EU AI Act in Croatia: Who Enforces It, and What Croatian Companies Must Do

If you run an AI system in Croatia and want to know which authority will inspect it, the honest answer in mid-2026 is: that is not yet fully settled. Croatia missed the EU's 2 August 2025 deadline for naming its market-surveillance authority, and a national implementing law is still being drafted. What is already certain is the obligation set itself — because the EU AI Act, Regulation (EU) 2024/1689, applies directly in Croatia whether or not a Croatian law exists yet.

This guide separates the two. It sets out the parts that already bind Croatian businesses, the parts Croatia still has to put in place, what is verified about enforcement and what is genuinely undecided, and the corrected compliance timeline after the Digital Omnibus deferral.

---

A Regulation, Not a Directive: Croatia Does Not "Transpose" It

The EU AI Act is a Regulation. It entered into force on 1 August 2024 and, under Article 288 of the Treaty on the Functioning of the European Union, applies directly in every Member State — Croatia included — without being rewritten into Croatian law. Croatian companies do not wait for a national statute before obligations bite.

The early obligations are already live across the EU, Croatia among them:

• Article 5 prohibited practices have applied since 2 February 2025 — social scoring, certain manipulative systems, untargeted facial-image scraping, and emotion recognition in workplaces and schools.
• Article 4 AI literacy — the duty to ensure staff who use AI have a sufficient understanding of it — has applied since the same date.
• General-purpose AI (GPAI) obligations under Chapter V have applied since 2 August 2025.

What Croatia still has to provide is the national scaffolding the Regulation expects each state to build: designated authorities, domestic penalty procedures, and the institutional plumbing for inspections. That is where Croatia is behind.

---

Who Enforces the EU AI Act in Croatia?

The Article 70 Authority Is Not Yet Designated

Article 70 of the Regulation required each Member State to designate, by 2 August 2025, a national competent authority — in practice a market-surveillance authority, a notifying authority, and a single point of contact for the EU AI Office. Croatia did not meet that deadline. Its Ministry of Justice, Administration and Digital Transformation acknowledged in mid-2025 that Croatia had not yet appointed its body and would be among the late states.

As of mid-2026, the position is best stated plainly: Croatia has not confirmed in law which authority will be its market-surveillance body for AI. The Ministry has signalled an intention to create a national "umbrella" AI regulator with a clear mandate, supported by sectoral bodies, and to pass an enabling law — but no statute has been published and no single authority has been confirmed. Treat any claim that Croatia "has designated its AI market-surveillance authority" with suspicion unless it cites an official Croatian or Commission source naming the body. The full Article 70 designation is still being finalised.

What Has Been Designated: The Fundamental-Rights Bodies

There is a separate designation that Croatia did complete, and it is easy to confuse with the one above. Under Article 77, Member States had to notify the public authorities that oversee fundamental-rights obligations relevant to high-risk AI. Croatia met that earlier deadline and notified a list of bodies, including the Personal Data Protection Agency, the Ombudswoman, the Ombudsman for Children, the Ombudsman for Gender Equality, the Ombudsman for Persons with Disabilities, the State Election Commission, and the Agency for Electronic Media.

This is a fundamental-rights oversight list, not the market-surveillance designation. A company should not read it as "these are the regulators who will inspect and fine my AI system" — that role is the unfilled Article 70 slot.

The Firmest Anchor: AZOP, the Data Protection Authority

The most settled institution in Croatia's AI enforcement picture is its data protection authority — AZOP, the Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency). AZOP is the established GDPR supervisor in Croatia and an active enforcer; it is also on the Article 77 fundamental-rights list. For any AI system that processes personal data — which covers most Annex III high-risk use cases — AZOP is the authority a Croatian company is most certain to encounter, through the GDPR if not yet through the AI Act.

Whether AZOP also becomes the AI Act market-surveillance authority is one of the open questions. Some Member States let their DPA double as AI supervisor; Croatia's Ministry has treated that as a live option, not a decision. So AZOP is a candidate, not a confirmed AI-Act designee.

The AI Office (Brussels): GPAI Stays at EU Level

For general-purpose AI models, enforcement does not run through any Croatian authority at all. GPAI model providers are supervised directly by the EU AI Office in Brussels under Articles 53 and 55, with fines imposed by the Commission under Article 101. A Croatian company that merely uses a general-purpose model is a deployer of whatever system it builds — it is not a GPAI provider and does not answer to the AI Office for the model itself.

