Operates a social platform, in Croatia

Copyright and Related Rights Act (Zakon o autorskom pravu i srodnim pravima, Narodne novine 111/2021, br. 1941), Articles 50 to 53 · Read the law's page

• Obtain the author's authorization for giving the public access to works your users upload, or be able to prove the conditions that avoid liability: best efforts to obtain authorization, best efforts to keep unavailable the works for which authors gave you relevant and necessary information, and prompt action on a sufficiently substantiated notice, with best efforts to prevent re-upload.
• If your service has been available in the European Union for under three years and your annual turnover is under EUR 10 million, show only best efforts to obtain authorization and prompt action on a substantiated notice; once your average monthly users exceed five million, also show best efforts to prevent further uploads of reported works.
• On an author's request, give adequate information on how your practices work, and, if you have a contract with the author, information on the use of the works it covers.
• Do not let cooperation with authors make unavailable user-uploaded works that infringe no copyright, tell users in your terms and conditions about the permitted uses under the copyright exceptions, and do not identify individual users or process their personal data except as the data protection rules allow.
• Set up effective and expeditious complaint and redress procedures for users, resolve complaints immediately on receipt, and have a person review each decision to disable access to or remove an uploaded work.

Zakon o elektronickim medijima, Narodne novine 111/2021, cl. 24, 96 · Read the law's page

• Applies to providers of audiovisual media services, radio programmes and electronic publications (Article 24) and to video-sharing platform providers under Croatian jurisdiction (Article 96).
• Do not publish content likely to seriously harm a minor's physical, mental or moral development.
• Publish content that could harm that development only if scheduling, age-verification tools or another technical measure ensures that minors within its reach will not ordinarily see or hear it.
• Video-sharing platforms: take appropriate measures to protect minors from user-generated video and audiovisual commercial communications that could harm their physical, mental or moral development.
• For the content causing the greatest harm, those measures include, among others, an age-verification system for platform users, flagging and reporting mechanisms, a way for users to declare whether uploaded videos contain audiovisual commercial communications, and easy-to-use content-rating tools.

Zakon o kibernetičkoj sigurnosti, Narodne novine, broj 14/2024, čl. 29. i 30. · Read the law's page

• Take risk-management measures sized to your exposure, covering at minimum: risk-analysis and information-system-security policies, incident-handling procedures (monitoring, logging and reporting), business continuity including backup management and disaster recovery, supply-chain security accounting for your direct suppliers' and service providers' vulnerabilities, security in the acquisition, development and maintenance of your systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of your own measures, basic cyber-hygiene practices and training, cryptography and encryption policies, human-resources security and access control including asset inventories, and, where appropriate, multi-factor or continuous authentication and secured communications.
• Have the members of your management body, or, if you are a public entity, the heads of your state administration or local self-government body, approve these measures and control their implementation, and have them attend, and make available to your staff, appropriate cybersecurity training covering risk-management issues and their effect on your services.
• This binds you where you are an essential or important entity designated under the Cybersecurity Act, whose Annex III lists providers of digital services as a sector and whose definitions clause names a provider of an online marketplace, an online search engine, or a social networking services platform expressly; you become an important entity at the general medium-enterprise-or-larger size threshold Article 10 applies to Annex II entities. The wider sector classes the Act also reaches (energy, transport, banking, health, drinking water, digital infrastructure, public administration, manufacturing, research, education and others) are reached too where you meet the Article 9 or 10 criteria for them; the competent authority categorizes you and notifies you of your category and your obligations (Articles 17(1) and 19(1)).

Zakon o kibernetičkoj sigurnosti, Narodne novine, broj 14/2024, čl. 37.-44.; Uredba o kibernetičkoj sigurnosti, Narodne novine, broj 135/2024, čl. 64.-71. i 85. · Read the law's page

• Notify the competent CSIRT of every significant incident on this clock, set by the Cybersecurity Regulation rather than the Act itself: an early warning without delay and no later than 24 hours after becoming aware of it (24 hours also for a trust service provider's initial notification), an initial notification no later than 72 hours otherwise, an interim report if the CSIRT requests one, and a final report no later than 30 days after your initial notification, or, if the incident is still unresolved at that point, a progress report instead, repeated every 30 days once the incident has run past 60 days, followed by a final report within 30 days of your last progress report.
• Submit an interim report to the CSIRT when it requests one, within the period the CSIRT sets, of no less than 48 hours and no more than seven days from receipt of the request.
• Notify the recipients of your service, without delay and no later than 72 hours after you become aware of a significant incident likely to affect them, in a clear and easily verifiable way, and send them any details that were not yet known within 72 hours of sending that notice. Separately notify them of a serious cyber threat and of any protective measures or remedies they can take.
• Same fine tiers and misdemeanor-prosecution mechanism as this jurisdiction's companion risk-management-and-governance row: EUR 10,000 to EUR 10,000,000 or 0.5 to 2 percent of worldwide turnover for an essential entity, EUR 5,000 to EUR 7,000,000 or 0.2 to 1.4 percent for an important entity, whichever amount is higher, enforced either by a misdemeanor order the competent authority issues itself or by referral to the state attorney for misdemeanor prosecution.
• This binds you where you are an essential or important entity designated under the Cybersecurity Act, whose Annex III lists providers of digital services as a sector and whose definitions clause names a provider of an online marketplace, an online search engine, or a social networking services platform expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management-and-governance row.
• If you are newly categorized as an essential or important entity, you have 30 days from the date you receive your Article 19(1) categorization notice before these notification duties bind you.

