ISO Certification in Croatia: Accredited Audits for Tourism, Shipbuilding, IT, and Public Contractors
ISO certification in Croatia helps hotel groups and food suppliers show tour operators audited controls, gives Zagreb software firms an answer to client security checks, and supports bidders on EOJN RH tenders. Accredify Global audits Croatian organizations against ISO 9001, ISO 14001, ISO 22000, ISO 27001, and the other standards in our scope. We start every engagement with a free scoping review.
What ISO Certification in Croatia Gives Guests, Clients, and Contracting Authorities
ISO certification in Croatia is a finding by an accredited certification body that your management system meets an international standard and is used day to day. Our auditors sample your records, interview staff on shift, and visit hotels, kitchens, yards, plants, or offices. When the system conforms, you receive a certificate valid for three years. One surveillance audit a year keeps it current.
Tourism shapes the Croatian economy more than almost any other sector. Hotel groups, campsites, and marinas along Istria and Dalmatia serve guests booked through foreign tour operators and online platforms. Those partners check food hygiene, guest safety, and environmental practice. ISO 22000, ISO 9001, and ISO 14001 give a hotel one audited answer, and ISO 45001 covers the seasonal staff who arrive each spring.
The Adriatic coast also holds an industrial base. Shipyards in Rijeka, Split, and Pula build and repair vessels, and the ports of Rijeka and Ploče move cargo for Central and Southeast Europe. Shipowners, classification societies, and freight customers ask yards and terminal operators for ISO 9001, ISO 14001, and ISO 45001.
Zagreb is home to a fast-growing software and IT services sector. Product companies and development teams there sell to banks, telecoms, and retailers across the EU and the United States. Those clients send long security questionnaires. ISO 27001 settles most of them, and the Cybersecurity Act has made Croatian customers ask the same questions of their suppliers.
Inland, Slavonia and Baranja around Osijek and Vukovar grow grain, process meat and dairy, and make wood products. Pharmaceutical and food plants around Zagreb export across the region. These producers need ISO 22000, ISO 9001, and ISO 14001 for retail chains and export buyers.
Accredify Global is accredited by UAF, and our scope is published in the UAF directory. Croatia's national accreditation body is HAA, and the national standards body is HZN. When a tender or contract names a particular accreditation body, or asks for an equivalent, send us the clause before you book. We will confirm whether our certificate meets it.
Croatian Rules in 2026 That Shape Certification Requests
The Cybersecurity Act brought NIS2 into force early. Croatia's Cybersecurity Act (Official Gazette 14/2024) entered into force on 15 February 2024. A Regulation on Cybersecurity (Official Gazette 135/2024) followed in November 2024. The National Cyber Security Centre within the Security and Intelligence Agency, NCSC-HR, leads in most sectors. HNB, HANFA, and HAKOM supervise banking, financial market infrastructure, and electronic communications.
Entities are categorized by the authorities. Organizations do not self-register. Competent authorities notify each entity whether it is essential (ključni) or important (važni), and the first round was due by February 2025. Essential entities must have a cybersecurity audit at least every two years. Important entities run a self-assessment on the same cycle. A significant incident needs an early warning to the CSIRT within 24 hours and a full notification within 72 hours.
GDPR runs alongside a national implementation act. The Act on the Implementation of the GDPR (Official Gazette 42/2018) took effect on 25 May 2018, and AZOP enforces it. Personal data breaches still go to AZOP within 72 hours. The Act sets the age of digital consent at 16 and limits video surveillance recordings to six months in most cases. It also allows biometric attendance systems for employees only on strict conditions.
Sources: NIS2 transposition (NCSC-HR) · Croatia NIS2 obligations and fines (NIS Solutions) · Croatian GDPR implementation law (IAPP) · Public procurement in Croatia (Portal javne nabave)
Standards Croatian Buyers and Tenders Request
Requirements differ from client to client. In Croatia these standards come up most.
| Sector | What the buyer worries about | Usual standards |
|---|---|---|
| Hotels, campsites, and resort groups on the coast | Food hygiene, guest safety, and water and energy use | ISO 22000, ISO 9001, and ISO 14001 |
| Marinas and nautical charter operators | Environmental care and safe operations | ISO 14001 and ISO 45001 |
| Shipyards and marine engineering firms | Welding quality, yard safety, and waste | ISO 9001, ISO 45001, and ISO 14001 |
| Software, fintech, and IT service firms in Zagreb | Client data and supplier security under NIS2 | ISO 27001 and ISO 27701 |
| Banks, insurers, and payment firms | ICT risk and business continuity | ISO 27001 and ISO 22301 |
| Food, meat, and dairy processors in Slavonia | Food safety for retail chains and export | ISO 22000 and HACCP |
| Energy-intensive and manufacturing plants | Energy cost and emissions control | ISO 50001 and ISO 14001 |
Tour operators may also ask for their own sustainability or hygiene labels. Those are separate programs. An ISO system gives you the records to pass them, but it does not replace them.
A hotel group with properties in Split, Makarska, and Dubrovnik usually certifies all hotels under one system. The audit plan samples properties each year, and the head office is visited every time. Timing matters on the coast. Stage 2 works best in late spring or early autumn, when kitchens, pools, and housekeeping run at real volume but managers still have time to sit with an auditor.
