AI Regulation Tracker  /  Legislative programming

Croatia's AI Act Implementing Law Is Still Pending

Parliament's 2026 EU-alignment plan, published in Narodne novine 26/2026, lists the national AI Act implementing statute as a first-quarter measure. The plan is a programming document, not a rule, and the statute it schedules has not appeared.

By Anthony Guerriero  ·  Reviewed by Anthony Guerriero  ·  Published August 3, 2026  ·  Updated August 3, 2026  ·  Legislative programming

Key facts

Regulatory briefing

Instrument

Plan for the Alignment of Croatian Legislation with the EU Acquis for 2026, NN 26/2026, act no. 291, item 27

Authority

Hrvatski sabor (Croatian Parliament); lead ministry Ministarstvo pravosuda, uprave i digitalne transformacije (MPUDT)

Jurisdiction

Croatia, within the EU single market

Status

The plan is adopted and published. The implementing Act it schedules is unenacted as of August 3, 2026

Bindingness

Non-binding framework. The plan programmes legislative work; it imposes no obligations on private parties

Effective date

Plan published March 13, 2026, first-quarter target lapsed. Regulation (EU) 2024/1689 applies generally in Croatia from August 2, 2026

Primary source

Narodne novine No. 26/2026, act no. 291

What Parliament actually adopted, and what it is not

Start with the category, because the category is the whole story. What Croatia published in March is a legislative programme. It is the document by which Parliament tells itself, and the ministries, which pieces of EU law it intends to transpose or implement in the coming year and roughly when. It is adopted formally, it is published in the Official Gazette, and it carries real institutional weight inside government. It is not a rule that anyone outside government has to comply with.

The opening line and the relevant item read as follows:

Na temelju clanka 81. Ustava Republike Hrvatske, Hrvatski sabor na sjednici 6. ozujka 2026. donio je PLAN USKLADIVANJA ZAKONODAVSTVA REPUBLIKE HRVATSKE S PRAVNOM STECEVINOM EUROPSKE UNIJE ZA 2026. GODINU [...] I. KVARTAL [...] 27. Zakon o provedbi Uredbe (EU) 2024/1689 Europskog parlamenta i Vijeca od 13. lipnja 2024. o utvrdivanju uskladenih pravila o umjetnoj inteligenciji (Akt o umjetnoj inteligenciji)Narodne novine No. 26/2026, act no. 291, published March 13, 2026. Croatian diacritics are rendered here in plain ASCII; the bracketed ellipses mark the gap between the enacting formula and item 27 under the first-quarter heading

Translated plainly: on the basis of Article 81 of the Constitution, at its session of March 6, 2026, Parliament adopted the alignment plan for 2026, and item 27 of that plan, in the first quarter block, is the Act on the Implementation of Regulation (EU) 2024/1689, the Artificial Intelligence Act. The owning ministry is the Ministry of Justice, Administration and Digital Transformation, MPUDT in the Croatian abbreviation.

So the useful content here is narrow and specific. Croatia has named the vehicle. It has named the owner. It has put the work in a calendar quarter. That is more than an intention expressed in a press release, and less than a draft. There is no bill text to read, no article numbering, no penalty schedule and no commencement provision, because the Act does not yet exist in published form.

I would resist two opposite errors here. The first is to report a programming line as though Croatia had legislated. The second is to treat the lapse of a quarter as proof that nothing is happening. Neither is supported. What the record supports is that a target was set, the target period has passed, and the statute has not appeared in the Official Gazette.

What the implementing Act is expected to carry

It helps to understand why a national implementing statute is needed at all for a Regulation. A regulation applies directly. Croatian firms do not wait for a Croatian law before Regulation (EU) 2024/1689 binds them, and neither do US firms placing systems on the Croatian market. What a member state still has to supply is the domestic machinery the Regulation assumes exists.

That machinery is the reason this file matters. The national implementing Act is the vehicle expected to designate the notifying authority and the market surveillance authority under Article 70 of the Regulation, to set the national penalty rules that Article 99 leaves to member states, and to put a domestic legal basis under a regulatory sandbox. Those are not cosmetic. They determine who you write to, who inspects you, who can fine you and how much within the Regulation's ranges, and whether there is a supervised route to test a system in that market.

It is worth being precise about the sequence, because it is the part compliance teams get backwards. The obligation does not wait for the designation. Article 70 designations tell you who administers a duty that already exists; they do not switch the duty on. A member state that is late in naming its authorities has produced an administrative gap, not a grace period, and nothing in the Regulation makes the two the same thing. The practical consequence is that a provider placing a system on the Croatian market today builds the same technical documentation, runs the same conformity work on the same schedule, and keeps the same records as it would for any other part of the single market. What it cannot yet do with confidence is name the Croatian official on the other side of that correspondence.

Until that Act is published, the honest description of Croatia's position is that the substantive obligations apply and part of the national enforcement plumbing has not been identified in the national sources reviewed. That is a different sentence from saying nothing exists, and the difference is worth holding onto if you are writing a compliance memo that someone will rely on.

Drafting is real work with named people attached to it. The MPUDT working group preparing the draft has 42 members and is chaired by Brankica Alujevic Grgas, with Dejan Vukelic as deputy. A 42-member group is a consultative structure rather than a small drafting cell, which usually signals that a wide set of ministries, agencies and interests are being brought into the text. That tends to produce a more durable statute and a slower one. I would read the lapsed quarter in that light rather than as neglect, though I cannot verify the cause and will not guess at it.

What Croatia has already designated

One piece of the structure is on the record and is often missed, so state it carefully.

On December 5, 2024, MPUDT announced Croatia's list of national public authorities and bodies that supervise or enforce obligations under Union law protecting fundamental rights in relation to high-risk AI systems, the list contemplated by Article 77(2) of the Regulation. Seven bodies were named: the Ombudswoman, the Ombudswoman for Children, the Gender Equality Ombudswoman, the Ombudswoman for Persons with Disabilities, the Personal Data Protection Agency (AZOP), the State Electoral Commission and the Agency for Electronic Media.

That list does two useful things. It gives fundamental-rights bodies in Croatia a defined route to request and access documentation about high-risk systems, and it tells you which regulators are formally in the frame if a system touches elections, media, children, disability, gender equality or personal data.

It does not do the thing people frequently assume it does. Appearing on the Article 77(2) list is not the same as being the market surveillance authority or the notifying authority. AZOP in particular is easy to over-read, because data protection regulators have been designated as AI market surveillance authorities in some member states. On the Croatian sources reviewed, AZOP appears on the fundamental-rights list and no market surveillance designation for it was identified. I would not write AZOP into a compliance register as Croatia's AI market surveillance authority on the strength of that list, and I would apply the same caution to any assumption about the telecoms and postal regulator, whose verifiable digital designation is as Digital Services Coordinator under the Digital Services Act, a different instrument with a different mandate.

What actually applies in Croatia today

Here is the part that matters for a US general counsel: the absence of a Croatian implementing statute does not buy you time.

Regulation (EU) 2024/1689 became generally applicable on August 2, 2026, and it applies in Croatia directly. The population it reaches in this market is the one the record describes: any provider, deployer, importer or distributor placing AI systems or general-purpose AI models on the Croatian market, including US companies serving Croatian customers, together with Croatian public-sector deployers of high-risk AI. Whether a Croatian statute exists does not enter that test.

The staged dates then run as follows, and they were moved once already, so use the current ones. Transparency and marking duties, including the machine-readable marking of synthetic content, apply from December 2, 2026. High-risk obligations for stand-alone systems in Annex III apply from December 2, 2027. High-risk obligations for systems embedded in products covered by Annex I apply from August 2, 2028. If a memo on your desk still says August 2, 2027 for high-risk, that date is superseded and the memo needs correcting.

What the missing national Act changes is procedure, not substance. If you need to file a serious incident report, respond to an information request, or find a single point of contact for Croatia, the Croatian line in your register will be thinner than you would like, because the Article 70 designations were not identified in the national sources reviewed. Practically, that means keeping the Regulation's own obligations as your compliance baseline and treating the national contact question as something to re-check rather than something to answer once and close.

My own view, clearly marked as a view: it is tempting to read an unlegislated penalty regime as breathing room, and I think that is a poor thing to plan around. Penalty regimes arrive. Documentation you failed to create in 2026 does not become available retroactively in 2027, and a supervisor reading a file after the fact reads the whole file, not the part that was convenient to build once someone was watching. The asymmetry is not in your favour.

What to do about it

Concretely, four things.

First, correct the register entry. If your AI Act tracker lists Croatia with a named market surveillance authority, check the source. The defensible entry today is that the Article 77(2) fundamental-rights bodies are published, and that no Article 70 notifying or market surveillance authority was identified in the national sources reviewed as of August 3, 2026. Write it that way and it survives review.

Second, set a monitoring trigger on Narodne novine rather than on news coverage. The implementing Act becomes a fact when it is published there. A committee reading, a public consultation or a ministry announcement is progress, not enactment, and the distinction is the one that has cost people the most in this file already.

Third, watch the consultation. The draft will normally go out for public consultation before it reaches Parliament, and the MPUDT working-group page is where that surfaces. For a firm with material Croatian exposure, a consultation draft is the first moment you can see the proposed penalty structure and the proposed authority split, and the only moment you can comment on them.

Fourth, do not restructure anything around Croatia's timing. The duties you owe come from Regulation (EU) 2024/1689, and that Regulation applies in Croatia directly. The variable that a missing national statute controls is administration: who receives the filing, who inspects, who sets the fine within the range the Regulation contemplates. Building a compliance posture around an administrative gap is a bet on that gap staying open, and administrative gaps close quietly and without a transition period for the people who were relying on them.

Last verified: August 3, 2026 against the primary sources listed above.