Where we work · Croatia
ISO and GRC certification consulting in Croatia
Achieve ISO and GRC certification in Croatia with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Croatia
Clients include
ISO and GRC certification in Croatia at a glance
Why do organisations in Croatia seek ISO and GRC certification? Mostly because EU rules arrive through national acts and because export buyers ask for proof. The Cybersecurity Act, NN 14/2024, transposes NIS2 and, through its 2024 Regulation, places key and important entities on basic, intermediate or advanced measure levels. AZOP supervises the GDPR under the Implementation Act, HNB and Hanfa supervise DORA, and HALMED keeps the medical device registers. The food hygiene Act requires HACCP-based systems, while the Public Procurement Act steers contracting authorities toward quality and environmental systems certified by accredited bodies. Any certificate is issued by a certification body accredited by HAA, the national accreditation body, and never by Sterling. Demand is strongest in tourism and hospitality, food and beverage production, software and ICT, financial services, pharmaceuticals and medical devices, automotive parts and logistics. Croatian clients are served from Sterling's Frankfurt office, backed by 8,100+ client engagements in 60+ countries and 20+ years of experience, and Effivity and Sterling Academy come with the engagement.
ISO and GRC standards Sterling delivers in Croatia
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Croatia (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the GDPR Agencija za zaštitu osobnih podataka (AZOP, the Personal Data Protection Agency) — the Act names it as the supervisory authority under the GDPR and describes it as an independent state body, autonomous in its work and accountable to the Croatian Parliament, with its seat in Zagreb | The Act ensures implementation of the GDPR. It excludes processing by competent authorities for criminal-law purposes and the areas of national security and defence, and it adds national rules on children's consent for information society services, genetic data in life insurance, biometric data, video surveillance and official statistics. | |
| Accreditation of GDPR certification bodies The national accreditation body appointed under Regulation (EC) No 765/2008 (in Croatia, HAA) — the Act makes it the authority competent to accredit certification bodies under the GDPR | The Act ties accreditation of data protection certification bodies to the national accreditation body, and requires AZOP's annual report to cover its work on codes of conduct and certification. | |
| Croatian rules on video surveillance, biometric data and children's consent AZOP | For private-sector biometric processing the Act sets conditions and, for identifying service users, requires explicit consent; it allows biometric time-and-attendance processing of employees where the Act's conditions are met. Video surveillance must have a necessary and justified purpose, carry a visible notice, be protected from unauthorised access with an automated access log, and respect extra conditions for workplaces, residential buildings and public areas. Consent by a child for information society services is lawful from sixteen. | |
| The central state body for cyber security (the Act names the Security and Intelligence Agency, SOA), the central state body for information security (the Office of the National Security Council), the Information Systems Security Bureau (ZSIS) for technical areas, the Croatian Regulatory Authority for Network Industries for electronic communications, and the ministries responsible for digital society, science and education, each in its own sector; HNB, Hanfa and the Croatian Civil Aviation Agency apply their own sector laws Key and important entities in the sectors the Cybersecurity Act lists (the Croatian NIS2 transposition): energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management for businesses, public administration, space, postal and courier services, waste management, chemicals, food, manufacturing (medical devices, computers and electronics, electrical equipment, machinery, motor vehicles and other transport equipment), digital providers, research and education | Zakon o kibernetičkoj sigurnosti (NN 14/2024), which states that it transposes Directive (EU) 2022/2555, and Uredba o kibernetičkoj sigurnosti (NN 135/2024). ZSIS states that the Act is in force since 15 February 2024 and the Regulation since 30 November 2024. The Regulation assigns each key or important entity one of three levels of risk-management measures (basic, intermediate or advanced) after a national risk assessment, and the Act provides for self-assessment, cyber security audits by certified auditors and a declaration of conformity. The Act's measures do not name ISO/IEC 27001, but the Regulation has ZSIS publish a mapping of the measures to the main European and international standards. | ISO/IEC 27001, ISO 22301 |
| HNB (Hrvatska narodna banka, the Croatian National Bank) and Hanfa (Hrvatska agencija za nadzor financijskih usluga, the Croatian Financial Services Supervisory Agency) — the Cybersecurity Act names them as the authorities for their sectors' special laws Financial entities (banks, investment firms, insurers, payment and other entities within DORA's scope) | Regulation (EU) 2022/2554 (DORA) and Croatia's implementing Act (NN 136/2024). HNB states that DORA applies from 17 January 2025 and covers ICT risk management, reporting of major ICT incidents, resilience testing, ICT third-party risk and information sharing. HNB's page does not name ISO/IEC 27001. | |
