CroatiaKazneni zakon, Computer Crime Chapter (Arts. 266-273)
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access a computer system, part of one, or computer data in Croatia without authorisation; unauthorised access alone is a criminal offence, rising from up to two years' imprisonment to up to three years where the system or data belongs to a government body, the Constitutional Court, an international organisation Croatia belongs to, a local or regional government unit, a public institution, or a company of special public interest.NIST AI RMFMAP 4.1
- Do not interfere with the operation of a computer system, damage, alter, delete, destroy or conceal another person's computer data or programs, or intercept a non-public transmission of computer data, without authorisation; each is a separate criminal offence carrying up to three years' imprisonment.NIST AI RMFMAP 4.1
- Do not make, acquire, sell, possess, distribute or make available a device, computer program or computer data created or adapted to commit any of these offences; doing so is itself a criminal offence carrying up to three years' imprisonment, or up to two years for passwords, access codes or similar data.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Kazneni zakon Chapter XXV punishes unauthorised access to a computer system or computer data (Art. 266) with up to two years' imprisonment, rising to three years where the target is a government body, the Constitutional Court, an international organisation Croatia belongs to, a local or regional government unit, a public institution, or a company of special public interest. Interference with a computer system's operation (Art. 267), damage to computer data (Art. 268), unauthorised interception (Art. 269) and computer forgery (Art. 270) each carry up to three years' imprisonment. Computer fraud (Art. 271) carries six months to five years, rising to one to eight years where a substantial gain or loss results. Misuse of devices (Art. 272) carries up to three years for devices, programs or data, and up to two years for passwords or access codes made or distributed for the same purpose. Article 273 raises the penalty for Articles 267 to 270 to six months to five years where the target is a government body, the Constitutional Court, an international organisation Croatia belongs to, a local or regional government unit, a public institution, or a company of special public interest, and for Articles 266 to 269 to the same six months to five years where the offender conceals their real identity and causes confusion about the authorised holder of that identity; it rises further, to one to eight years, for an offence under Articles 267 to 269 committed by a means intended to attack a larger number of computer systems, or that causes significant damage.
Who enforces it
Settledness
- As of
- Open questions
- Does 'neovlašteno pristupi' (accesses without authorization) in Article 266(1) of the Kazneni zakon reach a crawler that requests a page the operator serves openly to the public, when the article has no security-measure element and no provision says an openly served page is authorized?
What it makes you log
Logging duty
Articles 266 to 273 define the offences of unauthorized access, interference with a computer system, damaging data, interception, computer forgery and fraud, misuse of devices and their aggravated forms. They impose no duty to create, keep, produce or review a log or record. Data produced by an offence is ordered destroyed as a consequence of conviction.
- Kind
- None
- As of
What this law does
Chapter XXV of the Kazneni zakon (Criminal Code) creates the criminal offences against computer systems, programs and data. Article 266 punishes unauthorised access to a computer system, part of one, or computer data, with a higher penalty where the target is a government body, the Constitutional Court, an international organisation Croatia belongs to, a local or regional government unit, a public institution, or a company of special public interest.
Article 267 punishes disabling or hindering a computer system's operation or use, or computer communication. Article 268 punishes unauthorised damage, alteration, deletion, destruction or concealment of another's computer data or programs, or blocking access to them. Article 269 punishes unauthorised interception of a non-public transmission of computer data.
Article 270 punishes computer forgery: unauthorised creation, entry, alteration, deletion or suppression of computer data with legal significance, intending it be used as genuine. Article 271 punishes computer fraud committed to obtain an unlawful material gain by manipulating computer data or a computer system's operation, with a higher penalty where a substantial gain or loss results.
Article 272 punishes making, acquiring, distributing or making available a device, program or data created or adapted to commit any of these offences, or a password or access code for the same purpose.
Article 273 raises the penalty for Articles 267 to 270 where the target is a government body, the Constitutional Court, an international organisation Croatia belongs to, a local or regional government unit, a public institution, or a company of special public interest, and for Articles 266 to 269 where the offender conceals their real identity and causes confusion about the authorised holder of that identity; it raises the penalty further, to one to eight years' imprisonment, for an offence under Articles 267 to 269 committed by a means intended to carry out an attack on a larger number of computer systems, or that causes significant damage.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .