Croatia NIS2 Transposition

National implementation through the Cybersecurity Act 2024. Covers energy, transport, banking, health, and digital infrastructure. Supervised by the Security and Intelligence Agency.

JurisdictionCroatia
CategoryCybersecurity
StatusActive
Latest development

Analysis

Croatia has transposed NIS2 through the Cybersecurity Act (NN 14/2024) and a detailed Cybersecurity Regulation (NN 135/2024), creating one of the EU’s more prescriptive national NIS2 regimes for sectors including energy, transport, banking, health and digital infrastructure, coordinated by the Security and Intelligence Agency (SOA) / NCSC‑HR.1359

Key Requirements

  • Scope and covered entities (essential & important entities)
  • The Cybersecurity Act (Zakon o kibernetičkoj sigurnosti, NN 14/2024) explicitly transposes Directive (EU) 2022/2555 (NIS2) into Croatian law and defines essential and important entities across all NIS2 sectors plus national additions.512
  • Croatia applies size‑based thresholds for classification (e.g. essential ≥ 250 employees or €50m turnover; important ≥ 50 employees or €10m turnover).67
  • Risk management and technical‑organizational security measures
  • The Act requires entities to implement “appropriate and proportionate technical, operational and organizational measures” to manage cybersecurity risks, aligned with NIS2 Articles 21–23 (e.g. risk analysis, incident handling, business continuity, supply‑chain security, policies for cryptography and secure development).512
  • The Cybersecurity Regulation (Uredba o kibernetičkoj sigurnosti, NN 135/2024) introduces a three‑tier risk classification (Low/Medium/High) and prescriptive controls (e.g. password length minimums; specific network security and logging requirements).798
  • Incident reporting obligations and timelines
  • Entities must report significant incidents via the national portal (JISKB) with NIS2‑style deadlines: initial alert within 24 hours, status update within 72 hours, and a final report within 30 days.659
  • Reporting channels are split: National CERT (within CARNET) for private‑sector and many critical industries, and NCSC‑HR (within SOA) for state bodies and public authorities, as specified in Article 16 of the Cybersecurity Act.913
  • Governance, management accountability, and board‑level oversight
  • The Act introduces personal liability for executives, requiring board‑level approval of cybersecurity strategies, and allowing temporary disqualification of management in case of repeated or serious negligence.675
  • Entities must designate clear cybersecurity governance responsibilities, including risk ownership and decision‑making processes.79
  • Supervision, enforcement and sanctions
  • The Security and Intelligence Agency (SOA), hosting NCSC‑HR, acts as the central cybersecurity authority and coordinates NIS2 implementation and supervision.318
  • Administrative fines mirror NIS2 levels: up to €10 million or 2% global turnover for essential entities, and up to €7 million or 1.4% for important entities, plus management‑level sanctions.675
  • Sector coverage, including energy, transport, banking, health, digital infrastructure
  • Croatia’s Act and Regulation apply to all core NIS2 sectors, explicitly including energy, transport, banking, financial market infrastructure, health, and digital infrastructure, as well as additional domestic sectors (e.g. education, local government).1279

Compliance Challenges

  • Broad scope and identification of in‑scope entities
  • The number of regulated organizations expanded from roughly 1,000 to 8,000–10,000, creating challenges around identifying obligation status, especially for medium‑sized operators in sectors like transport and health.623
  • Competent authorities planned to notify entities of their classification by April 2025, leading to uncertainty for organizations awaiting official notification.38
  • Prescriptive technical requirements and resource constraints
  • The Regulation’s detailed controls (e.g. multi‑level password policies, specific logging and monitoring requirements, risk‑tiered measures) have been highlighted by practitioners as resource‑intensive for smaller “important” entities.796
  • Industry commentary notes that many organizations in health and transport lack dedicated cybersecurity teams, making compliance with continuous risk assessment and incident response requirements challenging.692
  • Incident reporting and operational readiness
  • Organizations have struggled with setting up reporting workflows capable of meeting the 24h / 72h / 30‑day deadlines while ensuring data accuracy and cross‑border coordination.695
  • Example: sector‑wide exercises described in NCSC‑HR and ITU material show energy and telecom operators testing crisis‑management processes to align with the National Cyber Crisis Management Programme, revealing gaps in communication chains.281
  • Management accountability and cultural change
  • The introduction of personal liability for executives and mandatory board‑level oversight has required a shift in governance culture, especially in traditional industries like energy and transport where cybersecurity was previously delegated to IT.679
  • Reports from consultancy guides emphasize board education and cross‑functional coordination as recurring pain points.769

Implementation Best Practices

  • Perform a structured NIS2 gap assessment aligned to Croatian Act & Regulation
  • Organizations should start with a formal risk assessment and gap analysis against the 13 security measure areas and risk‑tier requirements defined in the Regulation NN 135/2024.795
  • Several Croatian‑focused implementation guides provide step‑by‑step gap‑analysis templates and checklists.796
  • Establish governance: board‑approved cybersecurity strategy and roles
  • Implement a board‑approved cybersecurity strategy that explicitly references obligations under NN 14/2024 and NN 135/2024, including risk appetite, incident reporting, and supply‑chain controls.576
  • Assign clear responsibility (CISO or equivalent) and an internal cybersecurity steering committee to oversee implementation and interactions with NCSC‑HR and National CERT.913
  • Implement and test incident response and reporting processes
  • Develop an incident response plan that integrates the JISKB portal reporting timelines and the correct reporting authority (National CERT vs NCSC‑HR) for each system.965
  • Regularly conduct tabletop exercises and simulations to validate communication chains and crisis‑management procedures, aligned with the National Cyber Crisis Management Programme.281
  • Leverage reference frameworks and tools
  • Map Croatian NIS2 obligations to international frameworks such as ISO/IEC 27001, ISO/IEC 27019 (energy), and NIST Cybersecurity Framework, which are commonly referenced in implementation guidance to structure controls.769
  • Use specialized NIS2 compliance tools and audit templates provided by Croatian and EU‑level providers (e.g. sector‑specific checklists for energy and health) to track control implementation and evidence.762

Recent Updates

  • Entry into force of the Cybersecurity Act (NN 14/2024)
  • The Cybersecurity Act was passed by Parliament on 26 January 2024, promulgated in the Official Gazette 14/2024, and entered into force on 15 February 2024, formally transposing NIS2.157
  • Cybersecurity Regulation (NN 135/2024) – technical details & phased applicability
  • The Cybersecurity Regulation (NN 135/2024) was adopted on 21 November 2024 and entered into force on 30 November 2024, with some articles deferred to 1 January 2026, setting detailed technical requirements and categorization procedures.379
  • According to implementation guides, entities must implement initial cybersecurity measures under NN 135/2024 by 4 April 2026, reflecting transitional provisions for full technical compliance.73[8

Recent developments

  • — Presentation "NIS2 in Croatia" at RIPE NCC on 21 April 2026 outlines the operational implementation of the Cybersecurity Act, confirming SOA/NCSC‑HR as the national cybersecurity authority and detailing oversight and coordination mechanisms for NIS2-covered entities.[9] (source)
  • — Update notes that Croatia has completed NIS2 transposition early via the Cybersecurity Act, with a significant expansion of regulated entities (estimated 8,000–10,000 organizations) and highlights challenges around compliance readiness among newly in-scope sectors.[1] (source)
  • — Industry-focused 2026 compliance guide stresses that NIS2 obligations in Croatia are already fully in force, explains steep fines (up to €10m or 2% of global turnover) and personal liability for management, and provides practical impact and reaction from Croatian businesses on incident reporting and risk management duties.[10] (source)
  • — Government of Croatia adopts the Regulation on Cybersecurity (Official Gazette 135/24) under Article 24 of the Cybersecurity Act, specifying detailed technical requirements and categorization procedures for NIS2 entities and operationalizing the 2024 legislative transposition.[3] (source)
  • — Analysis of the November 2024 Regulation on Cybersecurity describes transition periods of up to nine months, the plan to notify entities of their status by April 2025, and audit/self-assessment regimes, highlighting how these rules impact essential and important entities and extend scope beyond NIS2 (e.g. education, e‑invoice intermediaries).[5] (source)
  • — Industry tracker reports that Croatian competent authorities began categorizing essential and important entities in late 2024, with completion and notification targeted for April 2025, triggering one‑year compliance deadlines and prompting intensified preparation among affected organizations.[5] (source)
  • — European Commission’s NIS2 implementation page confirms Croatia’s status as “Transposed”, lists the Office of the National Security Council as single point of contact and sectoral competent authorities, and reflects EU-level recognition of Croatia’s completed NIS2 transposition and governance structure.[4] (source)
  • — NCSC‑HR update reiterates that the Cybersecurity Act (in force since 15 February 2024) transposes NIS2 and outlines national structures and processes for risk management and incident reporting, shaping how Croatian cybersecurity and digital service industries organize compliance.[3] (source)
  • — Announcement of the enactment of the Regulation on Cybersecurity (Official Gazette 135/24) provides granular rules for implementing the Cybersecurity Act, clarifying obligations for thousands of newly covered entities and prompting industry compliance programs across critical and digital sectors.[3] (source)
  • — Entry into force of the Cybersecurity Act (Official Gazette 14/24) formally transposes NIS2 in Croatia, replaces the previous NIS framework, and immediately brings a wide range of operators and service providers under stricter cybersecurity risk management and incident reporting requirements, driving strong reaction and readiness efforts in the cybersecurity industry.[3] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates