Makes insurance decisions, in Croatia

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 · Read the law's page

• Give a person in Croatia a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.
• Do not subject a person in Croatia to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
• Do not base a solely automated decision with legal or similarly significant effects on a person in Croatia on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).
• If you make solely automated decisions about a person in Croatia of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Zakon o izmjenama i dopunama Kaznenog zakona, Narodne novine 136/2025, cl. 11, novi Kazneni zakon cl. 215a · Read the law's page

• Do not develop, test, verify, oversee, manage, or otherwise use an artificial intelligence system in a way that creates a danger to a person's life or body, or to property on a large scale, in Croatia. This is a criminal offence.

Regulation (EU) 2024/1689, Arts. 5, 50 — directly applicable in Croatia as EU Member State

• Do not place on the market, put into service, or use an AI system for social scoring.
• Do not use real-time remote biometric identification in publicly accessible spaces for law enforcement, except within narrow exceptions.when it serves a public body
• Tell users before or at the start of an interaction that they are communicating with an AI chatbot or voice assistant.
• Mark generated images, video, audio and text output with machine-readable watermarks or metadata identifying them as artificially generated.

Zakon o izmjenama i dopunama Zakona o obveznim odnosima · Read the law's page

• These rules are enacted but do not apply yet: they do not apply to products placed on the market or put into service before 9 December 2026, and Articles 1073 to 1080 now in force keep governing those products (Arts. 21(2) and 22 of the amending Act).
• If you develop or make a product, software included, or present yourself as its manufacturer by your name, trade mark or other distinguishing feature, you answer for damage a defect in it causes (Arts. 1072.a points 1 and 11, 1073(1) and 1076(1)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control: a defect caused by software, by an update or upgrade, or by a missing update needed to maintain safety is not excused because it arose after you placed the product on the market (Arts. 1072.a point 5 and 1078(2)).
• Treat safety-relevant cybersecurity requirements and any recall as part of what decides whether your product is defective (Art. 1075(2) points 6 and 7).
• Allow for what the product learns or acquires after it is placed on the market, because the effect of that ability is weighed in deciding whether it is defective (Art. 1075(2) point 3).
• Keep evidence you could produce if a court orders you to disclose it: failing to disclose presumes the product defective (Arts. 1074(2) point 1 and 1074.a(1)).
• If you are outside the EU, the importer, your authorized representative or, failing both, the fulfilment service provider answers for the product in your place (Art. 1076(1) point 3).
• If you distribute a product, or run an online platform that lets consumers contract with traders, name the liable operator established in the EU or your own supplier within one month of the injured person's request, or you answer for the damage (Art. 1076(4) and (5)).
• If you substantially modify a product outside the manufacturer's control and then make it available on the market or put it into service, you answer as its manufacturer (Art. 1076(3)).
• If you build a software component into a product, you have no recourse against the maker of a defective software component that was a micro or small enterprise, or where you waived recourse by contract (Art. 1077.a).
• Do not rely on a contract term to limit or exclude liability to the injured person in advance; such a term is void (Art. 1079).
• Free and open-source software developed or supplied outside a business activity is outside these rules (Art. 1073(5)).
• A claim is time-barred three years after the injured person learned, or should have learned, of the damage, the defect and the identity of the economic operator, and the right to compensation is extinguished ten years after the product was placed on the market or put into service, or 25 years for a latent bodily injury (Art. 1080).