Cybersecurity law & regulation in Croatia (2026)

Legal framework

Zakon o kibernetičkoj sigurnosti (Cybersecurity Act, Official Gazette No. 14/2024, in force 15 Feb 2024) + Uredba o kibernetičkoj sigurnosti (Regulation on Cybersecurity, Official Gazette No. 135/2024, in force 30 Nov 2024); national competent authority: SOA / National Cyber Security Center (NCSC-HR)

NIS2 & cybersecurity law in Croatia

In Croatia, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Croatia implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Croatia

1. 01Primary legislation

   The Cybersecurity Act (NN 14/2024) entered into force on 15 February 2024, repealing the earlier NIS1-based law. It is supplemented by the Regulation on Cybersecurity (NN 135/2024, in force 30 November 2024), which sets out technical security levels, audit cycles and standardised incident-report templates.

   ncsc.hr ncsc.hr digital-strategy.ec.europa.eu

2. 02Competent authority & CSIRT

   SOA (Sigurnosno-obavještajna agencija) is designated the central state body for cybersecurity. Its National Cyber Security Center (NCSC-HR) is the national CSIRT and competent authority for 15 sectors; sector-specific regulators (e.g. HAKOM for electronic communications, Croatian National Bank for banking) act as competent authorities in their own domains.

   soa.hr ncsc.hr ncsc.hr

3. 03Incident reporting obligations

   Essential and important entities must submit: an early warning within 24 hours of becoming aware of a significant incident, a formal incident notification within 72 hours, and a final report within 30 days. Reporting is made to the relevant CSIRT via the national JISKB portal.

   ncsc.hr copla.com cms.law

4. 04Scope & sector coverage

   The Act covers 19 sectors (up from 7 under NIS1), bringing an estimated 8,000-10,000 entities in scope. Entities were required to register via the JISKB portal by 1 March 2025 and must implement initial security measures within one year of receiving their categorisation notice (essential or important).

   span.eu ncsc.hr openkritis.de

5. 05Penalties

   For essential entities: fines up to €10 million or 2% of global annual turnover (whichever is higher); individual managers up to €6,000. For important entities: up to €7 million or 1.4% of global turnover; individual managers up to €3,000. These thresholds exceed the NIS2 minimum requirements.

   ncsc.hr advisera.com cms.law

6. 06Financial sector: DORA overlay

   Financial entities subject to Croatia's Cybersecurity Act are also subject to EU Regulation 2022/2554 (DORA, applicable from 17 January 2025), which takes precedence as lex specialis for ICT-risk management and major-incident reporting in the financial sector. Croatia's Cybersecurity Act explicitly accounts for this sectoral overlay.

   ide3.hr cms.law

NIS2 in Croatia: FAQ

Timeline of decisions

1. 9 May 2025Decision · official
   National Cyber Crisis Management Programme Adopted

   Croatia's government formally adopted the National Cyber Crisis Management Programme, establishing coordinated procedures and roles for managing large-scale cybersecurity crises across public administration and critical infrastructure. This completes the secondary legislative package under the 2024 Cybersecurity Act.

   NCSC-HR (National Cybersecurity Centre Croatia)

2. 1 Mar 2025Decision · official
   JISKB Registration Deadline: Essential and Important Entities Formally Identified

   Deadline passed for entities to register in Croatia's national cybersecurity information portal (JISKB), completing the initial identification of essential and important operators under the NIS2-transposing Cybersecurity Act. Supervisory audits of essential entities are scheduled to commence in H2 2025.

   NCSC-HR

3. 30 Nov 2024Law · official
   Cybersecurity Regulation (NN 135/2024) Enters Into Force

   Adopted by the Croatian government on 21 November 2024, this implementing regulation specifies risk-management measures, entity-categorisation criteria, self-assessment procedures for important entities, and mandatory significant-incident reporting timelines, completing the NIS2 secondary legislation.

   NCSC-HR / Government of Croatia

4. 27 Jun 2024Incident
   LockBit Ransomware Attack Cripples Croatia's Largest Hospital (KBC Zagreb)

   The LockBit group attacked the University Hospital Centre Zagreb, forcing diversion of emergency patients to other hospitals and a full revert to paper-based operations for ~24 hours; radiological systems were especially disrupted. Patient records, organ-donor data, and staff information were reportedly exfiltrated and later published on LockBit's leak site.

   The Record / Recorded Future

5. 15 Feb 2024Law · official
   Cybersecurity Act (NN 14/2024) Enters Into Force, NIS2 Transposition

   Croatia's Zakon o kibernetičkoj sigurnosti, passed by Parliament on 26 January 2024, entered into force, repealing the 2018 NIS1 act. It expanded regulated entities from ~1,000 to an estimated 8,000-10,000, established NCSC-HR within the Security and Intelligence Agency (SOA) as the central cybersecurity authority, and introduced a nationally added Education sector beyond NIS2's original scope.

   NCSC-HR

6. 1 Jan 2022Guidance · official
   Updated Action Plan for the National Cybersecurity Strategy Published

   Led by the Information Systems Security Bureau (ZSIS), a revised Action Plan containing 77 specific implementation measures was published to operationalise Croatia's National Cybersecurity Strategy, covering cybercrime, international cooperation, incident reporting, R&D, and baseline security requirements.

   ZSIS (Information Systems Security Bureau)

7. 1 Jun 2018Law · official
   NIS1 Transposition: Act on Cybersecurity of Operators of Essential Services (NN 64/2018)

   Croatia transposed EU Directive 2016/1148 (NIS1) by enacting the Act on Cybersecurity of Operators of Essential Services and Digital Service Providers (NN 64/2018), supplemented by the Regulation (NN 68/2018). This was the first Croatian law extending mandatory cybersecurity obligations beyond government bodies to private critical-sector operators.

   NCSC-HR

8. 1 Oct 2015Guidance
   Croatia Adopts its First National Cyber Security Strategy (NN 108/2015)

   The Croatian government adopted the National Cyber Security Strategy (Official Gazette 108/2015), establishing the country's first strategic cybersecurity framework with goals aligned to ENISA's classification, including cybercrime prevention, international cooperation, incident response capability, and baseline security requirements.

   Digital Watch Observatory / Croatian Government

9. 1 Jan 2008Decision · official
   National CERT (CERT.hr) Established Within CARNET

   Croatia established its National Computer Emergency Response Team (CERT.hr) as a department of the Croatian Academic and Research Network (CARNET) pursuant to the 2007 Information Security Act, providing the country's first centralised capability for detecting, analysing, and coordinating responses to cybersecurity incidents.

   CERT.hr / CARNET

10. 1 Sept 2002Law · official
    Croatia Ratifies the Budapest Convention on Cybercrime (ETS No. 185)

    Croatia ratified the Council of Europe's Budapest Convention on Cybercrime, the first binding international treaty harmonising national cybercrime laws and cross-border investigative cooperation. This aligned Croatian criminal law with international standards on computer offences, illegal interception, and electronic evidence.

    Council of Europe Treaty Office

11. 1 Jan 2002Law · official
    Croatia ratifies the Budapest Convention on Cybercrime

    Croatia enacted a Law on Ratification of the Council of Europe's Convention on Cybercrime (Budapest Convention, ETS No. 185), criminalising illegal system access, data and system interference, computer-related fraud and child pornography online — embedding the first international cybercrime definitions into Croatian law and criminal procedure.

    Council of Europe – Octopus Cybercrime Community

Sources

1. 1.ncsc.hr/UserDocsImages/ostalo/Cybersecurity_Act.pdf
2. 2.ncsc.hr/UserDocsImages/ostalo/Regulation_on_Cybersecurity.pdf
3. 3.ncsc.hr/en/nis2-transposition
4. 4.soa.hr/en/cyber-security/212
5. 5.digital-strategy.ec.europa.eu/en/policies/nis2-directive-croatia
6. 6.cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
7. 7.ide3.hr/en/blog/it-stories/dora-nis2-and-the-cybersecurity-act-what-companies
8. 8.advisera.com/articles/croatia-cybersecurity-act-vs-nis-2/
9. 9.ncsc.hr/en/about-us
10. 10.copla.com/blog/compliance-regulations/nis2-directive-regulations-and-implementa
11. 11.span.eu/en/insights/cyber-security-act-application-of-the-nis2-directive-in-c
12. 12.openkritis.de/eu/eu-nis-2-croatia.html