Croatia:
First on NIS2

Croatia as a market for South America

Croatia is a small market with strong tourism, food processing, shipbuilding and pharmaceuticals. Hotels and restaurants on the coast buy food, beverages and equipment, often through wholesalers. That makes coffee, meat, fish, fruit and wine interesting for South American suppliers, as well as software and services. Chile and Argentina have large communities of Croatian descent, many of which also keep business ties. For trade figures with your country, use Eurostat's foreign trade database (Comext).

The main container port is Rijeka, where the new Rijeka Gateway container terminal has been built. Ploče in the south matters for bulk cargo. Overseas goods usually arrive after transshipment in the Mediterranean; some also reach Croatia by rail or truck from Koper, Trieste or northern ports.

What is the same across the EU and what applies nationally

Customs and product law are uniform in the EU. The basics are in the guide Exporting to the EU.

Croatia regulates these points itself:

• Language: consumer information, labels and instructions are expected in Croatian. Agree with your importer on who translates and labels.
• Packaging: there is a deposit system for beverage packaging, run by the state Environmental Protection and Energy Efficiency Fund (Fond za zaštitu okoliša i energetsku učinkovitost). Manufacturers and importers of packaged goods have reporting and fee obligations. Since August 12, 2026, the EU Packaging Regulation (EU) 2025/40 applies as well.
• Taxes and currency: the standard VAT rate is 25 %. Croatia has used the euro since January 1, 2023.
• Authorities: the Customs Administration (Carinska uprava) is part of the Ministry of Finance.

On VAT: for goods, the importer pays import VAT at customs and later deducts it as input tax. You invoice services to Croatian businesses, such as booking software for a hotel chain, without Croatian VAT; your customer accounts for it (reverse charge under Art. 196 of the VAT Directive). Check the VAT identification number in the Commission's VIES register. If you sell to consumers, for example through your own online store, you will usually need a VAT registration in the EU.

NIS2 in Croatia

Croatia was the first EU country with a NIS2 law. The Zakon o kibernetičkoj sigurnosti (Cybersecurity Act) was published in Narodne novine No. 14/2024 and has applied since February 15, 2024. The details are in the Uredba o kibernetičkoj sigurnosti (NN 135/2024), including a catalog of security measures and the reporting thresholds.

The Croatian model differs from the rest of the EU in one respect. Companies do not have to assess and register themselves. The competent authorities classify them by formal decision as essential (ključni) or important (važni) entities, and the obligations apply only from that notice onward. According to the National Cybersecurity Center, 798 companies and bodies had been classified by the end of the second quarter of 2026, 162 of them as essential. Classification is ongoing.

The central body is the Nacionalni centar za kibernetičku sigurnost (NCSC-HR) within the Security and Intelligence Agency SOA. For certain sectors such as banking, research and education, the National CERT at CARNET is responsible. Incidents are reported through the national platform PiXi. Croatia has also added one sector of its own: the education system.

What does this mean for you? Your customer knows exactly whether it is covered, because it has received a decision. Ask about it. If it has been classified, it will include you as a service provider in its risk assessment and set reporting duties, access rules and evidence requirements in the contract.

Prepare a short file: contact person for incidents, list of subcontractors, access rules, and records of updates and backups. Many suppliers keep such a file in a GRC platform; Sightadel turns the items into tasks and stores the evidence with them.

Data protection and supply chain

The GDPR applies. The supervisory authority is the Agencija za zaštitu osobnih podataka (AZOP) in Zagreb. For processing on behalf of a customer you need a contract under Art. 28 GDPR; for transfers to a country without an adequacy decision, standard contractual clauses.

Croatia has no national supply chain law. The EU rules are explained on the CSDDD page.

What Croatian customers typically ask for

Wholesalers and retail chains supplying hotels and supermarkets ask for certificates such as IFS or BRCGS (food safety). If you supply beef from Paraguay or coffee from Brazil, also keep your EUDR documentation ready.

Industrial customers usually expect ISO 9001. IT service providers get asked about ISO 27001, especially by classified entities such as energy suppliers, hospitals or banks.

Contacts

• The Hrvatska gospodarska komora (HGK) is the national chamber of commerce. In South America it works with partners such as the Croatian-Argentine Chamber of Industry and Commerce in Buenos Aires.
• The Croatian embassies in South America put you in touch with authorities and associations.
• The Enterprise Europe Network has contact points in Croatia.
• Imports and tariffs are handled by the Carinska uprava.

FAQ