Skip to content

National Annex — Croatia

Status as of October 2026: In force. Community-maintained orientation. This is not legal advice; verify against the official gazette and authority guidance before relying on it. Corrections welcome, see contributing.

Review Status
Confidence Maintainer reviewed
Checked line by line against the legal text No
Reviewed by a lawyer No
Last reviewed October 2026
Reviewed by Frederik B. Krogsgaard, maintainer
Second reviewer Wanted, see CONTRIBUTING
Next review due April 2027

NIS2 implementation

Field Value
Implementing law Zakon o kibernetičkoj sigurnosti (Cybersecurity Act), NN 14/2024, in force 15 February 2024; first member state to transpose
Competent authority Sigurnosno-obavještajna agencija (SOA), the central state authority for cybersecurity
National CSIRT / reporting The CSIRT at SOA or the national CERT at CARNET, depending on the entity; CARNET runs the national reporting platform
Official starting point https://www.soa.hr

Country notes for your CDC

Competent authorities categorise entities and notify them of the result. The duty to report significant incidents starts 30 days after that notice, so the reporting runbook has to be ready by then.

Standard checklist for all countries

  • GOVERN: applicability determined per legal entity and sector, and recorded in the regulatory applicability register
  • Entity registration completed with the national authority where required
  • RESPOND: incident-reporting procedure drilled against the national channel and the 24 h early-warning clock
  • Contact established with the national CSIRT before the first incident
  • Data protection authority contact and GDPR Art. 33 flow prepared. This runs in parallel with NIS2 reporting
  • National guidance and frameworks mapped to your control evidence, per the note above

Selector tag

Tick "Croatia" in tools/regulatory-profile.html to include this country's references under the hr-nat tag.

Open CDC Framework, licensed CC BY 4.0.