Croatia

Article 215a of the Kazneni zakon (Criminal Code), inserted by the Act of 24 October 2025 amending the Criminal Code, criminalises developing, testing, verifying, overseeing, managing or otherwise using an artificial intelligence system in a way that creates a danger to a person's life or body, or to property on a large scale, where the conduct does not amount to a more serious offence.

The amending Act defines an artificial intelligence system in the same terms as the EU AI Act: a machine-based system of varying levels of autonomy that, from the input it receives, infers how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

Intentional commission carries six months to five years' imprisonment and negligent commission up to three years; where the offence causes serious bodily injury or property damage of a large scale the ranges rise to one to ten years and six months to five years respectively, and where it causes one or more deaths they rise to three to fifteen years and one to eight years respectively.

Article 24 of the Consumer Credit Act requires a creditor and a credit intermediary that offer a consumer a personalised offer based on automated processing of personal data to tell the consumer so clearly and comprehensibly, in addition to their duties under Regulation (EU) 2016/679. Article 30(1) requires a creditor whose creditworthiness assessment involves automated processing of personal data to inform the consumer of that in writing, and of the consumer's right to a human assessment.

Under that right the consumer may request and receive a clear explanation of the assessment, including the logic and risks of the automated processing and its significance and effects on the decision, express a view to the creditor, and request and receive a review of the assessment and of the decision to grant credit. Article 30(2) requires the creditor to enable the consumer to exercise those rights.

Under Article 30(3), a creditor that rejects a credit application on the basis of the assessment must inform the consumer that the assessment rests on automated processing of personal data, and of the right to a human assessment and the procedure for contesting the decision. Article 119 provides that the Act takes effect on 20 November 2026, apart from Article 114(1) to (6) and Article 3(2), points 1 and 2, which take effect later. The Act was published in Narodne novine 86/2026 on 7 August 2026.

Under Article 221.d(1) of the Labour Act, a digital labour platform or aggregator is the employer of a worker who performs work personally through a digital labour platform. Article 221.g(1) binds that employer where it uses digital technology and infrastructure in an automated management system based on algorithms. The employer must inform the worker of the organisation of the platform's work and of how decisions are made in the automated management system.

The employer must appoint an authorised person who reviews, at the worker's request, decisions made in the automated management system and who decides on them. Article 221.g(2) requires the employer to let the worker learn, before work begins, how tasks will be assigned, how the worker will be monitored and how the work will be evaluated. Article 221.g(5) requires the employer to make the data relating to those duties available to the worker on request.

Article 221.h(1) requires the employer to assess the risks of the work and their effect on the safety and health of platform workers. Under Article 221.h(2) the employer may not allow a work intensity that endangers the physical or mental health of a platform worker.

Under Article 221.i(1) a worker who considers that a decision made in the automated management system has violated a right arising from employment may ask the employer for protection of the right, a written explanation and a review of the decision. Article 221.c(3) applies the Labour Act to platforms and aggregators that organise work performed in the European Union, whatever their place of business.

Article 67 of the amending Act provides that Article 56, which inserted these provisions, takes effect on 1 January 2024.

Article 23 of the Act implementing Regulation (EU) 2024/1083 requires media service providers, providers of electronic publications and video-sharing platforms to label content they publish that has been generated in any way by artificial intelligence. Article 3 makes the Agency for Media (Agencija za medije) the competent authority under the Act. Article 24(1) fines a legal person that publishes AI-generated content without labelling it between EUR 13,270 and EUR 132,720.

Article 24(2) fines the responsible person in the legal person between EUR 1,320 and EUR 6,630. Article 24(3) fines a sole trader or other self-employed person between EUR 2,650 and EUR 13,270. Article 33 provides that the Act takes effect on the eighth day after its publication in Narodne novine. The Act was published in Narodne novine 27/2026 on 18 March 2026, so it took effect on 26 March 2026.

Croatia regulates biometric processing by sector rather than a single undifferentiated rule. Article 21 permits public-authority biometric processing only where provided by law and necessary to protect persons, property, classified data, or business secrets, or to fulfil international border-crossing identification obligations.

Article 22 permits private-sector biometric processing where prescribed by law or necessary for those same protective purposes, or for the individual, secure identification of service users, with the last purpose requiring the data subject's explicit General Data Protection Regulation (GDPR)-compliant consent as its legal basis; the other Article 22(1) grounds do not require consent on this reading.

Article 23 permits employee biometric processing for recording working time or entry to and exit from official premises where prescribed by law, or as an alternative to another solution for the same purpose, on condition the employee has given explicit consent.

A controller must notify AZOP without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. The Act requires the Agency's annual report to the Croatian Parliament to state the number of controller reports of personal-data breaches received under General Data Protection Regulation (GDPR) Article 33 and the supervisory activities taken on them (Article 17).

Croatia gives the General Data Protection Regulation (GDPR) domestic effect through the Act on the Implementation of the General Data Protection Regulation, Narodne novine 42/18, enacted 27 April 2018 and effective 25 May 2018. AZOP (Agencija za zastitu osobnih podataka) is the supervisory authority.

A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier. Article 44(1) of the Act has the Agency impose administrative fines for infringements of the Act and of the Regulation, in line with General Data Protection Regulation (GDPR) Article 83.

Individuals in Croatia have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

Croatia's implementation act adds no Croatia-specific exemptions or extensions to Article 22 beyond what the General Data Protection Regulation (GDPR) itself provides.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Croatia can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.

The Croatian implementing Act adds no restriction on these requests that reaches a private controller: its statistics exception (Art. 33) covers only bodies producing official statistics, and Articles 34 and 35 govern complaints to the Personal Data Protection Agency and challenges to its decisions.

Agencija za zastitu osobnih podataka (AZOP) is Croatia's supervisory authority, entitled to impose administrative fines in line with General Data Protection Regulation (GDPR) Article 83 (Article 44(1) of the Act). A fine imposed on a body with public powers or a public service must not jeopardize the performance of that power or service (Article 44(2)). Article 47 of the Act bars administrative fines against public authorities.

Article 51 of the Act sets administrative fines of up to HRK 50,000 for a controller or processor that breaches the Act's video-surveillance duties. GDPR Article 82 arms an individual with a direct private right of action. Article 41 of the Act lets a data subject authorize a qualifying non-profit body to lodge a complaint and claim compensation under Article 82 on the subject's behalf.

Health and other personal data must be processed so as to ensure appropriate security and confidentiality, including protection against unauthorized or unlawful processing and accidental loss, destruction or damage, by appropriate organizational, technical and security measures.

The systems that store and process the data must contain technical and organizational measures consistent with the cybersecurity rules, in particular pseudonymization and encryption, lasting confidentiality, integrity, availability and resilience, timely restoration of availability and regular testing of the measures. Article 8 makes it mandatory to allow access only to users on the basis of user roles, authentication and authorization, with audit records for all activity in the system.

Article 8 also makes it mandatory to use strong passwords of at least 16 characters combining upper and lower case letters, digits and punctuation marks. Article 8 requires backups at suitable intervals, regular testing of the backups, and backups made on equipment and at a location different from the primary storage. Software providers must keep the personal data they learn in their work permanently confidential, without time limit, even after they stop working in the systems.

A user of a health information system must identify and authenticate with an identification digital certificate or another credential of substantial assurance level.

Chapter XXV of the Kazneni zakon (Criminal Code) creates the criminal offences against computer systems, programs and data. Article 266 punishes unauthorised access to a computer system, part of one, or computer data, with a higher penalty where the target is a government body, the Constitutional Court, an international organisation Croatia belongs to, a local or regional government unit, a public institution, or a company of special public interest.

Article 267 punishes disabling or hindering a computer system's operation or use, or computer communication. Article 268 punishes unauthorised damage, alteration, deletion, destruction or concealment of another's computer data or programs, or blocking access to them. Article 269 punishes unauthorised interception of a non-public transmission of computer data.

Article 270 punishes computer forgery: unauthorised creation, entry, alteration, deletion or suppression of computer data with legal significance, intending it be used as genuine. Article 271 punishes computer fraud committed to obtain an unlawful material gain by manipulating computer data or a computer system's operation, with a higher penalty where a substantial gain or loss results.

Article 272 punishes making, acquiring, distributing or making available a device, program or data created or adapted to commit any of these offences, or a password or access code for the same purpose.

Article 273 raises the penalty for Articles 267 to 270 where the target is a government body, the Constitutional Court, an international organisation Croatia belongs to, a local or regional government unit, a public institution, or a company of special public interest, and for Articles 266 to 269 where the offender conceals their real identity and causes confusion about the authorised holder of that identity; it raises the penalty further, to one to eight years' imprisonment, for an offence under Articles 267 to 269 committed by a means intended to carry out an attack on a larger number of computer systems, or that causes significant damage.

Croatia's Copyright and Related Rights Act creates two text-and-data-mining exceptions transposing the EU Digital Single Market Copyright Directive. Article 187 lets a research organisation or cultural heritage institution reproduce and extract from copyrighted works and databases for scientific-research text-and-data-mining without a rightsholder's authorisation or payment, and a rightsholder cannot override this by contract.

Article 188 extends the same freedom to text-and-data-mining for other purposes, including AI training, but only where the rightsholder has not expressly reserved their rights in an appropriate manner; for a work made available online, the only appropriate reservation is a machine-readable means that includes metadata and the general terms of the website or service.

The Government decree names the competent authorities for the Cyber Solidarity Act (Regulation (EU) 2025/38) as the Security and Intelligence Agency, through its National Cybersecurity Centre, and the Croatian Academic and Research Network (CARNet), through the National CERT (Article 3).

The National Cybersecurity Centre acts as the national cyber hub and as the body responsible for coordinated preparedness testing of entities, and the National CERT acts as the computer security incident response team (CSIRT) responsible for that testing (Articles 4 and 5). The decree takes effect on the eighth day after its publication in Narodne novine of 17 July 2026 (Article 7).

Article 30 of the Cybersecurity Act requires every essential and important entity to take risk-management measures covering, at minimum, risk-analysis and information-system-security policies, incident-handling procedures including monitoring, logging and reporting, business continuity such as backup management and disaster recovery and cybersecurity-crisis management, supply-chain security including the vulnerabilities and security practices of direct suppliers and service providers, security in the acquisition, development and maintenance of network and information systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of the entity's own risk-management measures, basic cyber-hygiene practices and cybersecurity training, cryptography and, where appropriate, encryption policies, human-resources security and access-control policies and asset management including regular inventory updates, and, where appropriate, multi-factor or continuous authentication, secured voice, video and text communications, and secure emergency communication systems.

Article 29 makes the members of an essential or important entity's management body, or the heads of the relevant state administration body, other state body, or local and regional self-government executive body for a public entity, responsible for implementing these measures: they must approve the risk-management measures the entity applies and control their implementation, and they must themselves attend appropriate training on risk-management issues and its effect on the entity's services, and make the same training available to the entity's staff.

Both articles transpose NIS2 Articles 21 and 20 respectively. Annex III (Prilog III, the list of competences) lists 'providers of digital services' at row 21 for all entity types, with the National Cybersecurity Centre as competent computer security incident response team (CSIRT). The Act's own definitions clause names a provider of an online marketplace, an online search engine, or a social networking services platform among the digital service providers it reaches.

Article 8(1) applies the corresponding provisions of a special law, including those on supervision, to an essential or important entity of a sector in Annex I or II for which that special law sets requirements that match this Act's cybersecurity requirements in content and purpose or are stricter. Article 4(1) names the Croatian National Bank and the Croatian Financial Services Supervisory Agency, with the Croatian Civil Aviation Agency, as the authorities competent to apply those special laws.

Annex III names no authority implementing this Act's cybersecurity requirements for the banking and financial-market-infrastructure sectors, and names the Croatian National Bank and the Croatian Financial Services Supervisory Agency as the authorities implementing their special laws.

The Croatian Financial Services Supervisory Agency (HANFA) and the Croatian National Bank are the competent authorities for implementing the DORA Regulation (Regulation (EU) 2022/2554) and the Act (Article 7). Entities supervised by the Agency must report significant ICT incidents to the Agency, those supervised by the Croatian National Bank must report them to the Bank, and all supervised entities must also report to the computer security incident response team (CSIRT) (Article 14).

Supervised entities must report significant ICT incidents through the national platform for cyber threats and incidents set up under the cybersecurity law (Article 15). A legal person that has not set up the internal governance and control framework for managing ICT risk required by DORA Article 5(1) is fined up to 3 percent of its total annual revenue (Article 19). The Act took effect on 17 January 2025 (Article 22).

Article 37 of the Cybersecurity Act requires every essential and important entity to notify the competent computer security incident response team (CSIRT) of every incident with a significant effect on the availability, integrity, confidentiality or authenticity of data material to the entity's business or on the continuity of the services it provides (a significant incident), and Article 38 requires it to notify the recipients of its services of a significant incident likely to affect them and, on a serious cyber threat, of protective measures or remedies those recipients can take.

Neither article states the notification clock itself: Article 44 delegates the criteria for a significant incident, the type and content of every notification under Articles 37 to 40, and the deadlines for their submission to the implementing regulation Article 24 authorizes. That regulation, the Cybersecurity Regulation (Narodne novine No. 135/2024), sets the clock in its Articles 64 to 71.

