Croatia

Article 215a of the Kazneni zakon (Criminal Code), inserted by the Act of 24 October 2025 amending the Criminal Code, criminalises developing, testing, verifying, overseeing, managing or otherwise using an artificial intelligence system in a way that creates a danger to a person's life or body, or to property on a large scale, where the conduct does not amount to a more serious offence.

The amending Act defines an artificial intelligence system in the same terms as the EU AI Act: a machine-based system of varying levels of autonomy that, from the input it receives, infers how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

Intentional commission carries six months to five years' imprisonment and negligent commission up to three years; where the offence causes serious bodily injury or property damage of a large scale the ranges rise to one to ten years and six months to five years respectively, and where it causes one or more deaths they rise to three to fifteen years and one to eight years respectively.

Croatia regulates biometric processing by sector rather than a single undifferentiated rule, read verbatim from the gazette text. Article 21 permits public-authority biometric processing only where provided by law and necessary to protect persons, property, classified data, or business secrets, or to fulfil international border-crossing identification obligations.

Article 22 permits private-sector biometric processing where prescribed by law or necessary for those same protective purposes, or for the individual, secure identification of service users, with the last purpose requiring the data subject's explicit General Data Protection Regulation (GDPR)-compliant consent as its legal basis; the other Article 22(1) grounds do not require consent on this reading.

Article 23 permits employee biometric processing for recording working time or entry to and exit from official premises where prescribed by law, or as an alternative to another solution for the same purpose, on condition the employee has given explicit consent.

A controller must notify AZOP within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. Two commentary sources confirm no Croatian-specific derogation.

Croatia gives the General Data Protection Regulation (GDPR) domestic effect through the Act on the Implementation of the General Data Protection Regulation, Narodne novine 42/18, enacted 27 April 2018 and effective 25 May 2018, read in full (73,116 characters, not truncated). AZOP (Agencija za zastitu osobnih podataka) is the supervisory authority.

The cited text is the as-promulgated 2018 gazette issue rather than a consolidated text; no pročišćeni tekst (consolidated version) has been located, so whether the Act has been amended since 2018 is not established.

A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier. Two commentary sources independently confirm no further Croatian addition beyond the General Data Protection Regulation (GDPR) baseline.

Individuals in Croatia have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. Croatia's implementation act adds no Croatia-specific exemptions or extensions to Article 22 beyond what the General Data Protection Regulation (GDPR) itself provides.

Agencija za zastitu osobnih podataka (AZOP) is Croatia's supervisory authority, entitled to impose administrative fines in line with General Data Protection Regulation (GDPR) Article 83, with no Croatian-specific enforcement addition found. GDPR Article 82 arms an individual with a direct private right of action; no distinct Croatian civil remedy or collective-redress addition was found.

Chapter XXV of the Kazneni zakon (Criminal Code) creates the criminal offences against computer systems, programs and data. Article 266 punishes unauthorised access to a computer system, part of one, or computer data, with a higher penalty where the target is a government body, the Constitutional Court, an international organisation Croatia belongs to, a local or regional government unit, a public institution, or a company of special public interest.

Article 267 punishes disabling or hindering a computer system's operation or use, or computer communication. Article 268 punishes unauthorised damage, alteration, deletion, destruction or concealment of another's computer data or programs, or blocking access to them. Article 269 punishes unauthorised interception of a non-public transmission of computer data.

Article 270 punishes computer forgery: unauthorised creation, entry, alteration, deletion or suppression of computer data with legal significance, intending it be used as genuine. Article 271 punishes computer fraud committed to obtain an unlawful material gain by manipulating computer data or a computer system's operation, with a higher penalty where a substantial gain or loss results.

Article 272 punishes making, acquiring, distributing or making available a device, program or data created or adapted to commit any of these offences, or a password or access code for the same purpose.

Article 273 raises the penalty for Articles 267 to 270 where the target is a government body, the Constitutional Court, an international organisation Croatia belongs to, a local or regional government unit, a public institution, or a company of special public interest, and for Articles 266 to 269 where the offender conceals their real identity and causes confusion about the authorised holder of that identity; it raises the penalty further, to one to eight years' imprisonment, for an offence under Articles 267 to 269 committed by a means intended to carry out an attack on a larger number of computer systems, or that causes significant damage.

Croatia's Copyright and Related Rights Act creates two text-and-data-mining exceptions transposing the EU Digital Single Market Copyright Directive. Article 187 lets a research organisation or cultural heritage institution reproduce and extract from copyrighted works and databases for scientific-research text-and-data-mining without a rightsholder's authorisation or payment, and a rightsholder cannot override this by contract.

Article 188 extends the same freedom to text-and-data-mining for other purposes, including AI training, but only where the rightsholder has not expressly reserved their rights in an appropriate manner; for a work made available online, the only appropriate reservation is a machine-readable means that includes metadata.