| HALMED (Agencija za lijekove i medicinske proizvode, the Agency for Medicinal Products and Medical Devices) Medical device manufacturers, distributors and other economic operators | The Act on the Implementation of Regulation (EU) 2017/745 and Regulation (EU) 2017/746 (NN 100/18). HALMED's English pages say it keeps the registers of medical devices on the Croatian market and of related economic operators and runs the vigilance system. They do not name ISO 13485. | |
| The ministry responsible for agriculture and the ministry responsible for health, each within its remit — the Act on Food Hygiene and Microbiological Criteria for Food names them as the competent authorities Food businesses | Zakon o higijeni hrane i mikrobiološkim kriterijima za hranu (NN 81/2013) and Regulation (EC) No 852/2004. The Act requires food business operators to establish, implement and maintain systems and procedures based on the HACCP principles and has the ministries encourage and assess national guides to good hygiene practice and HACCP. Neither source makes a third-party certificate compulsory. | HACCP |
| The labour inspection authorities and the ministry responsible for labour, as the Occupational Safety Act names them Employers (occupational health and safety) | Zakon o zaštiti na radu (NN 71/2014, text as published). The Act sets minimum occupational safety requirements, requires the employer to carry out a risk assessment and organise occupational safety, and provides for safety professionals and an occupational safety committee in larger employers. It does not name ISO 45001. Check the current consolidated text with counsel. | |
| Ministarstvo gospodarstva (Ministry of Economy) Manufacturers and the wider industrial base | National Industrial Development Plan 2027–2034 with its Action Plan. Invest Croatia reports that the Government adopted them, with objectives for a competitive and export-oriented industry, a clean industry and a resilient industry, and measures that include modernisation, digitalisation, higher energy efficiency and renewable energy use. The Plan does not name any ISO standard. | |
| EU framework; the national supervisory arrangements are for the competent Croatian authorities to confirm Providers and deployers of AI systems | Regulation (EU) 2024/1689 (Artificial Intelligence Act), which lays down harmonised rules on artificial intelligence. It is a regulation, not a certification scheme, and it does not name ISO/IEC 42001. |
Accreditation and recognition
- HAA (Hrvatska akreditacijska agencija, the Croatian Accreditation Agency): National accreditation body — HAA describes itself as an independent, non-profit public institution that performs the national accreditation service of Croatia.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Public Procurement Act (Zakon o javnoj nabavi, NN 120/16, as amended) (Contracting authorities (javni naručitelji) under the Act): Each contracting authority sets its own conditions. In the Act as published, a contracting authority that asks for independent certificates on quality assurance must refer to systems based on the relevant European standard series and certified by accredited bodies, and one that asks for environmental management certificates must refer to EMAS, other recognised systems or standards certified by accredited bodies; equivalent certificates from other member states must be accepted. Mandatory exclusion grounds include final convictions for corruption, with room for the operator to show reliability measures.
Economic zones
- Business zones listed by the Ministry of Economy: manufacturing, logistics and distribution, software and ICT centres
- Tourism and hospitality along the Adriatic coast: hotels and resorts, nautical tourism, gastronomy and health tourism
- Food and beverage production: food processing, beverages
- Software, ICT and shared-service development: software development, ICT services, information systems
- Automotive parts and metal processing: automotive parts, metal processing, plastics and glass
- Pharmaceutical industry: pharmaceutical manufacturing, research and development
- Logistics and transport corridors: logistics, port and river transport, distribution centres
Sterling in Croatia
Sterling delivers in Croatia from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Croatia clients ask
Are certification audits in Croatia conducted in Croatian or English?
Either, and the certification body fixes the audit language with you when you apply. Croatian is the official language while English is widely used in business, so audits often combine both. Tell the body early which language its auditors must read in your records and controlled documents, and follow any rule from a customer contract or regulator.
Is the Croatian NIS2 law in force?
Yes. The Cybersecurity Act (NN 14/2024) states that it transposes the NIS2 Directive, and the Information Systems Security Bureau says it has been in force since 15 February 2024, with the implementing Regulation in force since 30 November 2024. Whether your organisation is a key or important entity, and at which measure level, is for the competent authority or your counsel to confirm.
Which authority supervises the GDPR in Croatia?
The Agencija za zaštitu osobnih podataka, known as AZOP. The Implementation Act names it as the supervisory authority and calls it an independent state body accountable to the Croatian Parliament. The same Act adds national rules on video surveillance, biometric data and children's consent. For a specific processing activity, ask AZOP or your counsel.
Which body accredits certification bodies in Croatia?
HAA, the Croatian Accreditation Agency, is the national accreditation body. Its own pages list its signature of the EA multilateral agreement for management system, product and person certification, and its public Register of Accreditations lets you check a body's status. Recognition is by scope, so confirm that the body you choose is accredited for your standard and sector.
Can Croatian public buyers ask for ISO certificates?
