NIS2 in Croatia

The law

The Act took effect 8 days after publication on 2024-02-07, so on 2024-02-15. The Government Regulation on Cybersecurity (NN 135/2024) adds the detail rules. It took effect 8 days after publication on 2024-11-22.

Name

Zakon o kibernetičkoj sigurnosti (NN 14/2024)Cybersecurity Act

Published

2024-02-07

In force

2024-02-15

Text

Read the Cybersecurity Act

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Croatia differs

• Art. 15(1) Cybersecurity Act The size test uses the average number of staff of the entity and its revenue, assets or fixed assets from the last financial statements. The Act refers to the Croatian small business law for the size classes.
• Art. 9 Cybersecurity Act Information intermediaries in B2B e-invoicing are essential entities at any size. The Directive has no such rule.
• Art. 11 Cybersecurity Act The authority can categorise an entity of any size as essential or important in the cases of Article 11. It decides on the entity.

Also note

• A national risk assessment gives each entity 1 of 3 levels of measures: basic, medium or advanced.
• The Act lists essential entities in Art. 9 and important entities in Art. 10.
• The central body is the Security and Intelligence Agency. Other authorities supervise some sectors, such as banking, aviation and electronic communications.

Registration

Croatia has no self-registration step. The Act is in force and the competent authority categorises each entity itself. The authority enters the entity on the list of essential or important entities (Art. 17). It sends the entity a notice of the category within 30 days (Art. 19). The entity sends its data when the authority asks. The deadline is 15-45 days from the request. An entity can also send the data on its own, and this counts the same as an answer to a request. The authorities had 1 year from the entry into force to finish the first categorisation, so until 2025-02-15. Later duties run from the notice.

Portal

Electronic data submission to the competent authority

Rule

The authority names the entities. There is no self-registration

You need

A contact person from the management body. Name this person and at least 2 authorised persons within 8 days of the request.

Changes

Report changes to your data within 14 days

Incident reporting

1. 24 hEarly warning
2. 72 hIncident notification
3. 30 daysFinal reportafter the notification

Send the reports to the competent CSIRT, through the national platform run by CARNET.

Trust service providers send the initial notification within 24 hours. The duty to report starts 30 days after the notice of the category.

Measures and proof

Essential

An essential entity runs a cybersecurity audit at least every 2 years. A certified cybersecurity auditor does the audit and the entity pays. The entity sends the report to the authority within 8 days. The authority supervises each essential entity once every 3-5 years.

Important

An important entity runs a self-assessment at least every 2 years and sends a declaration or action plan within 8 days. The authority can order an audit. It supervises only when it has indications of a breach.

The dates, in order

1. 2024-02-15 The Act takes effect (8 days after publication)Derived from a rule in the law
2. 2024-11-30 The Regulation takes effect (8 days after publication)Derived from a rule in the law
3. 2025-02-15 Authorities finish the first categorisation (1 year after the Act)Derived from a rule in the law

Duties of management

Members of the management body are responsible for the risk measures. They approve the measures and check how the entity applies them. They must take training and give training to staff. The responsible persons can pay a personal fine. For an essential entity, the authority can ask for a temporary ban on their management duties.

Fines

The ceiling is the higher of a fixed amount and a share of the annual turnover of the entity itself.

The Act sets a range with a floor. Essential entities pay EUR 10,000 to 10,000,000 or 0.5-2%. Important entities pay EUR 5,000 to 7,000,000 or 0.2-1.4%. The higher amount applies. The % applies to the turnover of the entity concerned. The responsible person can also pay EUR 1,000-6,000 (essential) or EUR 500-3,000 (important). Failure to send data costs EUR 2,000-20,000.