Article 30 of the Cybersecurity Act requires every essential and important entity to take risk-management measures covering, at minimum, risk-analysis and information-system-security policies, incident-handling procedures including monitoring, logging and reporting, business continuity such as backup management and disaster recovery and cybersecurity-crisis management, supply-chain security including the vulnerabilities and security practices of direct suppliers and service providers, security in the acquisition, development and maintenance of network and information systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of the entity's own risk-management measures, basic cyber-hygiene practices and cybersecurity training, cryptography and, where appropriate, encryption policies, human-resources security and access-control policies and asset management including regular inventory updates, and, where appropriate, multi-factor or continuous authentication, secured voice, video and text communications, and secure emergency communication systems.

Article 29 makes the members of an essential or important entity's management body, or the heads of the relevant state administration body, other state body, or local and regional self-government executive body for a public entity, responsible for implementing these measures: they must approve the risk-management measures the entity applies and control their implementation, and they must themselves attend appropriate training on risk-management issues and its effect on the entity's services, and make the same training available to the entity's staff.

Both articles transpose NIS2 Articles 21 and 20 respectively. Annex II (Prilog II, Other Critical Sectors) lists 'providers of digital services' at item 21. The Act's own definitions clause names a provider of an online marketplace, an online search engine, or a social networking services platform among the digital service providers it reaches.

Article 37 of the Cybersecurity Act requires every essential and important entity to notify the competent CSIRT of every incident with a significant effect on the availability, integrity, confidentiality or authenticity of data material to the entity's business or on the continuity of the services it provides (a significant incident), and Article 38 requires it to notify the recipients of its services of a significant incident likely to affect them and, on a serious cyber threat, of protective measures or remedies those recipients can take.

Neither article states the notification clock itself: Article 44 delegates the criteria for a significant incident, the type and content of every notification under Articles 37 to 40, and the deadlines for their submission to the implementing regulation Article 24 authorizes. That regulation, the Cybersecurity Regulation (Narodne novine No. 135/2024), sets the clock in its Articles 64 to 71.

An early warning to the competent CSIRT is due without delay and no later than 24 hours after becoming aware of a significant incident (Article 66). An initial notification is due no later than 72 hours (Article 67), or 24 hours instead for a trust service provider (Article 68). An interim report is due on the CSIRT's request, within a period the CSIRT sets of 48 hours to 7 days (Article 69).

A final report is due no later than 30 days after the initial notification (Article 70), or, where the incident is still ongoing at that point, a progress report in its place, repeated every 30 days once the incident has run past 60 days, followed by a final report within 30 days of the last progress report (Article 71).

The Regulation's Article 85 sets a parallel 72-hour clock, running from the entity's own awareness of the incident, for notifying affected service recipients under the Act's Article 38. Article 37(4) and Article 38(3) of the Act each separately give a newly categorized entity 30 days from the date it receives its Article 19(1) categorization notice before these notification duties bind it, a grace period distinct from the per-incident clock the Regulation sets.

The same Chapter Nine penalty structure documented on this jurisdiction's companion risk-management-and-governance row applies to a reporting failure: an essential entity's fine of EUR 10,000 to EUR 10,000,000 or 0.5 to 2 percent of worldwide turnover, an important entity's fine of EUR 5,000 to EUR 7,000,000 or 0.2 to 1.4 percent, whichever is higher in each case, referred by the competent authority to the competent state attorney for misdemeanor prosecution rather than imposed directly.

Article 24 forbids publishing audiovisual media service, radio programme, or electronic publication content likely to seriously harm a minor's physical, mental or moral development, and forbids publishing content that could harm that development at all unless the provider secures, through scheduling, age-verification tools, or another technical measure, that minors within the transmission's reach will not ordinarily see or hear it.

Article 96 requires a provider of a video-sharing platform under Croatian jurisdiction to take appropriate measures protecting minors from user-generated video and audiovisual commercial communications that could harm their physical, mental or moral development; for content causing the greatest harm, those measures include, among others, establishing and applying an age-verification system for platform users, alongside flagging and reporting mechanisms, functionality for users to declare whether their uploaded videos contain audiovisual commercial communications, and easy-to-use content-rating tools.

A publisher of information publications established in the EU holds exclusive reproduction, distribution, communication-to-the-public and adaptation rights over its information publications against ordinary users, per Article 165, and a separate exclusive reproduction and communication-to-the-public right specifically against an information-society service provider's online use, per Article 166.

Article 166(3) exempts an individual user's private and non-commercial use, hyperlinking, and the use of individual words or very short extracts of no more than a few words that carry no photograph or video and do not affect the effectiveness of the exclusive rights.

The Article 165 right against ordinary users lasts ten years from the information publication's first lawful publication, and the Article 166 right against information-society service providers lasts two years from the same event, per Article 171.