In forceNIS2

NIS2 in Croatia

Croatia transposed NIS2 through the Zakon o kibernetičkoj sigurnosti. ZSIS coordinates the cybersecurity framework across all sectors.

Transposition law

Zakon o kibernetičkoj sigurnosti (Cybersecurity Act)

In force since

17 October 2024

Competent authority

Information Systems Security Bureau (ZSIS)

Max fine (Essential)

€10 million or 2% of global annual turnover

Max fine (Important)

€7 million or 1.4% of global annual turnover

Law adopted

15 February 2024

Key Deadlines

Law in force

15 February 2024

Full enforcement

17 October 2024

Competent Authority

Information Systems Security Bureau (ZSIS)

Central competent authority for NIS2 oversight

https://www.zsis.hr ↗

Croatia employs ZSIS to manage proactive audits and cross-sector cyber intelligence, with severe penalties for non-compliance starting immediately.

Registration Process

📊 Quick Test

Find out if your company is in scope

Does your organisation fall under Annex I (Essential) or Annex II (Important) entities?

Check NIS2 Scope →

Key Requirements

1Registration with ZSIS within designated timeframes
2Mandatory multi-layered infrastructure encryption
3Incident notification within 24 hours to the national CSIRT

National Additions

★Strong mandates for critical industrial automation networks (OT security)

★Public administration bodies are strictly supervised

FAQ: NIS2 in Croatia

Who is the primary CSIRT in Croatia?

The National CERT (cert.hr) managed under CARNET operates as the national point for incident triage.

Ready to assess your NIS2 compliance?

Use our free tools to check your NIS2 scope and run a gap assessment.

🎯 Scope Checker 📊 Gap Assessment

Currency and sources

The legal details on this page were last checked on 25 July 2026. Some details rest on a single secondary source and are not verified against the national authority or official journal. Confirm with the competent authority before relying on them for a compliance decision.