Oil Beneath the Surface: Why Crude Oil Extraction Is an Essential Service Even Though Slovakia Extracts Little

It is a service about which many will say: Slovakia extracts practically no oil, so why bother with it? And that is exactly where it gets interesting.

Where exactly this service is defined in the Act

Under Annex No. 1 to Act No. 367/2024 Coll. on Critical Infrastructure, crude oil extraction is classified as follows:

Sector: Energy

Subsector: Oil and petroleum products

Category of entities: Operators of facilities for the extraction, refining and processing of crude oil, and the storage and transport of crude oil and petroleum products

Central authority: Ministry of Economy of the Slovak Republic

Who this concerns in practice

Crude oil extraction is not an isolated activity. In Slovak conditions, it involves the extraction of hydrocarbons from domestic deposits, closely interlinked in technological and personnel terms with natural gas extraction – the same wells, the same gathering stations, the same crews, the same control systems. This has one very practical consequence for the application of the Act: a single entity may provide several essential services at once, including across subsectors.

The circle of affected entities is therefore broader than the extraction company itself: it includes service and drilling companies, suppliers of SCADA and industrial control systems, operators of gathering pipelines and stations, transport operators, laboratories, electricity suppliers for the production field, and security guard services. This topic deserves separate attention to such an extent that we address it in a dedicated section of the article below.

Risks: what can bring oil extraction to a halt

The risk assessment under Section 8(3) requires consideration of "all relevant natural and human-made risks, including risks of a cross-sectoral or cross-border nature, accidents, natural disasters, public health threats, hybrid threats or other threats, including acts of terrorism." For crude oil extraction, this specifically means:

• Physical vulnerability of dispersed assets. A production field is not a single fenced-in compound. It consists of dozens of kilometres of scattered wells, gathering lines and technological nodes in open terrain, often beyond the reach of cameras and guard services. That is why Section 10(1)(b) of the Act requires adequate physical protection through mechanical barriers and technical security devices, and Section 2(j) expressly includes among them equipment for the detection of unmanned aerial systems. This is exceptionally relevant for extensive, area-wide extraction infrastructure.
• Cyber risk in the OT environment. Extraction is controlled by industrial systems. As we pointed out in a separate article, a PLC should not be directly accessible from the public internet. In extraction operations with remote metering and remote well control, this risk is entirely concrete. The Act requires linkage with the cybersecurity regime; Section 8(3)(c) includes in the risk assessment also a risk analysis under the cybersecurity legislation.
• Energy dependence. Extraction requires electricity. A power outage means shutting down pumping. This is a textbook example of cross-sectoral dependence under Section 8(3)(d), and at the same time the reason why our previous instalments on electricity generation, demand management and electricity storage are not separate from this topic.
• Environmental and accident risk. A release of petroleum substances into soil or groundwater is not merely ecological damage. It is an event that can trigger a shutdown of operations, intervention by authorities and a long-term loss of capacity. The definition of an essential service in Section 2(b) expressly includes environmental protection as a protected interest.
• Personnel risk. Hydrocarbon extraction is a field with a narrow and ageing pool of expertise. The Act responds to this in Section 10(1)(e) and (f): security management in relation to employees and external workers, categories of authorised persons, verification of identity and integrity, access rights, and mandatory awareness-raising including training and exercises. As we wrote in the commentary by the President of AKI SR: We talk a lot about technologies and too little about people.
• Climate and weather impacts. Section 10(1)(a) requires due consideration of disaster risk reduction and climate change adaptation measures. Extreme heat, drought and floods are no longer a marginal item, as we showed in a separate article on heatwaves.

Two deadlines that make the difference

For every entity that receives a notification of identification, two time limits apply – and it pays to know them before the notification arrives:

• 10 months from delivery of the notification to adopt a security plan, including a description and location of the critical infrastructure by means of GPS coordinates (Section 10(1)).
• If a camera system is used, camera recordings are retained for 7 days and are provided for other purposes only to courts, law enforcement authorities and the intelligence service (Section 10(3)).

And one piece of good news that is often overlooked: under Section 10(4), an entity may make use of documents and measures it has already drawn up under other legislation – mining, emergency response, ISO, cybersecurity – and the central authority may declare them fully or partially compliant with the obligations under the Act. Extraction operations have an advantage here that few others enjoy: they already have most of the documentation, they simply have not translated it into the language of critical infrastructure resilience.

A point of interest: a service that is critical precisely because it is small

Here comes the paradox that makes crude oil extraction one of the most interesting items in the whole of Annex No. 1.

Domestic oil extraction in Slovakia is small in volume and does not come close to covering consumption. This is a long-known and undisputed fact. One could therefore logically argue that it is a marginal service. However, the Act does not measure criticality by production volume. Under Section 9(1)(c), what matters is whether an incident would have a significant disruptive effect on the provision of the essential service or on the provision of other essential services in the sectors and subsectors that depend on that service.

And here the picture changes. Extraction infrastructure is not just a source of barrels. It is know-how, drilling capacity, geological data, personnel with authorisations, and physical infrastructure shared with underground storage and the gas industry. Its value to the state does not lie in how much it produces under normal conditions, but in what it enables under crisis conditions. Critical infrastructure is not assessed by how much it supplies under standard circumstances, but by what remains functional when those circumstances change. That is precisely why the legislator included this service in Annex No. 1. And why the entities themselves should approach it in the same way.

What AKI SR can do about it

The Critical Infrastructure Association of the Slovak Republic acts in this area as a link between the state and operators – and not merely declaratively. The Act itself, in Section 5(g) and Section 6(r), requires the Ministry of the Interior and the central authorities to participate in and support the creation of partnerships at national and international level. AKI SR is exactly such a partnership.

For critical entities in the Oil subsector, AKI SR offers:

• expert support in drawing up and revising the security plan under Section 10, including mapping which existing documents may be applied under Section 10(4),
• methodological support for the risk assessment by the critical entity under Section 11 and for linking it with the central authority's risk assessment under Section 8(4),
• consultations on incident reporting and threshold values,
• preparation for inspection activities by the central authority under Section 6(m),
• training and exercises for authorised persons under Section 10(1)(f).

Supply chain: a topic AKI SR addresses systematically

If there is one place where the resilience of an extraction operation most often fails, it is not the main technology. It is the third party: the service company, the control system integrator, the transport operator, the remote support provider, the security guard service. From this perspective, crude oil extraction is an extreme case: a large share of specialised activities is procured externally, and the external supplier has both physical access to dispersed assets and logical access to control systems.

The Act reflects this in several places at once. Under Section 10(1)(d), the security plan must contain identified alternative supply chains for restoring the smooth provision of the essential service. Under Section 10(1)(e), security management applies not only to the entity's own employees but expressly also to external workers – with categories of authorised persons, verification of identity and integrity, and management of access rights. And the risk assessment under Section 8(3) must also take into account risks of a cross-sectoral and cross-border nature, which, in the case of suppliers, is the rule rather than the exception.

What AKI SR focuses on in this area:

• Transposing requirements into contractual relationships. In practice, the obligations of a critical entity are fulfilled through supplier contracts – access regimes, notification duties in the event of an incident, the right to audit, confidentiality in relation to limited information. The Association helps formulate these requirements so that they are enforceable and, at the same time, achievable for the supplier.
• Involving suppliers rather than bypassing them. AKI SR also brings together entities that are not critical entities themselves but form part of the chain. This creates a space where the customer and the supplier meet before the topic is opened in the form of an audit or a sanction.
• Mapping dependencies and single points of failure. The typical finding is not "we have no supplier", but "we have three suppliers, all of whom depend on the same fourth one". This can only be revealed by looking across entities – and that is precisely what an individual operator cannot see on its own.
• Sharing experience and lessons learned from incidents within the membership base, to the extent that respects the regime of limited information under Section 6 of the Act.
• Training and exercises covering external workers, not just in-house personnel.
• Conveying practical problems to the central authorities, including the Ministry of Economy of the Slovak Republic, with which AKI SR has signed a memorandum of cooperation.

Put simply: the critical entity bears the responsibility, but resilience is created by the entire chain. The Act requires this of the operator, yet it does not itself provide the tool to achieve it across dozens of partners. That tool is a sector-wide platform – and that is exactly the role AKI SR plays.

The series continues



Crude oil extraction represents just one link in the value chain that we are systematically mapping in this series – from the deposit, through transport infrastructure, to processing and distribution. In the following parts, we will focus on the related essential services in the Oil subsector and subsequently on the other subsectors of the Energy sector.