EU NIS2 in Croatia

Current status

In Croatia, the Office of the National Security Council (UVNS, Ured Vijeća za nacionalnu sigurnost) coordinated the implementation of the NIS2 Directive. The Croatian Ministry of Defence (MORH) published the initial draft of the Cybersecurity Act CCA in September 2023. CCA was enacted in January 2024 (Official Gazette 14/2024) and entered into force on 15 February 2024.

A detailed Regulation on Cybersecurity specifying technical requirements and categorization procedures followed in November 2024 (Official Gazette 135/2024) was enacted. Transition periods of up to nine months apply. Competent authorities planned to notify entities of their status by April 2025, after which affected entities haveup to one year to comply with the cybersecurity obligations in full.

Authorities

The national regulator is the Croatian Security and Intelligence Agency (SOA, Sigurnosno-obavještajna agencija), which hosts the National Cyber Security Center (NCSC-HR) and coordinates the implementation of NIS2. Competent authorities began the process of categorizing essential and important entities across all sectors in late 2024, scheduled to be completed in April 2025, when organizations falling under the law will have received an official notification of their status.

Supervising authorities in Croatia are assigned primarily on a sectoral basis. different authorities oversee compliance depending on the (sub)sector or type of service provided, with SOA/NCSC-HR providing centralized coordination and sectoral regulators handling oversight within their respective domains.

The Croatian National Computer Emergency Response Team (CERT.hr), within CARNET, supports NCSC-HR as the CSIRT and is responsible for operating the national reporting platofrm (PiXi).

NIS2 Requirements

National differences

• Compliance: For essential entities, compliance can only be proven through audits. The audit cycle is two years, but shorter cycles may be required by the competent authority. Important entities may conduct a self-assessment. However, the competent authority may require an audit in exceptional cases.
• Incident reporting: Essential and important entities must report significant incidents. Unlike the NIS2 Directive, the Croatian draft omits the 24h/72h reporting deadlines. The reporting platform will be operated by CARNET, the Croatian academic and research network.
• Authority-led affectedness determination: Entities are not required to self-identify as essential or important entities. The competent authority proactively notifies all affected entities of their obligations.
• Threat detection system: The Croatian intelligence agency SOA will develop a national system for detecting cyber threats, which essential and important entities can access.
• Additional sectors: Croatia expands the scope beyond NIS2 by including:
  • Public administration on the local level (optional under Art. 2(5)(a) NIS2)
  • Education System (Sustav Obrazovanja) — both public and private institutions are listed in Annex II
• New entity category: Croatia introduces a new type of essential entity not covered by NIS2:
  • Information intermediaries involved in the exchange of electronic invoices between companies, regardless of their size
• Omissions: Domain name registration service providers (covered in Annex I of the NIS2 Directive) are not included in the Croatian law.
• Different CSIRTs: Generally, the Croatian National Cybersecurity Centre acts as the CSIRT. For banking, financial market infrastructure, digital infrastructure, research, and the education system, the national CSIRT is directly responsible.

Entities and sectors

Sectors

Croatia aligns it sector definitions closely with EU NIS2. The Cybersecurity Act directly references the EU criteria for essential (ključni) and important (važni) entities, and defines them accordingly. However, Croatia introduces the Education System (Sustav Obrazovanja) an additional sector compared to the original NIS2 framework.

Entities are categorized by competent authorities with a process starting in 2024 and entities receiving notifications in early 2025. These formal notices trigger the entities’ obligations under the law. Entities only become obliged to comply once they are informed of being classified as essential or important entities.

Annex I Sectors

Annex II Sectors

Cybersecurity

Risk Management

The CCA and its implementing regulation define detailed cybersecurity risk management obligations that go beyond the general requirements of the NIS2 Directive. These are laid out in Articles 35–57, where the CCA formalizes a structured, multi-level risk assessment and control system based on national profiling and sectoral exposure.

Entities categorized as essential or important must undergo a national cybersecurity risk assessment, which determines the binding level of risk management obligations based on factors such as:

• Size and sector of the entity
• Relevance of typical cyberattacks (e.g., espionage, sabotage, disinformation)
• Severity and probability of sector-specific threats
• Profile and capability of threat actors (e.g., APTs, terrorists, cybercriminals)
• Historical and global cybersecurity trends

This national risk assessment results in a low, medium, or high risk rating per entity Art. 38 with corresponding cybersecurity obligations:

• Basic measures for low risk
• Intermediate measures for medium risk
• Advanced measures for high risk

Each level consists of predefined cybersecurity practice bundles set out in Annex II, including:

• Technical, operational, and organizational controls
• Risk management processes and documentation
• IT/OT system applicability
• Mandatory (“A”), conditional (“B”), or voluntary (“C”) subsets of measures

A formalized scoring system calculates an entity’s compliance and maturity level, supported by official guidelines and a state-issued risk calculator. Art. 43–45, 57 Mandatory updates to risk management measures must occur at least annually, or after major incidents, business changes, or audit findings. Art. 48