Yes, but each contracting authority writes its own conditions. When a tender asks for quality or environmental certificates, the Public Procurement Act directs it to systems certified by accredited bodies, accepts EMAS for environmental management and requires equivalent certificates from other member states to be recognised. Read the tender documents and take legal advice on a specific procedure.
Can Croatian employers use biometric time clocks?
Can a Croatian company use biometric time clocks for its staff? Sometimes. The Implementation Act allows biometric processing of employees to record working time and entry or exit where a law prescribes it, or where it is an alternative to another solution and the employee gives explicit consent. The impact assessment duty still applies, so check with AZOP or counsel.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the GDPR — narodne-novine.nn.hr; azop.hr; eur-lex.europa.eu (accessed 18 Oct 2026)
- Accreditation of GDPR certification bodies — narodne-novine.nn.hr (accessed 18 Oct 2026)
- Croatian rules on video surveillance, biometric data and children's consent — narodne-novine.nn.hr (accessed 18 Oct 2026)
- Zakon o kibernetičkoj sigurnosti (NN 14/2024), which states that it transposes Directive (EU) 2022/2555, and Uredba o kibernetičkoj sigurnosti (NN 135/2024). ZSIS states that the Act is in force since 15 February 2024 and the Regulation since 30 November 2024. The Regulation assigns each key or important entity one of three levels of risk-management measures (basic, intermediate or advanced) after a national risk assessment, and the Act provides for self-assessment, cyber security audits by certified auditors and a declaration of conformity. The Act's measures do not name ISO/IEC 27001, but the Regulation has ZSIS publish a mapping of the measures to the main European and international standards. — narodne-novine.nn.hr; zsis.hr (accessed 18 Oct 2026)
- Regulation (EU) 2022/2554 (DORA) and Croatia's implementing Act (NN 136/2024). HNB states that DORA applies from 17 January 2025 and covers ICT risk management, reporting of major ICT incidents, resilience testing, ICT third-party risk and information sharing. HNB's page does not name ISO/IEC 27001. — hnb.hr; hanfa.hr; narodne-novine.nn.hr (accessed 18 Oct 2026)
- The Act on the Implementation of Regulation (EU) 2017/745 and Regulation (EU) 2017/746 (NN 100/18). HALMED's English pages say it keeps the registers of medical devices on the Croatian market and of related economic operators and runs the vigilance system. They do not name ISO 13485. — halmed.hr (accessed 18 Oct 2026)
- Zakon o higijeni hrane i mikrobiološkim kriterijima za hranu (NN 81/2013) and Regulation (EC) No 852/2004. The Act requires food business operators to establish, implement and maintain systems and procedures based on the HACCP principles and has the ministries encourage and assess national guides to good hygiene practice and HACCP. Neither source makes a third-party certificate compulsory. — narodne-novine.nn.hr; eur-lex.europa.eu (accessed 18 Oct 2026)
- Zakon o zaštiti na radu (NN 71/2014, text as published). The Act sets minimum occupational safety requirements, requires the employer to carry out a risk assessment and organise occupational safety, and provides for safety professionals and an occupational safety committee in larger employers. It does not name ISO 45001. Check the current consolidated text with counsel. — narodne-novine.nn.hr (accessed 18 Oct 2026)
- National Industrial Development Plan 2027–2034 with its Action Plan. Invest Croatia reports that the Government adopted them, with objectives for a competitive and export-oriented industry, a clean industry and a resilient industry, and measures that include modernisation, digitalisation, higher energy efficiency and renewable energy use. The Plan does not name any ISO standard. — investcroatia.gov.hr (accessed 18 Oct 2026)
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), which lays down harmonised rules on artificial intelligence. It is a regulation, not a certification scheme, and it does not name ISO/IEC 42001. — eur-lex.europa.eu (accessed 18 Oct 2026)
- HAA (Hrvatska akreditacijska agencija, the Croatian Accreditation Agency) — akreditacija.hr (accessed 18 Oct 2026)
- Public procurement under the Public Procurement Act (Zakon o javnoj nabavi, NN 120/16, as amended) — narodne-novine.nn.hr; azop.hr (accessed 18 Oct 2026)
- Business zones listed by the Ministry of Economy — investcroatia.gov.hr (accessed 18 Oct 2026)
- Tourism and hospitality along the Adriatic coast — investcroatia.gov.hr (accessed 18 Oct 2026)
- Food and beverage production — investcroatia.gov.hr (accessed 18 Oct 2026)
- Software, ICT and shared-service development — investcroatia.gov.hr (accessed 18 Oct 2026)
- Automotive parts and metal processing — investcroatia.gov.hr (accessed 18 Oct 2026)
- Pharmaceutical industry — investcroatia.gov.hr (accessed 18 Oct 2026)
- Logistics and transport corridors — investcroatia.gov.hr (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice