at least at the level of the category that applies to it (primary source — Slov-lex, Decree 184/2026 Coll., promulgated 9. 7. 2026).
This text describes the mechanics of classification and the transitional rules, not the measures themselves. The list of measures is in annexes that the open version renders only as files to download, so no specific measure and no count of items in any category is stated here.
How the category in which security measures apply is set
Classification is derived neither from the budget, nor from the number of users, nor from the value of the data managed, but from what kind of subject the managing body is. The decree lists three groups and each further group also takes on the measures of the preceding ones, so the categories do not combine as alternatives but cumulatively, and the classification does not change according to which information system of the body is involved.
| Measures that apply | To whom under Section 1 |
|---|---|
| Category One | A municipality of up to 6 000 inhabitants; a legal person under Section 5(2)(e) of the act other than a critical entity; a person under Section 5(2)(g) |
| Category One and Category Two | A municipality above 6 000 inhabitants other than a regional capital; a city district; the Office of the Public Defender of Rights; the Commissioner for Children; the Commissioner for Persons with Disabilities; the Council for Media Services; another state body under Section 5(2)(b) |
| Categories One, Two and Three | A city that is a regional capital; a self-governing region; a ministry and other central state administration body and further listed subjects including the Social Insurance Agency, a health insurer and the Financial Directorate of the Slovak Republic |
For a conflict between categories the decree has a rule of its own. Where minimum measures of different categories applying to the same information technology duplicate or are incompatible, the provisions governing the measures of the higher category prevail. A lower category therefore never operates as an exception to a higher one (primary source — Slov-lex, Decree 184/2026 Coll., Section 1, as of 22. 8. 2026).
What is recorded and what is documented on top
Alongside the category, the decree also fixes what the measures are performed on. An asset is identified and kept in an asset register that is centrally managed and matches the current state, and that contains in particular the identification of primary assets, supporting assets, asset owners and the persons responsible for identifying and recording them.
Where a managing body adopts measures beyond the minimum, it documents and justifies the changes in their scope. And where the decree refers to a procedure under a technical standard, an equivalent may be followed if the same result is achieved and the decree’s requirements are met; in case of doubt the view of the guiding body is decisive.
Two transitional regimes that do not apply to everyone alike
The decree takes effect on 1 January 2027 and on the same day Decree 179/2020 Coll. is repealed under Section 6. The transition is not a single event, however, because Section 5 contains two different rules for two different situations: one aimed at the scope of measures, the other at organisations that came into being while the new instrument was being prepared.
The first is temporal: until 30 June 2027 the measures of the relevant category count as adopted also where they are adopted in the scope of Annex 2 to Decree 179/2020 Coll. in the version in force until 31 December 2026. For half a year after the new decree takes effect, two scopes are therefore recognised side by side.
The second is subject-based: in the organisation of an administrator established or founded from 1 January 2026, the decree is implemented within 12 months of the day of establishment. The period here does not run from the effect of the instrument but from the creation of the organisation, so two equally sized subjects may have deadlines months apart (primary source — Slov-lex, Decree 184/2026 Coll., Sections 5 and 7, as of 22. 8. 2026).
The same pattern elsewhere: content in the annex
The categorisation decree is not alone in this. Decree 175/2026 Coll. of the Ministry of Finance, in force from 1 September 2026, says one sentence about content in its Section 1: the annual report on internal audits contains the data set out in the annex. The rest is the enabling clause and the repeal of the earlier Decree 204/2019 Coll. (primary source — Slov-lex, Decree 175/2026 Coll., promulgated 2. 7. 2026).
The practical consequence is the same in both cases. The text of the instrument says who and by when, but not what exactly; the content of the duty sits in an annex downloaded separately. When preparing a budget or tender documents that means the decisive document is not the one opened first.
Dates
The following dates follow from the provisions cited and are listed chronologically. The first of them falls still within this year, the next three within the following twelve months, and the last is not fixed at all, because it depends on the day a particular administrator’s organisation came into being and not on the effect of the instrument.
- 1 September 2026 — entry into force of Decree 175/2026 Coll. on the content of the annual report on internal audits.
- 31 December 2026 — the last day of the version of Decree 179/2020 Coll. to which the transitional rule refers.
- 1 January 2027 — entry into force of Decree 184/2026 Coll. and repeal of Decree 179/2020 Coll.
- 30 June 2027 — the end of transitional recognition of measures in the scope of the old annex.
- 12 months from establishment — the period for an administrator’s organisation established from 1 January 2026.
Zdroje a dáta
Primary sources: Slov-lex — Decree 184/2026 Coll. of the Ministry of Investments, Regional Development and Informatisation and Decree 175/2026 Coll. of the Ministry of Finance, both read in their promulgated versions on 22 August 2026. The dates of approval, promulgation and entry into force are taken from the instrument records in the same database, as is the information on which older decrees are repealed.
The annexes to both decrees appear in the open version only as files to download, so this text states no specific security measure, no count of items in the categories and no item of the annual report on internal audits. Nor does it state the number of bodies in each category, because no such figure appears in the verified source, and the list of Category Three subjects is cited in shortened form with a note that it is a selection from a longer enumeration.
This material is a general analysis of published rules. It is not legal, tax, immigration or financial advice.