An early warning to the competent CSIRT is due without delay and no later than 24 hours after becoming aware of a significant incident (Article 66). An initial notification is due no later than 72 hours (Article 67). A trust service provider's initial notification is due no later than 24 hours instead (Article 68). An interim report is due on the CSIRT's request, within a period the CSIRT sets of 48 hours to 7 days (Article 69).

A final report is due no later than 30 days after the initial notification (Article 70). Where the incident is still ongoing at that point, a progress report takes the place of the final report and is repeated every 30 days once the incident has run past 60 days, followed by a final report within 30 days of the last progress report (Article 71).

The Regulation's Article 85 sets a parallel 72-hour clock, running from the entity's own awareness of the incident, for notifying affected service recipients under the Act's Article 38. Article 37(4) and Article 38(3) of the Act each separately give a newly categorized entity 30 days from the date it receives its Article 19(1) categorization notice before these notification duties bind it, a grace period distinct from the per-incident clock the Regulation sets.

The same Chapter Nine penalty structure documented on this jurisdiction's companion risk-management-and-governance row applies to a reporting failure: an essential entity's fine of EUR 10,000 to EUR 10,000,000 or 0.5 to 2 percent of worldwide turnover, an important entity's fine of EUR 5,000 to EUR 7,000,000 or 0.2 to 1.4 percent, whichever is higher in each case, referred by the competent authority to the competent state attorney for misdemeanor prosecution rather than imposed directly.

Article 8(1) applies the corresponding provisions of a special law, including those on supervision, to an essential or important entity of a sector in Annex I or II for which that special law sets requirements that match this Act's cybersecurity requirements in content and purpose or are stricter. Article 4(1) names the Croatian National Bank and the Croatian Financial Services Supervisory Agency, with the Croatian Civil Aviation Agency, as the authorities competent to apply those special laws.

Annex III names no authority implementing this Act's cybersecurity requirements for the banking and financial-market-infrastructure sectors, and names the Croatian National Bank and the Croatian Financial Services Supervisory Agency as the authorities implementing their special laws.

Article 50, paragraph 1 of the Electronic Communications Act allows the use of automatic calling and communication systems without human intervention, fax machines or electronic mail, including SMS and MMS messages, for direct promotion and sale only with the end user's prior consent.

Article 50, paragraph 2 lets a natural or legal person who is a trader use the electronic mail addresses it obtained from its consumers in connection with selling products and services for direct promotion and sale of its own similar products or services only, if those consumers have a clear and unambiguous, free and simple chance to object when the addresses are collected and with every electronic message, where the consumer has not already refused.

Article 50, paragraph 3 bans, for direct promotion and sale, sending electronic mail or SMS and MMS messages that misrepresent or conceal the sender's identity and are contrary to the rules on electronic commerce, sending them without a valid address or number to which the recipient can send a request to stop further communication free of charge, and sending messages that urge recipients to visit websites contrary to the rules on electronic commerce.

Article 50, paragraph 4 provides that paragraphs 1 and 2 do not apply to such communication addressed to legal persons. Article 170, paragraph 1 punishes a legal person that uses automatic calling or communication systems, fax or electronic mail for direct promotion or sale without the end user's prior consent, uses consumers' electronic mail addresses without a free and simple way to object, or sends the prohibited messages with a fine of EUR 13,270 to EUR 132,720 as a misdemeanor.

Article 170, paragraphs 2 and 3 fine the responsible person in the legal person EUR 2,650 to EUR 13,270 and a natural person EUR 1,320 to EUR 6,630 for the same misdemeanor. Article 51, paragraph 1 lets the Agency (Agencija) or the authority competent for personal data protection order an end to breaches of articles 41 to 50.

Article 7, paragraph 1 makes the Croatian Regulatory Authority for Network Industries (Hrvatska regulatorna agencija za mrežne djelatnosti, the Agency) the national regulatory authority. Article 29 of the amending Act NN 45/2026 renumbers the points of article 170, paragraph 1 that list these breaches. Article 187 provides that the Act takes effect on the eighth day after its publication, except articles 169 to 172, which take effect on the day the euro is introduced.

Article 43, paragraph 4 of the Electronic Communications Act (Zakon o elektroničkim komunikacijama) allows using electronic communications networks to store data, or to access data already stored, in the terminal equipment of an end user or user only where that end user or user has consented after receiving clear and complete notice, in line with personal data protection rules, in particular about the purposes of the processing.

Article 43, paragraph 4 does not prevent technical storage or access solely to carry out the transmission of communications over an electronic communications network, or, where necessary, to provide an information society service at the express request of the end user or user.

Article 170, paragraph 1 punishes a legal person that uses an electronic communications network to store data or access stored data in terminal equipment without the end user's consent or without clear and complete notice with a fine of EUR 13,270 to EUR 132,720 as a misdemeanor. Article 170, paragraphs 2 and 3 fine the responsible person in the legal person EUR 2,650 to EUR 13,270 and a natural person EUR 1,320 to EUR 6,630 for the same misdemeanor.

Article 51, paragraph 1 lets the Agency (Agencija) or the authority competent for personal data protection order an end to breaches of articles 41 to 50. Article 7, paragraph 1 makes the Croatian Regulatory Authority for Network Industries (Hrvatska regulatorna agencija za mrežne djelatnosti, the Agency) the national regulatory authority. Article 29 of the amending Act NN 45/2026 renumbers the points of article 170, paragraph 1 that list these breaches.

Article 187 provides that the Act takes effect on the eighth day after its publication, except articles 169 to 172, which take effect on the day the euro is introduced.

Article 43, paragraph 1 of the Electronic Communications Act prohibits, to ensure the secrecy of electronic communications and associated traffic data in public communications networks and publicly available communications services, listening, tapping, storing and any form of interception or surveillance of electronic communications and associated traffic data, except in the cases in article 52 and cases laid down by special laws.

Article 43, paragraph 2 excludes from that prohibition technical storage necessary for the transmission of the communication, and cases where it is necessary to maintain or restore the security of electronic communications networks and services or to detect technical faults, errors, security risks or attacks, without infringing the principles of data secrecy.

Article 43, paragraph 3 provides that paragraphs 1 and 2 do not apply to legally authorized recording of communications and associated traffic data during lawful business transactions to provide evidence of commercial transactions or other business communications. Article 170, paragraph 1 punishes a legal person that does not ensure the secrecy of electronic communications or associated traffic data in the prescribed manner with a fine of EUR 13,270 to EUR 132,720 as a misdemeanor.

Article 170, paragraphs 2 and 3 fine the responsible person in the legal person EUR 2,650 to EUR 13,270 and a natural person EUR 1,320 to EUR 6,630 for the same misdemeanor. Article 51, paragraph 1 lets the Agency (Agencija) or the authority competent for personal data protection order an end to breaches of articles 41 to 50.

Article 7, paragraph 1 makes the Croatian Regulatory Authority for Network Industries (Hrvatska regulatorna agencija za mrežne djelatnosti, the Agency) the national regulatory authority. Article 29 of the amending Act NN 45/2026 renumbers the points of article 170, paragraph 1 that list these breaches. Article 187 provides that the Act takes effect on the eighth day after its publication, except articles 169 to 172, which take effect on the day the euro is introduced.

Article 50(1) of the Copyright and Related Rights Act treats giving the public access to works uploaded by users of online content-sharing platforms as communication to the public, which the author may authorize or prohibit.

Article 50(3) excludes non-profit online encyclopedias, educational and scientific repositories, open-source software platforms, electronic communications providers, online retail shops, business-to-business cloud services and personal cloud storage services from the definition of an online content-sharing service provider.

Article 50(4) requires the provider to obtain the author's authorization for giving the public access to works users upload, and the authorization covers users who do not act on a commercial basis or do not earn significant revenue. Article 50(9) disapplies the hosting liability limitation in Article 18(1) of the Electronic Commerce Act to such a provider.

Article 51(1) makes the provider liable for unauthorized communication to the public unless it proves it made best efforts to obtain authorization, made best efforts under high industry standards of professional diligence to make unavailable the works for which authors gave it relevant and necessary information, and acted expeditiously on a sufficiently substantiated notice to disable access or remove the works and made best efforts to prevent their future upload.

Article 51(3) limits a new provider that has been available in the European Union for less than three years and has annual turnover under EUR 10 million to showing best efforts to obtain authorization and acting expeditiously on a substantiated notice. Article 51(4) adds, for such a provider whose average monthly users exceed five million in the previous calendar year, the burden of proving best efforts to prevent further uploads of reported works.

Article 51(8) requires the provider to give the author, on request, adequate information on how its practices work. Article 52(1) bars cooperation with authors from making unavailable user-uploaded works that infringe no copyright or are used under a statutory exception, and Article 52(2) bars any general monitoring obligation. Article 52(4) requires the provider to tell users in its terms and conditions about the possibilities of using works under the copyright exceptions.

Article 53 requires the provider to set up effective and expeditious complaint and redress procedures for users, to resolve complaints immediately on receipt, and to subject decisions to disable access or remove uploaded works to human review. Article 315 brought the Act into force on the eighth day after its publication, except Article 69 and two other provisions.

Article 4(1) of the Act on the Implementation of Regulation (EU) 2022/2065 names the Croatian Regulatory Authority for Network Industries (Hrvatska regulatorna agencija za mrežne djelatnosti, HAKOM) the Digital Services Coordinator within the meaning of Article 49 of the Regulation. Article 4(2) gives the Coordinator the powers under Articles 51 and 53 of the Regulation and the powers over out-of-court dispute settlement bodies and the award of trusted flagger status.

Article 6(1) names the authorities that issue orders to act against illegal content and orders to provide information under Articles 9 and 10 of the Regulation, among them the State Attorney's Office and the Ministry of the Interior for offences, the Personal Data Protection Agency, the Customs Administration for intellectual property, the State Inspectorate, the Ministry of Health and the Electronic Media Agency.

Article 6(3) requires an order to act against illegal content to contain all the elements of Article 9 of the Regulation and to be issued in Croatian, with the elements in Article 9(2)(a) and (b) translated into the language the provider has chosen or that is agreed bilaterally. Article 7 makes the Personal Data Protection Agency the authority for Articles 27 and 28 of the Regulation.

Article 8 makes the authorities in Article 6(1) responsible, each in its own field, for Articles 25, 26 and 30 to 32 of the Regulation. Article 12 gives a provider or recipient eight days from receipt of an order under Article 9 or 10 to file an objection with the Zagreb Municipal Misdemeanor Court through the authority that issued the order.

Article 17(2) gives an authority that finds a breach of Articles 25 to 28 or 30 to 32 of the Regulation all the powers in Article 51, including ordering measures by decision with a suitable deadline to end the breach.

Article 18(1) punishes a provider of intermediary services that is a legal person with a fine of EUR 6,630 to 66,360, or up to 6 percent of its annual worldwide turnover in the previous financial year, whichever is higher, if it does not act without delay on an order to act against illegal content.

The same fine applies under Article 18(1) points 6 to 12 to a provider that fails to designate points of contact, appoint a legal representative, meet the terms and conditions, transparency reporting, notice and action, and statement of reasons duties in Articles 11 to 17 of the Regulation.

Article 19(1) applies the same fine to a provider of online platforms that fails to set up an internal complaint-handling system, to take measures against misuse, or to meet the transparency reporting, interface design, advertising, recommender system and protection of minors duties in Articles 20 and 23 to 28 of the Regulation.

Article 20(1) applies the same fine to an online platform that lets consumers conclude distance contracts with traders and fails to meet the trader traceability, interface design and consumer information duties in Articles 30 to 32 of the Regulation. Article 22 sets a fine of up to 1 percent of worldwide turnover for supplying incorrect, incomplete or misleading information, for not answering or correcting it, and for not consenting to an inspection.

Article 25(1) ended the application of Articles 16, 17, 18 and 21 of the Electronic Commerce Act when this Act took effect. Article 26 brought the Act into force on the eighth day after its publication in the Narodne novine.

The Hrvatski sabor adopted the Act amending the Zakon o obveznim odnosima on 19 June 2026. Narodne novine 69/2026 published the Act on 29 June 2026. Article 1 of the Act names Directive (EU) 2024/2853 among the directives that the Zakon o obveznim odnosima transposes. Articles 11 to 20 of the Act enter into force on 9 December 2026. Those articles do not apply to products placed on the market or put into service before 9 December 2026.

Article 1072.a, inserted by Article 11, defines a product to include software, electricity and other forms of energy, digital manufacturing files and raw materials. Article 1072.a defines a manufacturer as a person who develops or makes a product, a person for whom a product is designed or made or who presents itself as its manufacturer by putting its name, trade mark or other distinguishing feature on it, and a person who develops or makes a product for its own use.

Article 1072.a defines the manufacturer's control to include integrating, connecting or supplying a component, including a software update or upgrade, and being able to supply software updates or upgrades itself or through a third party. Article 1073(1) as replaced makes an economic operator liable for damage caused by the defect of a product regardless of fault. Article 1073(2) as replaced also covers damage caused by the destruction or corruption of data not used for business purposes.

