Croatia: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) directly applicable, implemented nationally by Croatia's Act on the Implementation of Regulation (EU) 2023/1114 (NN 84/2024, in force July 2024); HANFA (Croatian Financial Services Supervisory Agency) is the competent authority for crypto-asset service providers, the Croatian National Bank (HNB) supervises issuers of asset-referenced tokens (ARTs) and e-money tokens (EMTs); AML/CFT obligations under the Croatian Anti-Money Laundering and Terrorist Financing Prevention Act; tax treatment under the Personal Income Tax Act.

Crypto is legal in Croatia and is comprehensively regulated under the EU's MiCA framework, which has been directly applicable since 30 December 2024 and is implemented domestically through Croatia's MiCA Implementation Act of July 2024. HANFA licenses and supervises crypto-asset service providers (CASPs) such as exchanges, custodians and brokers, while the Croatian National Bank supervises EMT and ART (stablecoin) issuers; legacy VASPs registered with HANFA before 30 December 2024 may continue operating under a transitional regime until 1 July 2026, by which date they must obtain a full MiCA CASP authorisation. Crypto capital gains realised by individuals are subject to a 12% personal income tax (plus local surtax), with a full exemption for assets held for more than two years.

Framework: EU AI Act (Regulation (EU) 2024/1689), directly applicable; AZOP (Agencija za zaštitu osobnih podataka / Personal Data Protection Agency) designated as key national competent authority; Ministry of Justice, Administration and Digital Transformation (MPUDT) leads inter-ministerial AI Act implementation working group

Croatia is fully subject to the EU AI Act, the world's first comprehensive binding AI regulation, which entered into force on 1 August 2024 and has been phasing in its requirements through 2026. Croatia has no separate national AI law; the EU Regulation applies directly. AZOP has published the list of national competent authorities under the AI Act and is actively issuing guidance, while the Croatian government is concurrently drafting a National Plan for the Development of Artificial Intelligence aligned with the Digital Croatia Strategy 2032.

Framework: EU General Data Protection Regulation (GDPR, Regulation 2016/679) directly applicable; national implementation via Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka, Official Gazette No. 42/2018); supervisory authority: Agencija za zaštitu osobnih podataka (AZOP)

Croatia applies GDPR directly as an EU member state, supplemented by its 2018 national implementation act that establishes AZOP as the sole independent supervisory authority and sets out procedural rules, sector-specific carve-outs, and administrative-fine procedures. AZOP is an active enforcer, by 2025 it had issued 58 administrative fines totalling €9.1 million, placing Croatia among the EU's top-ten sanctioning authorities in 2023, and it imposed a record €4.5 million fine on a telecom operator in November 2025. The agency is also designated to supervise compliance with the EU AI Act under Article 70 thereof.

Framework: Payment System Act (transposing PSD2, Directive 2015/2366/EU); Electronic Money Act (transposing EMD2); MiCA Implementation Act (Zakon o provedbi Uredbe (EU) 2023/1114, July 2024); supervised by Croatian National Bank (HNB) and Croatian Financial Services Supervisory Agency (HANFA)

Croatia operates a comprehensive, fully functional licensing regime for payment institutions and electronic money institutions, with the Croatian National Bank (HNB) as the primary competent authority under the Payment System Act (PSD2 transposition effective July 2018) and the Electronic Money Act. MiCA became fully applicable on 30 December 2024, with HANFA licensing crypto-asset service providers (CASPs) and HNB overseeing asset-referenced and e-money token issuers. Croatia's instant-payment infrastructure (EuroNKSInst via FINA) mandated SEPA Instant receipt from January 2025 and sending from October 2025, while PSD3/PSR and CCD2 (covering BNPL) are incoming EU-level frameworks Croatia will be required to implement.

Framework: Croatian Law on Foreigners (Zakon o strancima), Part IV, Temporary Stay of Digital Nomads; administered by the Ministry of Interior (Ministarstvo unutarnjih poslova, MUP); official portal: digitalnomadscroatia.mup.hr

Croatia operates a dedicated temporary residence permit for digital nomads, third-country (non-EU/EEA/Swiss) nationals who work remotely for employers or companies not registered in Croatia. Introduced in January 2021 and significantly amended effective March 2025, the permit grants up to 18 months of legal stay, with holders exempt from Croatian income tax on foreign-sourced income. EU/EEA/Swiss citizens reside freely under EU freedom-of-movement rules and have no need for this permit.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065), directly applicable; Croatia's national Law on the Implementation of the DSA (in force 17 April 2025); Digital Services Coordinator: HAKOM (Hrvatska regulatorna agencija za mrežne djelatnosti)

Croatia is governed by the EU's Digital Services Act as the primary comprehensive online-safety and content-moderation regime, supplemented by a national DSA Implementation Law that entered into force on 17 April 2025 and designates HAKOM as the Digital Services Coordinator. However, the European Commission has issued two letters of formal notice (2024 and April 2026) citing Croatia's failure to fully empower HAKOM with the sanctioning powers required under the DSA. Children's online safety is addressed through DSA obligations, the Safer Internet Centre Croatia, and a draft National Programme for Children in the Digital Environment 2024-2026.

Framework: Zakon o kibernetičkoj sigurnosti (Cybersecurity Act, Official Gazette No. 14/2024, in force 15 Feb 2024) + Uredba o kibernetičkoj sigurnosti (Regulation on Cybersecurity, Official Gazette No. 135/2024, in force 30 Nov 2024); national competent authority: SOA / National Cyber Security Center (NCSC-HR)

Croatia transposed the EU NIS2 Directive (2022/2555) ahead of the October 2024 EU deadline, enacting its Cybersecurity Act on 26 January 2024 (in force 15 February 2024) and its implementing Regulation on Cybersecurity in November 2024. The law extends the regulated universe from ~1,000 to an estimated 8,000-10,000 entities across 19 critical sectors, with supervisory enforcement (audits, fines) commencing in H2 2025. The Security and Intelligence Agency (SOA) hosts the National Cyber Security Center (NCSC-HR), which acts as the central competent authority and CSIRT for most sectors.

Framework: Companies Act (Zakon o trgovačkim društvima, OG 111/93 as amended); Foreign Investment Screening Act (OG 136/25, in force Nov 2025); HITRO.HR one-stop-shop; Commercial Court Registry (Sudski registar)

Croatia permits 100% foreign ownership of companies under the same conditions as domestic investors, with no mandatory local partner for any nationality. The dominant incorporation vehicle is the d.o.o. (LLC) requiring EUR 2,500 minimum share capital, registerable through the HITRO.HR one-stop shop with commercial court registration possible within 24 hours of complete filing; total elapsed time is typically 2-4 weeks. A Foreign Investment Screening Act entered into force in November 2025 requiring Ministry of Finance approval for non-EU acquisitions of 10%+ in sensitive-sector companies, but this does not affect routine business formation.