Act on the Implementation of the Digital Services Act (Zakon o provedbi Uredbe (EU) 2022/2065, Narodne novine 67/2025, br. 857), Articles 4 to 26 · Read the law's page

• Act without delay on an order to act against illegal content (Article 9 of Regulation (EU) 2022/2065) or an order to provide information (Article 10), tell the issuing authority without delay that you have carried it out and when, and give the affected recipient the information Article 9(5) requires.
• Designate a point of contact for authorities and one for recipients of your service, and appoint a legal representative if you are not established in the European Union (Articles 11 to 13 of the Regulation).
• Meet the terms and conditions, transparency reporting, notice and action and statement of reasons duties of Articles 14 to 17 of the Regulation, which the Act punishes as misdemeanors.
• If you run an online platform, set up an internal complaint-handling system, take measures against misuse, and meet the transparency reporting, interface design, advertising, recommender system and protection of minors duties of Articles 20 and 23 to 28 of the Regulation.
• If your online platform lets consumers conclude distance contracts with traders, meet the trader traceability, interface design and consumer information duties of Articles 30 to 32 of the Regulation.
• If you are established in Croatia, notify the Coordinator that you provide intermediary services within three months of the Coordinator publishing how to notify; the notification is not a condition for providing the service.

Zakon o provedbi Uredbe (EU) 2024/1083 o uspostavi zajedničkog okvira za medijske usluge na unutarnjem tržištu i izmjeni Direktive 2010/13/EU (Europski akt o slobodi medija), čl. 23 · Read the law's page

• If you are a media service provider, a provider of an electronic publication or a video-sharing platform, label content you publish that has been generated in any way by artificial intelligence (Article 23).

Zakon o izmjenama i dopunama Zakona o obveznim odnosima · Read the law's page

• These rules are enacted but do not apply yet: they do not apply to products placed on the market or put into service before 9 December 2026, and Articles 1073 to 1080 now in force keep governing those products (Arts. 21(2) and 22 of the amending Act).
• If you develop or make a product, software included, or present yourself as its manufacturer by your name, trade mark or other distinguishing feature, you answer for damage a defect in it causes (Arts. 1072.a points 1 and 11, 1073(1) and 1076(1)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control: a defect caused by software, by an update or upgrade, or by a missing update needed to maintain safety is not excused because it arose after you placed the product on the market (Arts. 1072.a point 5 and 1078(2)).
• Treat safety-relevant cybersecurity requirements and any recall as part of what decides whether your product is defective (Art. 1075(2) points 6 and 7).
• Allow for what the product learns or acquires after it is placed on the market, because the effect of that ability is weighed in deciding whether it is defective (Art. 1075(2) point 3).
• Keep evidence you could produce if a court orders you to disclose it: failing to disclose presumes the product defective (Arts. 1074(2) point 1 and 1074.a(1)).
• If you are outside the EU, the importer, your authorized representative or, failing both, the fulfilment service provider answers for the product in your place (Art. 1076(1) point 3).
• If you distribute a product, or run an online platform that lets consumers contract with traders, name the liable operator established in the EU or your own supplier within one month of the injured person's request, or you answer for the damage (Art. 1076(4) and (5)).
• If you substantially modify a product outside the manufacturer's control and then make it available on the market or put it into service, you answer as its manufacturer (Art. 1076(3)).
• If you build a software component into a product, you have no recourse against the maker of a defective software component that was a micro or small enterprise, or where you waived recourse by contract (Art. 1077.a).
• Do not rely on a contract term to limit or exclude liability to the injured person in advance; such a term is void (Art. 1079).
• Free and open-source software developed or supplied outside a business activity is outside these rules (Art. 1073(5)).
• A claim is time-barred three years after the injured person learned, or should have learned, of the damage, the defect and the identity of the economic operator, and the right to compensation is extinguished ten years after the product was placed on the market or put into service, or 25 years for a latent bodily injury (Art. 1080).