Article 1073(2) as replaced also covers property damage caused by a medically recognized injury to psychological health. Article 1073(3) as replaced gives the injured person a right to compensation for non-pecuniary damage resulting from that damage. Article 1073(5) as inserted excludes free and open-source software that is developed or supplied outside a business activity. Article 1074(1) leaves the burden of proving the defect, the damage and the causal link with the injured person.

Article 1074(2) presumes a product defective where the economic operator has not disclosed the relevant evidence required under Article 1074.a(1). Article 1074(2) also presumes a product defective where the injured person proves that it does not meet mandatory product safety requirements under EU or national law that protect against the risk of the damage suffered. Article 1074(3) presumes a causal link where the product is defective and the damage is a typical consequence of that defect.

Article 1074(4) presumes the defect, the causal link or both where the injured person faces excessive difficulties, in particular because of technical or scientific complexity, and proves it likely that the defect or the link exists. Article 1074.a(1) has the court order the defendant to disclose relevant evidence in its control on the application of a claimant who has made the claim for compensation plausible.

Article 1075(1) makes a product defective if it does not provide the safety that may legitimately be expected of it or that EU or national law requires. Article 1075(2) lists among the circumstances for judging a defect the relevant product safety requirements, including cybersecurity requirements relevant to safety. Article 1075(2) also lists the effect of any ability of the product to keep learning or to acquire new features after it is placed on the market.

Article 1076(1) makes liable the manufacturer of the defective product, the manufacturer of a defective component, and, where the manufacturer is established outside the EU, the importer, the authorized representative and, failing both, the fulfilment service provider. Article 1076(3) makes liable any person who substantially modifies a product outside the manufacturer's control and then makes it available on the market or puts it into service.

Article 1076(4) makes a distributor liable where no operator in paragraph 1 can be identified and the distributor does not name one, or its own supplier, within one month of the injured person's request. Article 1076(5) applies that rule to an online platform provider that enables consumers to conclude distance contracts with traders where the conditions of Article 6(3) of Regulation (EU) 2022/2065 are met.

Article 1077.a denies a manufacturer that built software into a product as a component a right of recourse against the maker of the defective software component where that maker was a micro or small enterprise or the manufacturer waived the right by contract. Article 1078(1) releases an economic operator that proves the defect probably did not exist when the product was placed on the market or arose afterwards.

Article 1078(1) also releases an economic operator that proves the objective state of scientific and technical knowledge did not allow the defect to be discovered. Article 1078(2) denies that release where the defect of a product under the manufacturer's control is caused by a related service, by software including updates or upgrades, by the lack of software updates or upgrades needed to maintain safety, or by a substantial modification.

Article 19 of the Act replaces the word producer with the words economic operator in Article 1079(1). Article 1080(2) as replaced extinguishes the right to compensation ten years after the defective product was placed on the market or put into service, unless proceedings were started against the economic operator within that time. Article 1080(3) extends the period to 25 years where a latent bodily injury prevented the injured person from starting proceedings within ten years.

Article 1073(1) of the Zakon o obveznim odnosima makes a producer who puts a product into circulation liable for damage caused by its defect regardless of fault. Article 1073(2) covers property damage caused by death or bodily injury and damage to a thing of the injured person other than the defective product. The thing must be of a kind ordinarily intended for personal use, and the injured person must have mainly used it for that purpose.

Article 1073(3) gives compensation for damage to a thing only for the part of the damage that exceeds EUR 500. Article 4 of the 2022 amending Act deleted the kuna equivalent from that paragraph, so the figure is EUR 500. Article 1073(4) allows compensation for non-pecuniary damage caused by a defective product only under the general rules on liability for damage. Article 1073(7) leaves in place the rules on liability for damage caused by a dangerous thing or a dangerous activity.

Article 1073(8) puts on the injured person the burden of proving the defect, the damage and the causal link between them. Article 1074(1) defines a product as any movable thing and a separate part built into a movable or immovable thing. Article 1074(2) adds electricity and other forms of energy.

Article 1075(1) makes a product defective if it does not offer the safety that may legitimately be expected of it, judged on its presentation, the uses it can reasonably be put to and the time it was put into circulation. Article 1076(1) treats as producer the person who made the finished product, a raw material or a part built into it, and a person who presents themselves as producer by putting a name, trade mark or other distinguishing sign on the product.

Article 1076(2) treats a person who imports a product for sale, lease or another form of putting it into circulation as its producer, jointly liable with the persons in paragraph 1. Article 1076(3) treats every person who puts a product into circulation as its producer where the producer cannot be identified, unless that person informs the injured person within a reasonable time of the person it obtained the product from.

Article 1078(1) releases the producer from liability if it proves that the state of science and technical knowledge when it put the product into circulation did not allow the defect to be discovered. Article 1079(1) bars excluding or limiting the producer's liability to the injured person in advance by contract. Article 1079(2) makes a contract term contrary to paragraph 1 void.

Article 1080(1) time-bars a claim three years after the injured person learned, or should have learned, of the damage, the defect and the producer. Article 1080(2) extinguishes the right to compensation ten years after the product was put into circulation, unless proceedings were started against the producer within that time. Article 1.a of the Act, added by the amending Act published in Narodne novine 78/2015, listed Council Directive 85/374/EEC among the directives that the Act transposes.

The Act entered into force on 1 January 2006. Articles 11 to 20 of the amending Act published in Narodne novine 69/2026 do not apply to products placed on the market or put into service before 9 December 2026.

Article 12 requires a distributor to act with due care when making a product available, and before doing so to check the CE marking, the documents, and the instructions and safety information in Croatian and Latin script, and that the manufacturer and importer met their identification duties.

Article 12(3) to (6) requires a distributor to hold back a product it considers or has reason to believe does not conform, to protect conformity in storage and transport, to take corrective measures or withdraw a non-conforming product, and to notify the manufacturer or importer, the inspector and the national authorities. Article 35(1) fines a distributor that is a legal person EUR 1,990.00 to EUR 13,270.00 for the listed offences.

Article 35(2) and (3) fine the responsible person in the legal person, and a distributor that is a craftsperson or other self-employed natural person, EUR 1,320.00 to EUR 6,630.00.

Article 5, point 20 (point 16 until 15 October 2026), defines an economic operator as a manufacturer, authorized representative, importer, distributor or service provider.

Article 14 requires a manufacturer, authorized representative, importer or distributor to give the inspector, on request, the identity of every operator that supplied it with the product and every operator it supplied, and to keep that information for five years after the product was supplied to it and five years after it supplied another operator.

Article 16(1) requires a manufacturer, importer and distributor to give the inspector on a reasoned request, in Croatian and Latin script, all information and documentation needed to show conformity of the product, and to cooperate on measures to remove non-conformity.

Article 17(1) makes the accessibility requirements binding only so far as accessibility needs no significant change that fundamentally alters the basic nature of the product or service and causes no disproportionate burden on the economic operator.

