Is a lender, in Croatia

čl. 7, 14 i 19, Zakon o provedbi Uredbe (EU) 2022/2554 (NN 136/2024) · Read the law's page

• If you are a financial entity supervised by HANFA or the Croatian National Bank under Article 8 of the Act, report each significant ICT incident to HANFA (or to the Croatian National Bank, for the entities it supervises) and to the CSIRT (Article 14).when it serves a financial business
• Make those reports through the national platform for cyber threats and incidents set up under the cybersecurity law (Article 15).when it serves a financial business
• Set up the internal governance and control framework that ensures effective and prudent management of ICT risk, as DORA Article 5(1) requires (Article 19(1), item 1).for a financial business

NN 89/2025, čl. 3. st. 2. i 3., čl. 4., 6. st. 2., čl. 7., 15., 16. st. 3., 36. i 37. te Prilog I. odjeljci III. i IV. Zakona o zahtjevima za pristupačnost proizvoda i usluga · Read the law's page

• If you provide to consumers an electronic communications service (other than machine-to-machine transmission), a service giving access to audiovisual media services, the website, mobile service, app, electronic ticket, travel-information and interactive self-service terminal elements of air, bus, rail or waterborne passenger transport, a consumer banking service, e-books and dedicated software, or an e-commerce service, design and provide the service to meet the accessibility requirements of Annex I, sections III and IV (urban, suburban and regional transport: section IV only) (Art. 3(2), 6(2) and 15(1); implements Directive (EU) 2019/882, Art. 4(1) and (3) and Art. 13(1)).
• Make the products you use to provide the service accessible under Annex I, sections I and II; give information about how the service works and about the accessibility features of the products used and their interoperability with assistive devices, through more than one sensory channel, in an understandable and perceivable way, in text that can be turned into alternative formats, in suitable fonts with sufficient contrast, with a text alternative for non-text content; keep websites (including related web applications) and mobile services and apps consistently perceivable, operable, understandable and robust; and where you offer support services (help desks, call centers, technical support, relay services, training), give information on the accessibility of the service and its compatibility with assistive technologies through accessible means of communication (Annex I, section III, point (d), as corrected from 15 October 2026 by the Act published in Narodne novine 114/2026).
• For an electronic communications service, offer real-time text alongside voice, total conversation where video is offered with voice, and synchronized voice and text (with video where offered) in communications to emergency services, passed to the most appropriate emergency answering point (Annex I, section IV, point (a)).
• For a service giving access to audiovisual media services, provide electronic program guides that are perceivable, operable, understandable and robust and show whether accessibility is enabled, and transmit access services (subtitles for the deaf and hard of hearing, audio description, spoken subtitles, sign language interpretation) with appropriate quality, synchronized with sound and video, under the user's control (Annex I, section IV, point (b)).
• For air, bus, rail or waterborne passenger transport, give information on the accessibility of vehicles, surrounding infrastructure and built environment and on assistance for persons with disabilities, and information on smart ticketing, real-time travel information and additional service information such as staff at stations, lifts out of order and temporarily unavailable services (Annex I, section IV, point (c)); for urban, suburban and regional transport, make the self-service terminals accessible under section I (Annex I, section IV, point (d)).
• For a consumer banking service, provide electronic identification, electronic signature, secure element and payment-service methods that are perceivable, operable, understandable and robust, and keep information understandable and no more complex than level B2 of the Croatian language in the Common European Framework of Reference for Languages (Annex I, section IV, point (e)).
• For e-books and dedicated software, provide synchronized text and audio where an e-book has audio content, do not prevent assistive technology from working, give access to content, navigation and display with a flexible structure and choice of presentation, allow alternative presentations that work with different assistive technologies, make e-books findable through accessibility metadata, and do not let digital rights management block accessibility features (Annex I, section IV, point (f)).