Security Measures

Croatia introduces a graded and measurable framework to implement cybersecurity risk management requirements via:

• Three-tiered measure levels linked to assessed risk
• Mandatory vs. voluntary control subsets per Annex II
• Regular updates and reviews based on incidents, audits, or organizational changes
• Entity self-assessments every two years for important entities Art. 52 scored and documented through a formal Declaration of Conformity Art. 55
• Physical security extensions for digital infrastructure providers Art. 46
• Guidelines and calculators for both public and private actors, ensuring consistency with international standards Art. 40, 49, 50

Entities not formally categorized under the Act (e.g., SMEs or startups) may still voluntarily adopt basic-level controls or use published best practice guidelines. Arts. 47, 50

To ensure implementation and comparability, the central cybersecurity authority in Croatia publishes:

• Guidelines for risk assessments and self-assessments
• Mapping tables between Croatian controls and EU/international standards
• Official forms and scoring tools for audits and maturity evaluation

Reporting Obligations

Incident Reporting

Croatia’s NIS2 implementation sets out a detailed and highly structured framework for incident notification by key and important entities. A "significant incident" is defined using detailed technical and impact criteria (Arts. 59–62), including service downtime, data compromise, financial loss, reputational damage, or harm to third parties. Repeated smaller incidents with a shared root cause can also qualify as significant.

Entities must report incidents to the competent CSIRT in several stages Art. 65

• Early warning within 24 hours of awareness Art. 66
• Initial notification within 72 hours Art. 67
• Final report within 30 days Art. 70
• Progress reports every 30 days if the incident is ongoing Art. 71
• Interim reports if requested by the CSIRT Art. 69

Reports must be submitted via the national PiXi platform Art. 94 which all entities are required to use. The responsible authorities must notify entities of their platform access and ensure accounts are set up. Art. 95–97 CSIRTs provide feedback, coordinate incident resolution, and report significant cross-border or cross-sector incidents to the single point of contact. Art. 76–83 Entities must also inform affected service recipients within 72 hours Art. 85 and, where applicable, warn them of serious threats. Art. 86

In addition to mandatory reporting, Croatia also allows and encourages the voluntary reporting of other security incidents, cyber threats, and near misses (Arts. 87–89). These reports must be submitted via the national platform within 30 days, and CSIRTs may offer operational advice or reclassify the event as a significant incident if criteria are met. This mechanism helps identify emerging threats and fosters early intervention, even when thresholds for formal incident reporting are not met.

The reporting timelines, formats, and follow-ups are standardized across sectors, with optional sector-specific guidelines issued where necessary. Art. 72–74 Compared to other Member States, Croatia’s model stands out for its high level of procedural formalization and emphasis on centralized coordination between CSIRTs, sectoral authorities, and the single point of contact. This prescriptive and platform-integrated approach contrasts with the more flexible model adopted in NIS2 in Finland, where reporting requirements allow for more discretion and sectoral adaptation.

Sanctions

The Croatian Cybersecurity Act outlines the sanctions framework in Art. 101–102. Sanctions can be imposed if an operator fails to comply with cybersecurity obligations, including:

• Implementing appropriate cybersecurity risk management measures Art. 42
• Conducting a cybersecurity self-assessment and submitting a declaration of conformity Art. 51–55
• Timely reporting of incidents, threats, and near misses Art. 64–74

For essential entities Art. 101 fines range from 10k to 10m EUR or 0.5% to 2% of global annual turnover, whichever is higher. For responsible individuals, fines range from 1000 to 6k EUR.

For important entities Art. 102 fines range from 5k EUR to 7m EUR or 0.2% to 1.4% of global annual turnover. Responsible individuals may be fined 500 to 3k EUR.

Audits

Croatia mandates biennial cybersecurity audits for essential entities. Art. 51–57 These audits assess the entity’s compliance with the prescribed risk management level.

Important entities must perform self-assessments and submit a declaration of conformity Art. 55 but are not subject to regular audits by default. Audits may be required in case of non-compliance, serious incidents, or supervisory requests.

Audits must be conducted by qualified internal or external staff with appropriate certifications Art. 56 The central authority provides scoring guidelines and tools for assessment. Art. 57

Sources

1. Tagesordnung der 253. Regierungssitzung mit Link zum zweiten NIS2-Gesetzesentwurf, Webseite der kroatischen Regierung, 27.09.2023
2. Finaler NIS2-Gesetzesentwurf, Webseite der kroatischen Regierung, 13.12.2023
3. Tagesordnung der 271. Regierungssitzung mit Link zum finalen NIS2-Gesetzesentwurf, Webseite der kroatischen Regierung, 13.12.2023
4. Konsultationsergebnisse zum ersten kroatischen NIS2-Gesetzesentwurf, Webseite des kroatischen Konsultationsdienstes, 16.08.2023
5. Erster NIS2-Gesetzesentwurf, Webseite des kroatischen Konsultationsdienstes, 17.07.2023