Article 17(2) to (4) requires the economic operator to carry out the assessment itself on the criteria of Annex VI, to document it and keep the results for five years from the last time the product was made available or the service last provided, and to give the inspector a copy on request.

Article 17(5) exempts a micro entity of the small economy that places products on the market from documenting its assessment, but requires it to give the inspector on request the facts relevant to the assessment. Article 17(6) requires a service provider that relies on the disproportionate-burden limit to redo its assessment for each category or type of service when it changes the service, when the inspector asks, and at least every five years.

Article 17(7) denies the disproportionate-burden limit to an economic operator that receives funding from other sources than its own, public or private, to improve accessibility. Article 17(8) requires an economic operator other than a micro entity of the small economy that relies on Article 17(1) for a product or service to notify the relevant market surveillance authority or conformity-checking authority of the Member State where the product is placed on the market or the service provided.

Article 18 presumes that a product or service that conforms to the harmonized standards, or the parts of them, whose references are published in the Official Journal of the European Union, or to the technical specifications published there or set by an implementing act of the European Commission, meets the accessibility requirements those standards or specifications cover.

Article 8 provides that placing a conforming product on the market or providing a conforming service in Croatia cannot be prevented for reasons connected with the accessibility requirements. Article 30(1) makes the accessibility requirements of Annex I mandatory accessibility requirements for the description of the procurement object and the technical specifications under the public procurement law, for the products and services in Article 3.

Article 30(2) presumes that a product or service whose features, elements or functions meet the accessibility requirements of Annex I, section V, meets the corresponding accessibility obligations of other acts of the European Union for those features, elements or functions, unless those acts provide otherwise.

Article 11 requires an importer to place on the market only a product that meets the accessibility requirements, and before doing so to check that the manufacturer carried out the conformity assessment, drew up the technical documentation, affixed the CE marking and supplied the documents and the identification information.

Article 11 requires an importer that considers or has reason to believe a product does not conform to hold it back until it conforms and to inform the manufacturer and the inspector.

Article 11(4) to (9) requires an importer to put its own name and address on the product, to attach instructions and safety information in Croatian and Latin script, to protect conformity in storage and transport, to keep a copy of the EU declaration for five years and the technical documentation available, to take corrective measures or withdraw a non-conforming product, and to notify the authorities and keep a record of non-conforming products and complaints.

Article 13 treats an importer or distributor as a manufacturer, with the manufacturer's duties of Article 9, when it places a product on the market under its own name or trade mark or modifies a product already on the market so that conformity may be affected. Article 34(1) fines an importer that is a legal person EUR 3,310.00 to EUR 66,360.00 for the listed offences.

Article 34(2) and (3) fine the responsible person in the legal person, and an importer that is a craftsperson or other self-employed natural person, EUR 1,990.00 to EUR 6,630.00.

Article 22(2) and (3) assign the market surveillance of products to the electronic communications inspectors of the Croatian Regulatory Authority for Network Industries (HAKOM) where the product is radio equipment, and to the market inspectors of the State Inspectorate for all other products. Article 22(1) has the market surveillance of products carried out in accordance with the provisions of Regulation (EU) 2019/1020 that it lists.

Article 22(4) requires the competent inspector of Article 22(2), where an economic operator relies on Article 17, to check that it carried out the assessment, to review the assessment and its results, including the correct use of the Annex VI criteria, and to check conformity with the accessibility requirements.

Article 22(5), added by the Act published in Narodne novine 114/2026, lets the State Inspectorate's inspectors carry out the examinations and tests of products needed to determine conformity and take product samples for testing. Article 22(7), added by the same Act, makes the State Inspectorate bear the cost of the sample, examination or test if the samples meet the requirements, and the economic operator bear it if they do not.

Article 22(6), added by the same Act, lets those inspectors entrust particular steps of the inspection to an expert institution or other expert legal person where they lack the expertise or equipment.

Article 22(8), numbered 22(5) until 15 October 2026, lets the inspector give consumers, on request and in an accessible form, the information it holds on economic operators' conformity with the accessibility requirements and on the Article 17 assessment, unless confidentiality under Article 17 of Regulation (EU) 2019/1020 prevents it.

Article 23(2) lets the inspector require an economic operator to take all appropriate corrective measures within a reasonable period proportionate to the nature of the non-conformity. Article 23(3) and (4) require the inspector to demand, through the inspection record, correction of formal non-conformities within a set period, and to decide to prohibit placing the product on the market or to order its withdrawal if the operator does not act within it.

Article 23(5) lets the inspector, where a product does not meet the requirements or poses a risk to health or safety, order by decision one or more of correction within a period, a ban on placing it on the market or making it available, immediate withdrawal or recall with public information on the risks, destruction where necessary, a temporary ban during examinations and tests, and warnings in Croatian.

Article 23(8) requires the inspector to notify the economic operator before a corrective measure and to give it at least ten working days to respond, unless urgency or another public-interest reason makes that impossible.

Article 23(9) lets the inspector, for products sold online or by other distance sale where corrective measures leave no other effective means of removing a serious risk, order operators of public communications services, internet access providers and hosting providers to remove content, restrict access to the online interface or display an explicit warning, and order domain registries to delete the fully qualified domain name so that the authority can register it.

Article 23(11) requires those operators, providers and hosting providers to cooperate with the inspection authorities. Article 23(10) gives an operator of public communications services, an internet access provider or a hosting provider that suffers damage from such a decision the right to claim compensation from the economic operator under the general rules on damages.

Article 25 assigns the market surveillance of services to HAKOM inspectors for electronic communications services and e-books, the media agency for services giving access to audiovisual media services, the Croatian Civil Aviation Agency, road traffic inspectors, rail market regulation inspectors and navigation safety inspectors for the transport services, the Croatian National Bank and HANFA for consumer banking services, and the State Inspectorate for e-commerce.

Article 4 of the amending Act replaces the Agency for Electronic Media with the Agency for Media in Article 25(2). Article 25(10), added by the amending Act, requires the market surveillance authorities for services to make information on their organization, identity, competences and procedures under the Act available, in an accessible form on request.

Article 25(12), added by the amending Act, makes the State Inspectorate bear the cost of the examination, test or expert assessment of an e-commerce service that is found to conform, and the economic operator bear it if the service does not conform. Article 26 requires the inspector, for a service that does not conform, to demand correction through the inspection record within a set period and, failing that, to decide that the provider must remove the non-conformity within a period it sets.

Article 27 provides that no appeal lies against an inspector's decision but an administrative dispute may be started. Article 5 of the amending Act makes that rule paragraph (1) of Article 27 and adds a paragraph (2) that disapplies it to public procurement procedures under the public procurement law. Article 36a, added by the amending Act, disapplies the misdemeanour provisions of Articles 32 to 36 to public procurement procedures under the public procurement law.