• For an e-commerce service, give information on the accessibility of the products and services sold where the responsible operator supplies it, make identification, security and payment functions that are part of the service perceivable, operable, understandable and robust, and provide identification, electronic signature and payment-service methods that are perceivable, operable, understandable and robust (Annex I, section IV, point (g)).
• Prepare the information required by Annex V explaining how the service meets the accessibility requirements, state it in your general terms or an equivalent document, make it available to the public in written and oral form including in a manner accessible to persons with disabilities, and keep it for as long as the service is provided (Art. 15(2) and (3); implements Directive (EU) 2019/882, Art. 13(2)).
• Have a procedure that keeps the service in conformity, taking into account changes in the characteristics of the service, in the accessibility requirements, and in the harmonized standards or technical specifications on which conformity is based (Art. 15(4)).
• If the service does not conform, take the corrective measures needed and notify without delay the competent authorities of the Member States where the service is provided, with details of the non-conformity and the measures taken; on a reasoned request of the inspector, give all information needed to show conformity and cooperate on the measures taken (Art. 15(5) and 16(3)).
• The accessibility requirements apply only so far as compliance needs no fundamental alteration of the service and imposes no disproportionate burden; assess both against Annex VI, document the assessment and keep it for five years from the day the service was last provided, give the inspector a copy on request, repeat the burden assessment for each category or type of service when the service changes, when the inspector asks and at least every five years, and notify the authority of the Member State where the service is provided when you rely on the limit (Art. 17(1) to (4), (6) and (8)).
• A passenger transport service that meets the accessible-information and accessibility-information requirements of Regulations (EC) No 261/2004, (EC) No 1107/2006, (EU) 2021/782, (EU) No 1177/2010 and (EU) No 181/2011 and of the Croatian railway safety and interoperability law and the law establishing the agency for the investigation of air, maritime and rail accidents is treated as meeting the corresponding requirements of the Act, except where the Act sets an additional requirement (Art. 7; Directive (EU) 2019/882, Art. 5).
• The Act does not apply to micro entities of the small economy that provide services (Art. 4(2); Directive (EU) 2019/882, Art. 4(5)).
• The Act does not apply to pre-recorded time-based media and office file formats published before 28 June 2025, to online maps and mapping services where the key information is given in an accessible digital way for maps intended for navigation, to third-party content that you did not fund or develop and that is not under your control, or to archive content that is not updated or edited after 28 June 2025 (Art. 4(1)).
• Until 28 June 2030 you may keep providing your services with products you lawfully used for similar services before that date, service contracts concluded before 28 June 2025 may continue unchanged until they expire but for no more than five years from that date, and self-service terminals you lawfully used for services before 28 June 2025 may stay in use until the end of their economically useful life but for no more than twenty years after they entered use (Art. 37(1) to (3); Directive (EU) 2019/882, Art. 32).

Zakon o potrošačkim kreditima, Narodne novine 86/2026, čl. 24 i 30 · Read the law's page

• If you offer a consumer a personalised offer based on automated processing of personal data, tell the consumer so clearly and comprehensibly, in addition to your duties under Regulation (EU) 2016/679 (Article 24).when it serves a financial business
• If you are a creditor and your creditworthiness assessment involves automated processing of personal data, tell the consumer so in writing, and tell the consumer of the right to a human assessment (Article 30(1)).when it serves a financial business
• Give the consumer on request a clear and comprehensible explanation of the assessment, including the logic and risks of the automated processing and its significance and effects on the decision (Article 30(1), point 1).when it serves a financial business
• Let the consumer express a view, and give the consumer on request a review of the assessment and of the decision to grant credit (Article 30(1), points 2 and 3, and Article 30(2)).when it serves a financial business
• If you reject a credit application on the basis of the assessment, tell the consumer that the assessment rests on automated processing of personal data, and of the right to a human assessment and the procedure for contesting the decision (Article 30(3)).when it serves a financial business
• This Act takes effect on 20 November 2026 (Article 119), so the duties below do not bind before then.