NIS2 obligations in Croatia

Competent authority & CSIRT Legal ref: Annex III

• The Croatian National Bank. ecs-org.eu · 28 Oct 2026 · secondary source
• The Croatian Financial Services Supervisory Agency. ecs-org.eu · 28 Oct 2026 · secondary source
• The Croatian Civil Aviation Agency. ecs-org.eu · 28 Oct 2026 · secondary source
• The Office of the National Security Council. ecs-org.eu · 28 Oct 2026 · secondary source
• The Croatian Regulatory Authority for Network Industries. ecs-org.eu · 28 Oct 2026 · secondary source
• The Central State Office for the Development of Digital Society. ecs-org.eu · 28 Oct 2026 · secondary source
• The Ministry of Science and Education. ecs-org.eu · 28 Oct 2026 · secondary source
• The National Center for Cyber Security. ecs-org.eu · 28 Oct 2026 · secondary source
• National CERT. ecs-org.eu · 28 Oct 2026 · secondary source
• National Center for Cyber Security. ecs-org.eu · 28 Oct 2026 · secondary source
• The Croatian National Bank (CNB) for the banking sector. ecs-org.eu · 28 Oct 2026 · secondary source
• The Croatian Financial Services Supervisory Agency (HANFA) for financial market infrastructures. ecs-org.eu · 28 Oct 2026 · secondary source
• The Croatian Civil Aviation Agency (CCAA) for air traffic. ecs-org.eu · 28 Oct 2026 · secondary source
• The Office of the National Security Council (UVNS) for the public sector. ecs-org.eu · 28 Oct 2026 · secondary source
• The Croatian Regulatory Authority for Network Industries (HAKOM) for electronic communications. ecs-org.eu · 28 Oct 2026 · secondary source
• The Central State Office for the Development of Digital Society (SDURDD) for trust service providers. ecs-org.eu · 28 Oct 2026 · secondary source
• The Ministry of Science and Education (MZO) for the education system, the research sector and the registry of national top-level domains. ecs-org.eu · 28 Oct 2026 · secondary source
• The National Center for Cyber Security established within the Croatian Security and Intelligence Agency (SOA) will be responsible for all other operators that do not fall under one of the mentioned sectors. ecs-org.eu · 28 Oct 2026 · secondary source
• National CERT (NCERT) for the banking, financial markets, digital infrastructure, research and educational system sectors. ecs-org.eu · 28 Oct 2026 · secondary source
• National Center for Cyber Security for all other sectors (Nacionalni centar za kibernetičku sigurnost – part of SOA and covering 18 Sectors). ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 9, 10, 13

• In addition to NIS2, the Regulation covers ICT service management, the public administration as well as private and public entities from the education sector. ecs-org.eu · 28 Oct 2026 · secondary source
• Art. 9 (ICT service man­agement): information intermediaries as defined by the regulation governing the exchange of electronic invoices between entrepreneurs. ecs-org.eu · 28 Oct 2026 · secondary source
• Art. 10 (Public adminis­tration): other government bodies and legal entities with public authority; private and public entities that manage, develop or maintain the state information infrastructure in accordance with the law regulating state information infrastructure. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 20, 34 Primary Law and Art.19, Subordinate Act

• One year from the receipt of the notification on categorisation, entities in scope are required to comply with all provisions of the Law and the subordinate acts. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities shall submit the following information to the Central State Cyber Security Authority: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the entity. ecs-org.eu · 28 Oct 2026 · secondary source
• List of services they provide. ecs-org.eu · 28 Oct 2026 · secondary source
• Address of the main establishment of the entity and its other establishments or the address of its representative. ecs-org.eu · 28 Oct 2026 · secondary source
• Contact details, including email addresses and telephone numbers of the entity and its representative. ecs-org.eu · 28 Oct 2026 · secondary source
• List of Member States in which they provide the services referred to in Article 22 of this Act. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address ranges of the subject. ecs-org.eu · 28 Oct 2026 · secondary source
• The responsible governing body will formally notify and thus request essential and important entities to submit information for the purposes of categorisation and list maintenance. ecs-org.eu · 28 Oct 2026 · secondary source
• The deadlines for the submission shall be determined depending on the scope and complexity of the data to which the request relates, provided that it may not be shorter than 15 days or longer than 45 days from the date of receipt of the request for submission of data. ecs-org.eu · 28 Oct 2026 · secondary source
• Organisations required to provide information for categorising entities or maintaining a special register must submit details about designated contact persons and authorised data handlers within 8 days of receiving a request. Any changes to these details must be reported within 15 days, following the authority’s specified instructions. ecs-org.eu · 28 Oct 2026 · secondary source
• Essential entities are required to deliver a cybersecurity audit report conducted by a certified external audit service provider to the Competent authority within 2 years (and every 2 years afterwards) or at the request of the Competent authority. ecs-org.eu · 28 Oct 2026 · secondary source
• Important entities are required to deliver a cybersecurity self-assessment or an assessment by an external provider to their Competent authority every 2 years, as well as a cybersecurity audit report conducted by a certified external audit service upon the request of the Competent authority. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 37, Art. 58 – 74, Subordinate Act

• Entities shall notify the competent CSIRT of significant incidents by providing: ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours plus an initial assessment of the impact, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the national CSIRT (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. Reporting requirements under Art. 65 Subordinate Act ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 86, 101, 102, 103

• From 10,000 to 10,000.000 EUR or from 0,5% to 2% of the total worldwide annual turnover (essential entities: legal entities). ecs-org.eu · 28 Oct 2026 · secondary source
• From 1,000 to 6,000 EUR (essential entities: persons responsible for the management of measures). ecs-org.eu · 28 Oct 2026 · secondary source
• From 5,000 to 7,000.000 EUR or from 0,2% to 1,4% of the total worldwide annual turnover (important entities: legal entities). ecs-org.eu · 28 Oct 2026 · secondary source
• From 500 to 3,000 EUR (important entities: persons responsible for the management of measures). ecs-org.eu · 28 Oct 2026 · secondary source
• From 2,000 to 20,000 EUR (not providing information requested for purposes of categorising entities). ecs-org.eu · 28 Oct 2026 · secondary source
• From 200 to 1,000 EUR (persons acting as legal representatives of the entity). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines

• ISO 27001 ecs-org.eu · 28 Oct 2026 · secondary source
• ISO 27002 ecs-org.eu · 28 Oct 2026 · secondary source
• Croatia enforces a tiered risk assessment model based on entity classification (low, medium, high). Entities must align controls with risk levels, covering IT/OT systems, sector-specific assets, and third-party dependencies. Essential entities are audited every two years, while important entities must conduct self-assessments. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Primary Law · Implementing Act

What changed recently

No dated changes recorded.