How ISO Helps With Croatian Requirements
An ISO certificate is not a licence or a regulator's approval. It keeps the controls behind those approvals working all year.
| Rule or system | Who it reaches | How ISO supports it |
|---|---|---|
| Cybersecurity Act (OG 14/2024) | Essential and important entities named by the authorities | ISO 27001 supplies the risk management and incident process the Act expects |
| Regulation on Cybersecurity (OG 135/2024) | Entities preparing audits and self-assessments | ISO 27001 records feed the two-yearly audit or self-assessment |
| GDPR Implementation Act (OG 42/2018) | Every controller, including hotels using CCTV | ISO 27701 runs privacy duties and retention rules |
| Public Procurement Act (OG 120/2016) | Bidders on EOJN RH tenders | ISO 9001, ISO 14001, and ISO 45001 evidence quality and environmental measures |
| DORA (EU Regulation 2022/2554) | Banks, insurers, and their ICT providers | ISO 27001 and ISO 22301 support ICT risk and testing |
Some duties call for testing or a different scheme rather than certification. Our VAPT services and cyber security risk assessment report against recognized frameworks. Our NIS2 readiness service maps ISO 27001 controls to the Cybersecurity Act. Financial firms and their vendors can use our DORA readiness work. Our GDPR services help hotels and online sellers with guest data.
Planning a Certification Audit in Croatia
Local details that keep a Croatian audit on track.
Gather before Stage 1
- Court register (sudski registar) extract and OIB for each entity
- Hotels, yards, plants, and offices to include
- The tender documentation, client clause, or categorization letter
- Seasonal staff numbers and outsourced services
Timing on the coast and inland
- Offices work Monday to Friday
- June to September is peak season for tourism teams
- Statehood Day on 30 May and Victory Day on 5 August are holidays
- Records may be in Croatian; the audit can run in English
How ISO Certification in Croatia Works With Us
Six steps lead from the first conversation to a certificate a client can verify. Our certification process guide explains every stage.
Is the season about to start, or is an EOJN RH deadline close? Tell us the date and we will schedule around it.
Book a free scoping reviewWhat ISO Certification Costs in Croatia
Price depends on audit man-days per site and standard. They are listed in your proposal before you agree.
Raises audit time
- Many hotels or sites along the coast
- Large seasonal workforce
- Hot work, lifting, or dry-dock operations
- Each standard audited on its own
Lowers audit time
- One shared system across every property
- Food safety, quality, and environment audited together
- Records sorted before Stage 1
- Internal audit and management review done
What Croatian Organizations Ask Us First
Quick answers for hotel managers, yard directors, CISOs, and bid writers.
| Question | Our answer |
|---|---|
| Who accredits Accredify Global? | UAF, for the twelve standards in its directory. |
| Can all our hotels share one certificate? | Yes, as a multi-site certificate. |
| How does a client verify the certificate? | Through our verification page. |
| Do you write the system for us? | No. We audit only, which protects our impartiality. |
| How is the fee worked out? | From man-days per site, quoted in writing. |
FAQ: ISO Certification in Croatia
Answers on tourism, shipyards, the Cybersecurity Act, EOJN RH tenders, cost, and timing.
How do I get ISO certification in Croatia?
Start with the standard your client, tender, or partner asks for. Use the system until it produces records. Then book Stage 1 and Stage 2 with an accredited body, which issues a three-year certificate once you conform.
How long does ISO certification take in Croatia?
Organizations with a working system often certify 6 to 12 weeks after Stage 1. Many properties, several standards, or the summer season can stretch that.
How much does ISO certification cost in Croatia?
No list price applies. Your proposal is built from the man-days the scope needs, based on headcount, sites, risk, and standards.
Is Accredify Global accredited?
Yes. UAF accredits Accredify Global for twelve standards, including ISO 9001, ISO 14001, ISO 22000, ISO 27001, and ISO 45001.
Do EOJN RH tenders accept a UAF-accredited certificate?
Contracting authorities generally accept certificates from accredited bodies and equivalent evidence. If the tender names a specific body, send us the wording before booking.
Can a hotel be audited during the summer season?
Yes, though most hotels prefer May, June, or September. Kitchens and guest services are then running, but managers are less stretched than in July and August.
Does ISO 27001 satisfy the Cybersecurity Act?
Not by itself. It covers most risk management and incident handling duties. Categorization, incident reporting, and the two-yearly audit or self-assessment remain separate legal steps.
Who decides if we are an essential or important entity?
The competent authority for your sector, such as NCSC-HR, HNB, HANFA, or HAKOM. It notifies you directly rather than asking you to self-register.
How fast must a significant cyber incident be reported in Croatia?
Send an early warning to the competent CSIRT within 24 hours. A full incident notification follows within 72 hours.
How long can a hotel keep CCTV footage?
Under the GDPR Implementation Act, recordings may usually be kept for up to six months. Longer retention is allowed only for legal or similar proceedings.
Does ISO 27701 help with AZOP requirements?
Yes. It adds privacy roles, processing records, rights handling, and breach response to an ISO 27001 system.
Can parts of the audit be remote?
Document review and some interviews can be remote where the rules allow. Hotels, yards, kitchens, and plants are audited in person.
Which standard should a shipyard start with?
Most yards start with ISO 9001 and ISO 45001, because owners and class societies ask about quality and safety first. ISO 14001 usually follows.
Can one certificate cover Croatia and Slovenia or Bosnia and Herzegovina?
Yes, if all sites run one management system under the same organization. Each site is listed on the certificate.
Will Accredify Global write our procedures?
No. Certification bodies must remain impartial, so we audit and certify only. Your team or an independent consultant builds the system.
Show Guests, Clients, and Tender Panels an Audited Croatian Operation
Tell us your entities, sites, and the client, tender, or cybersecurity requirement. We will confirm the right ISO certification in Croatia and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global certification team.