---

The Croatian Enforcement Timeline (After the Digital Omnibus)

One caveat must travel with the high-risk dates. Under the Digital Omnibus package, the European Parliament and Council reached political agreement on 6–7 May 2026 to defer the stand-alone high-risk regime to 2 December 2027 (and product-embedded high-risk AI to 2 August 2028). That deferral is now adopted — the European Parliament approved it on 16 June 2026 and the Council formally adopted it on 29 June 2026, with entry into force on EU Official Journal publication, expected before 2 August 2026. Stand-alone high-risk Annex III systems now apply from 2 December 2027. Note also that the deferral is fixed calendar dates — it is not tied to the availability of harmonised standards.

---

Penalties: What Croatian Companies Actually Face

The penalty framework is Article 99 of the Regulation. Croatia's missing implementing law affects the procedure for imposing fines, not the ceilings — those are set by the Regulation and are identical across the EU. There are exactly three tiers, each "whichever is higher" of a fixed sum or a percentage of total worldwide annual turnover:

• €35,000,000 or 7% — for breaching the Article 5 prohibitions.
• €15,000,000 or 3% — for most other breaches: high-risk requirements (Articles 9–15), provider duties (Article 16), deployer duties (Article 26), and Article 50 transparency.
• €7,500,000 or 1% — for giving incorrect, incomplete, or misleading information to a notified body or authority.

The third tier is 1%, not 1.5% — there is no 1.5% tier anywhere in the Regulation, and no Croatia-specific fine figures exist. For SMEs and start-ups, Article 99(6) is the reassurance that matters: the fine is the lower of the fixed amount or the percentage. A Croatian company with €8 million turnover does not face a €15 million fine for a high-risk breach — 3% of €8 million is €240,000, and that is the ceiling.

GPAI-specific fines are separate: up to €15 million or 3%, imposed by the Commission under Article 101 on the model provider, not by any Croatian authority.

---

Worked Example: A Zagreb HR-Tech Company

Consider Kadrovik d.o.o., a fictional Zagreb-based HR software firm — roughly 60 employees, about €9 million annual turnover — that sells an AI-assisted CV-screening tool to mid-sized Croatian and regional employers.

CV-screening for recruitment is an Annex III high-risk use case (employment and worker management). Because Kadrovik develops the tool and places it on the market under its own name, it is a provider under Article 16 — the heavier role — not merely a deployer. Its obligations include an Article 9 risk-management system, Annex IV technical documentation, an Article 43 conformity assessment, human oversight under Article 14, and registration under Article 49.

What about the enforcer? Today, no Croatian AI market-surveillance authority is confirmed — so Kadrovik cannot yet name "its" AI regulator. But the tool processes candidates' personal data, so AZOP already supervises it under the GDPR, and Article 35 of the GDPR already requires a Data Protection Impact Assessment. The sensible sequence for Kadrovik: build the AI Act documentation now against the 2 December 2027 high-risk date, keep the GDPR and AI Act assessments aligned, and watch for Croatia's implementing law to confirm who inspects. On turnover of €9 million, its worst-case high-risk exposure is 3% — about €270,000 — not the headline €15 million.

---

How Confir Helps Croatian Companies

A Croatian compliance team facing an unsettled enforcement landscape still has a fixed obligation set to document: an AI inventory, Article 6 classification with the Annex III logic, role assignment, Article 9 risk records, the Annex IV technical file, the Article 27 fundamental-rights impact assessment where it applies, and Article 72 post-market monitoring.

Confir is EU-hosted compliance software built for exactly this work. Its classification engine is rule-based and deterministic — it encodes Articles 5 and 6 with Annex III logic as explicit rules, so the same intake always yields the same finding with a human-readable explanation of which rule fired. It generates the Annex IV technical-documentation pack and the Article 47 / Annex V Declaration of Conformity, and runs the Article 27 assessment. The structured review spans four areas: risk classification, data and technical robustness, transparency and human oversight, and governance and post-market monitoring.

---

What Croatian Companies Should Do Now

Immediately: Audit for any Article 5 prohibited practice — these are enforceable now, regardless of Croatia's missing authority. If a system fits a prohibited category and no exemption applies, stop or restructure it.

Before 2 August 2026: Bring chatbots, voice assistants, and AI content tools into line with Article 50 transparency — users must be told when they are dealing with AI or synthetic content.

Through 2026–2027: Build the AI inventory, classify systems under Article 6 with the Article 6(3) filter, assign provider or deployer roles, and start the documentation for any high-risk system, planning against 2 December 2027, the now-adopted high-risk deadline.

Ongoing: Track Croatia's implementing law and the eventual Article 70 designation — that is what will tell you, finally, which authority inspects your AI. Until then, treat AZOP and the GDPR as the firmest fixed point.

---

Related guides

• Who enforces the EU AI Act
• EU AI Act fundamentals
• EU AI Act penalties explained
• Provider vs deployer obligations
• Compliance guide for small businesses
• The EU AI Act in the Czech Republic
• The EU AI Act in Poland