Article 30(5) of Directive (EU) 2019/882 provides that its article on penalties does not apply to procurement procedures subject to Directive 2014/24/EU or Directive 2014/25/EU.

Article 28(1) provides that, except where the same offence is found again, the inspector files no indictment proposal and issues no misdemeanour payment order if the operator removes the irregularities during the inspection or before the decision, complies with the enforceable decision, or undertakes by its statement on the record to remove irregularities for which no administrative measure is prescribed.

Article 28(3) requires the inspector to file the indictment proposal or issue the misdemeanour payment order without delay, and within 15 days of the end of the inspection or of the deadline in the written order, if the operator does not act as described.

Article 3(1) applies the Act to consumer general purpose computer hardware systems and the operating systems for them, payment terminals, ATMs, ticketing machines, check-in machines and interactive self-service information terminals, consumer terminal equipment with interactive computing capability used for electronic communications services or for access to audiovisual media services, and e-readers.

Article 3(1) leaves out self-service terminals built into vehicles, aircraft, ships or rail vehicles as integral parts. Article 6(1) requires every product within Article 3(1) to meet the accessibility requirements of Annex I, sections I and II, and requires a self-service terminal to meet those of section I only.

Article 9(1) to (4) requires a manufacturer to verify that the product is designed and made to meet the requirements, to draw up the technical documentation and carry out the conformity assessment of Annex IV, to draw up the EU declaration of conformity and affix the CE marking, and to keep the documentation and declaration for five years after placing the product on the market.

Article 9(5) to (11) requires a manufacturer to keep series production in conformity, to mark the product for identification, to show its name and a contact address in Croatian on the product, to attach instructions and safety information in Croatian and Latin script, to correct or withdraw a non-conforming product, and to notify the authorities and keep a record of non-conforming products and complaints.

Article 10 lets a manufacturer appoint an authorized representative in writing, who carries out the tasks in the mandate, including keeping the EU declaration and technical documentation for five years and giving the inspector the information and documentation needed on a reasoned request, but who does not take on the manufacturer's duty under Article 9(1) or the drawing up of the technical documentation.

Article 19(2) requires the EU declaration of conformity to carry a note on the accessibility requirements that are subject to the exception of Article 17. Article 19(4), added by the Act published in Narodne novine 114/2026, requires the form of the EU declaration of conformity to be drawn up in Croatian or translated into Croatian where the product is placed on the market in Croatia.

Article 12(2) of the amending Act corrects the cross-reference in point 2(b) of Annex IV, the conformity assessment procedure, from Article 4 to Article 6. Article 21 requires the manufacturer to affix the CE marking visibly, legibly and indelibly on the product or its data plate before placing the product on the market. Article 32(1) fines a manufacturer that is a legal person EUR 6,630.00 to EUR 132,720.00 for the listed offences.

Article 32(2) and (3) fine the responsible person in the legal person, and a manufacturer that is a craftsperson or other self-employed natural person, EUR 2,650.00 to EUR 6,630.00 for the same offences. Article 33(1), as replaced by the Act published in Narodne novine 114/2026, fines an authorized representative that is a legal person EUR 6,630.00 to EUR 132,720.00 for the listed offences.

Article 33(2) and (3) fine the responsible person in the legal person, and an authorized representative that is a craftsperson or other self-employed natural person, EUR 2,650.00 to EUR 6,630.00.

Article 3(2) applies the Act to the following services provided to consumers: electronic communications services other than machine-to-machine transmission, services giving access to audiovisual media services, elements of air, bus, rail and waterborne passenger transport services, consumer banking services, e-books and dedicated software, and e-commerce services.

For air, bus, rail and waterborne passenger transport, Article 3(2) covers websites, services on mobile devices including apps, electronic tickets and electronic ticketing services, transport information including real-time information on interactive screens in the European Union, and interactive self-service terminals in the European Union. For urban, suburban and regional transport, Article 3(2) covers only the interactive self-service terminals.

Article 3(3) applies the Act to answering communications to the single European emergency number 112 and other emergency numbers, as the electronic communications law defines.

Article 4(1) excludes from the Act pre-recorded time-based media and office file formats published before 28 June 2025, online maps where the key information is given in an accessible digital way for navigation maps, third-party content the operator did not fund, develop or control, and archive content not updated or edited after 28 June 2025. Article 4(2) excludes micro entities of the small economy that provide services from the Act.

Article 6(2) requires every service within Article 3(2) to meet the accessibility requirements of Annex I, sections III and IV, and requires urban, suburban and regional transport to meet those of section IV only.

Annex I, section III requires the products used to provide a service to be accessible, information on the operation of the service and its accessibility features to be provided in accessible ways, websites and mobile services and applications to be perceivable, operable, understandable and robust, and support services to give accessibility information by accessible means.

Article 12(1) of the amending Act corrects Annex I, section III, point (d), so that support services give information on the accessibility of the service and its compatibility with assistive technologies, in place of information on the accessibility of the product.

Annex I, section IV requires electronic communications services to offer real-time text alongside voice and total conversation where video is offered, and requires emergency communications that use voice and text to be synchronized and passed to the most appropriate emergency answering point.

Annex I, section IV requires services giving access to audiovisual media services to provide electronic program guides that are perceivable, operable, understandable and robust, and to transmit access services such as subtitles for the deaf and hard of hearing, audio description, spoken subtitles and sign language interpretation with appropriate quality, synchronized with sound and video, under the user's control.

Annex I, section IV requires air, bus, rail and waterborne passenger transport services to give information on the accessibility of vehicles, infrastructure and built environment and on assistance for persons with disabilities, and information on smart ticketing, real-time travel information and additional service information.

Annex I, section IV requires consumer banking services to provide electronic identification, electronic signature, secure element and payment methods that are perceivable, operable, understandable and robust, and information that does not exceed level B2 of the Croatian language in the Common European Framework of Reference for Languages.

Annex I, section IV requires e-books to provide synchronized text and audio where an e-book has audio content, not to block assistive technology, to allow navigation and alternative presentation, to carry accessibility metadata, and not to use digital rights management that blocks accessibility features.

Annex I, section IV requires e-commerce services to give information on the accessibility of the products and services sold where the responsible operator supplies it, and to make identification, security and payment functions and methods perceivable, operable, understandable and robust.

Article 7 treats a passenger transport service that meets the accessible-information and accessibility-information requirements of the EU passenger rights regulations and the Croatian railway and accident-investigation laws as meeting the corresponding requirements of the Act, unless the Act sets an additional requirement.

Article 15(1) to (3) requires a service provider to ensure that the design and provision of the service meet the requirements, to prepare the information required by Annex V and explain how the service meets them, to make that information available to the public in written and oral form including in a way accessible to persons with disabilities, and to keep it for the whole period of providing the service.

Article 15(4) and (5) requires a service provider to have a procedure that keeps the service in conformity, to take the corrective measures needed, and to notify without delay the competent authorities of the Member States where the service is provided if the service does not conform. Article 16(3) requires a service provider to give the inspector, on a reasoned request, all information needed to show that the service conforms and to cooperate on measures taken to ensure conformity.

Article 37(1) lets service providers keep providing their services until 28 June 2030 with products they lawfully used for similar services before that date. Article 37(2) lets service contracts concluded before 28 June 2025 continue unchanged until they expire, but for no more than five years from that date.

Article 37(3) lets self-service terminals that providers lawfully used before 28 June 2025 stay in use for similar services until the end of their economically useful life, but for no more than twenty years after they entered use. Article 37(4) applies to the answering of communications to 112 the deadline set by the electronic communications law and its implementing rules.

Article 32(2) of Directive (EU) 2019/882 lets Member States provide that self-service terminals lawfully used by service providers before 28 June 2025 may continue to be used until the end of their economically useful life, but no longer than 20 years after their entry into use, and Article 37(3) uses that option. Article 36(1) fines a service provider that is a legal person EUR 6,630.00 to EUR 132,720.00 for the listed offences.

Article 36(2) and (3) fine the responsible person in the legal person, and a service provider that is a craftsperson or other self-employed natural person, EUR 2,650.00 to EUR 6,630.00.

Article 2 of the Electronic Media Act transposes Directive 2010/13/EU, among other acts of the European Union. Article 1(5) applies the Act to Croatian Radiotelevision as well, unless a special law provides otherwise. Article 18(1) requires television publishers, and the media service providers within Articles 26 and 92, to make their services continuously and progressively more accessible, by proportionate measures, to children with developmental difficulties and to persons with disabilities.

Article 18(2) requires the Council for Electronic Media to encourage media service providers to develop accessibility action plans for the continuous and progressive increase of the accessibility of their services. Article 18(3) requires media service providers to report to the Council once a year, and by 1 September at the latest, on the measures they took.

Article 18(4) makes the Agency for Electronic Media the online contact point for information and for receiving complaints on all accessibility questions under Article 18. Article 29(1) of the Act implementing the European Media Freedom Act continues the Agency for Electronic Media as the Agency for Media from the day that Act entered into force. Article 5 of that Act makes the Council for Media (Vijeće za medije) and the director the bodies of the Agency for Media.

That Act enters into force on the eighth day after its publication, which was 18 March 2026, so the new names apply from 26 March 2026. Article 20(1) lets the minister order media service providers to publish, free of charge, proclamations and official announcements of state bodies during major natural disasters, major accidents, catastrophes or epidemics.

Article 20(2) requires media service providers to publish those announcements in a way that is also accessible to children with developmental difficulties and to persons with disabilities. Article 26(1) covers a legal or natural person that provides audio or audiovisual media services on demand with the permission of the Council.

Article 92(1) covers a media service provider that has no concession and is not an on-demand provider, to which the Council gives permission for satellite, internet, cable and other permitted forms of transmission of an audiovisual or radio program.

Article 6(1) names as contracting authorities the Republic of Croatia and its state bodies, units of local and regional self-government, bodies governed by public law, and associations formed by them. Article 208(1) requires a contracting authority, for all procurement objects intended for use by natural persons, to take into account in drawing up the technical specifications the accessibility criteria for persons with disabilities or design for all users, except in duly justified cases.

Article 208(2) requires technical specifications on accessibility criteria to refer to mandatory accessibility requirements adopted by legal acts of the European Union. Article 24(1) of Directive (EU) 2019/882 provides that the accessibility requirements of its Annex I constitute mandatory accessibility requirements within the meaning of Article 42(1) of Directive 2014/24/EU and Article 60(1) of Directive 2014/25/EU.

Article 30(1) of the Act on the accessibility requirements for products and services makes the Annex I requirements mandatory accessibility requirements for the description of the procurement object and the technical specifications under the public procurement law.

Article 270(1) to (3) requires a contracting authority that asks for certificates of independent bodies on quality assurance standards, including accessibility for persons with disabilities, to refer to quality assurance systems based on the relevant series of European standards certified by accredited bodies, to recognize equivalent certificates from bodies in other Member States, and to accept evidence of equivalent quality assurance measures where the economic operator could not obtain the certificates in time for objective reasons.

Article 39 of the Act published in Narodne novine 48/2026 adds Article 270(4), under which the contracting authority states in the procurement documents how each member of a group of economic operators proves the group's conformity with the quality assurance standards asked for. That Act enters into force on the eighth day after its publication, which was 8 May 2026, so Article 270(4) applies from 16 May 2026.

Article 452 sets 1 January 2017 for the entry into force of the Act, with exceptions for Articles 284(4) and (5), 261 and 269. Article 4 of the Act published in Narodne novine 48/2026 raises the thresholds in Article 12(1), point 1, below which the Act does not apply, from EUR 26,540 to EUR 50,000 in sub-point (a) and from EUR 66,360 to EUR 100,000 in sub-point (b). Article 89 of that Act sets 1 September 2026 for Articles 4 and 5, which change the thresholds and the rules on simple procurement.

Article 24 forbids publishing audiovisual media service, radio programme, or electronic publication content likely to seriously harm a minor's physical, mental or moral development, and forbids publishing content that could harm that development at all unless the provider secures, through scheduling, age-verification tools, or another technical measure, that minors within the transmission's reach will not ordinarily see or hear it.

Article 96 requires a provider of a video-sharing platform under Croatian jurisdiction to take appropriate measures protecting minors from user-generated video and audiovisual commercial communications that could harm their physical, mental or moral development; for content causing the greatest harm, those measures include, among others, establishing and applying an age-verification system for platform users, alongside flagging and reporting mechanisms, functionality for users to declare whether their uploaded videos contain audiovisual commercial communications, and easy-to-use content-rating tools.

A publisher of information publications established in the EU holds exclusive reproduction, distribution, communication-to-the-public and adaptation rights over its information publications against ordinary users, per Article 165, and a separate exclusive reproduction and communication-to-the-public right specifically against an information-society service provider's online use, per Article 166.

Article 166(3) exempts an individual user's private and non-commercial use, hyperlinking, and the use of individual words or very short extracts of no more than a few words that carry no photograph or video and do not affect the effectiveness of the exclusive rights.

The Article 165 right against ordinary users lasts ten years from the information publication's first lawful publication, and the Article 166 right against information-society service providers lasts two years from the same event, per Article 171.