Check every process against the rulebook, with a person in charge
Plain-language information on compliance in the EU and Slovenia: the key rules, how new documents are reviewed and approved, how incidents are handled and reported, how employees are trained – and where compliance applies across industries.
A compliance review in four steps
- Keep an approved rulebook. Laws, guidelines and internal policies, versioned and dated.
- Submit the document. One process document with its owner, version and scope.
- Review and cite. Findings by requirement, with the source, a rating, a severity and a proposed fix.
- Officer validates. A named compliance officer confirms, amends or rejects each finding and signs.
What is compliance?
Compliance means that an organisation runs its business in line with the laws, supervisory rules and internal policies that apply to it – and can show that it does.
A written process
Policies, procedures and work instructions describe who does what, when and with which controls – for example how a loan is approved or how an incident is reported.
A rulebook
EU regulations and directives, national laws, measures of supervisors, guidelines and the organisation’s own policies. They change often and they overlap.
Evidence
Records that show the process meets the rules: reviews, approvals, training, incident logs and decisions – kept so that auditors and supervisors can follow them.
Why compliance matters now
Regulated organisations change their processes all the time: a new loan procedure, a revised product approval, an updated security policy. Each change has to meet laws, supervisory guidelines and internal policies. Checking by hand is slow, depends on who reads the text, and gaps are often found late.
More rules, more overlap
AI, data protection, cybersecurity, operational resilience, consumer credit and anti-money laundering rules apply at the same time and often to the same process.
Management is accountable
Under NIS2 and DORA, management bodies must approve and oversee the measures for cyber and ICT risk; NIS2 also requires them to follow training.
Short reporting deadlines
Some incidents must be reported to authorities within hours or days. Missing a deadline is itself a compliance failure. See the deadlines.
Sanctions and trust
Breaches can lead to supervisory measures and fines – under the GDPR up to EUR 20 million or 4% of worldwide annual turnover for the most serious infringements – and to loss of customer trust.
A consistent method – the same approved rulebook, the same review steps and a named person who signs – makes compliance repeatable and auditable. AI assistants can speed up the reading and comparing; people keep the judgement and the accountability.
The main rules to know
A short orientation on the main frameworks. Dates and scope were checked against official texts in October 2026; always confirm the current version before relying on them.
AI Act Regulation (EU) 2024/1689
Risk-based rules for AI systems: prohibited practices, obligations for high-risk systems, transparency duties and AI literacy.
- Already applies
- Prohibited practices and AI literacy since 2 February 2025; rules for general-purpose AI models since 2 August 2025; general date of application 2 August 2026.
- 2026 Digital Omnibus on AI
- Regulation (EU) 2026/1744 (in force since 27 July 2026) postpones the high-risk rules: to 2 December 2027 for Annex III systems – for example AI used to assess the creditworthiness of individuals – and to 2 August 2028 for AI in products under Annex I. It rewords the AI literacy duty (providers and deployers must take measures to support the AI literacy of their staff) and adds to the list of prohibited practices.
GDPR Regulation (EU) 2016/679 · ZVOP-2
Rules for processing personal data, applying since 25 May 2018; in Slovenia supplemented by the Personal Data Protection Act (ZVOP-2).
- Often relevant
- Lawful basis and transparency, data protection impact assessments, rights of individuals including safeguards for decisions based solely on automated processing (Art. 22), and notification of personal data breaches (Art. 33–34).
- Watch
- EU proposals to simplify parts of the GDPR are under discussion and not adopted.
NIS2 / ZInfV-1 Directive (EU) 2022/2555
Cybersecurity risk management and incident reporting for essential and important entities in listed sectors. Slovenia transposed NIS2 with the Information Security Act (ZInfV-1, Official Gazette 40/25), in force since 19 June 2025.
- Key duties
- Self-registration, risk management measures, management body approval, oversight and training, and staged reporting of significant incidents to the competent CSIRT.
- Who
- Generally medium-sized and larger entities in the listed sectors, plus some entities regardless of size. Check your own case.
DORA Regulation (EU) 2022/2554
Digital operational resilience for banks, insurers, investment firms, payment institutions and other financial entities, applying since 17 January 2025.
- Key duties
- ICT risk management framework owned by the management body, classification and reporting of major ICT-related incidents, resilience testing, and management of ICT third-party risk including a register of information.
Consumer credit ZPotK-2 · Directive (EU) 2023/2225
Advertising, pre-contractual information, creditworthiness assessment, the right of withdrawal and fair treatment of borrowers.
- Changing now
- The new Consumer Credit Directive (EU) 2023/2225 applies from 20 November 2026 and repeals Directive 2008/48/EC. In Slovenia, the National Assembly adopted a new Consumer Credit Act (ZPotK-3) in October 2026; check the Official Gazette for its publication and effective date. Until then ZPotK-2 applies.
- Also
- Banka Slovenije macroprudential limits on household lending and EBA guidelines on loan origination and monitoring.
Anti-money laundering ZPPDFT-2 · Regulation (EU) 2024/1624
Customer due diligence, beneficial ownership, monitoring and reporting of suspicious transactions.
- Today
- In Slovenia, the Prevention of Money Laundering and Terrorist Financing Act (ZPPDFT-2) applies.
- Upcoming
- The EU Anti-Money Laundering Regulation (EU) 2024/1624 applies from 10 July 2027, supervised in part by the new EU Anti-Money Laundering Authority (AMLA).
Depending on the organisation, other frameworks may also apply – for example eIDAS (electronic signatures and trust services), whistleblower protection, or standards such as ISO/IEC 27001 and ISO/IEC 42001.
Compliance for three kinds of organisations
Banks and financial institutions, the public sector and small and medium-sized enterprises face different rules but the same basic tasks. The method is the same; the rulebook changes.
Banks and financial institutions
Typical rules: DORA, consumer credit, AML, GDPR, AI Act, EBA guidelines and Banka Slovenije measures.
- Loan origination and product approval procedures that meet consumer credit and AML rules
- Human oversight and explanations where AI is used for credit scoring
- Classification and timely reporting of major ICT incidents under DORA
Public sector
Typical rules: GDPR and ZVOP-2, ZInfV-1 where in scope, AI Act duties for public authorities using AI.
- Internal procedures and rules that are reviewed and approved consistently
- Policies published to staff, with acknowledgements
- Personal data breaches and security incidents handled on time
SMEs
Typical rules: GDPR, AI Act (AI literacy and transparency), NIS2 where in scope or as a supplier to in-scope customers.
- A simple check of a policy or procedure before it is approved
- Approval and acknowledgement without a large compliance team
- Clear steps when a data breach happens
Where AI can read and where people decide
AI assistants can help with the reading and comparing. People own the rulebook, the decisions and the signature.
What an AI assistant can help with
- Mapping the steps of a process to the requirements in an approved rulebook
- Pointing to the source and article behind each point
- Drafting findings and proposed wording for people to review
- Saying clearly when no rule covers a point, instead of guessing
- Calculating reporting deadlines and drafting notifications for review
What people decide
- Which sources are approved for the rulebook
- Whether each finding is confirmed, changed or rejected, and how serious it is
- How the law is interpreted, together with Legal
- Whether a document is approved or sent back
- How an incident is classified and what is reported to authorities
Approving new documents
Policies, procedures and process changes: from an approved rulebook and a cited review to approval, publication and acknowledgement.
Document approvalManaging incidents
From detection and triage to the reporting deadlines under GDPR, NIS2, DORA and the AI Act, remediation and lessons learned.
Incident managementTraining and certification
Role-based courses, quizzes, certificates and renewals – including evidence of AI literacy under the AI Act.
Training and certificationWhere compliance applies
Banking, insurance, investment, pharma, medical devices, energy, telecom, the public sector and more – with the typical rules in each.
Use cases by industryPrinciples for using AI in compliance work
Human accountability
A named person validates and signs every result. AI supports compliance staff and does not make decisions about customers.
Traceability
Questions, sources, rulebook versions and decisions are logged, so every result can be reconstructed.
Data minimisation
No customer data or confidential personal data in the rulebook or in a document review.
Controlled knowledge
Only approved, dated and versioned sources are used. Old versions are archived, never overwritten.
AI tools used in compliance work are themselves AI systems. The EU AI Act treats some uses of AI, such as credit scoring, as high-risk; organisations should assess and document how each tool they use is classified.
Talk to us about your compliance needs
Get in touch for a conversation about document approval, incident management or employee training in your organisation. Tell us your sector (bank or financial institution, public sector body or SME) and the rules you work with.
Contact
E-mail: tadej.drmaz@comp-consulting.eu
Please do not send customer data or confidential documents by e-mail.