{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","NIS2 Implementation in the EU"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Divjak Topic Bahtijarevic & Krka Law Firm","Anella Bukovic"]
[null,null,"Tena Pavelic"]
[]
[]
["NIS2 Implementation in the EU"]
[]
["Report Generated: 11/19/2025"]
[]
["View your report results on next tab"]

{"sheet":"NIS2 Implementation in the EU","index":1,"n_rows":6,"n_cols":2,"rows_kept":6,"cut":false,"hidden":false,"merged":[]}
["Question","Croatia"]
["NIS2 Implementation Status"]
["Status","Enacted"]
["Status of the NIS2 Implementation Act","The \nNIS2 Implementation Act was implemented through the adoption of the \nCybersecurity Act (\nOfficial Gazette No. 14/2024).\n"]
["If available, foreseeable significant deviations of the National Implementation Act from the NIS2 Directive","The \nCroatian Cybersecurity Act deviates from the \nNIS2 Directive registering requirements for subjects in its scope – according to its provisions, the competent authorities will notify subjects of their categorization as essential or important entities by February 2025 at the latest. The competent authorities can also request information (if needed for the purposes of categorization) from subjects and the subjects need to provide the requested information within 15 days of the receipt of the request.\nOther requirements are closely modeled after the \nNIS2 Directive, but there are several bylaws that would further specify the requirements that need to be adopted (some are currently in the public consultation phase).\nAnother deviation is that the \nCybersecurity Act introduced a self-assessment requirement for important entities that must be performed at least once every 2 years.\n"]
["Expected date of entry into force of the Implementation Act","The \nAct has been in force since 15 February 2024.\n"]