Beyond the webshop: what the law requires of every kind of site

Public sector: municipalities, cities, tourist boards

Regional and local tourist boards are public sector bodies. That puts them under the Zakon o pristupačnosti mrežnih stranica i programskih rješenja za pokretne uređaje tijela javnog sektora, NN 17/19, which transposes Directive (EU) 2016/2102 and has been in force since 23 September 2019.

Three articles do most of the work.

• Art. 7 sets the standard: content is presumed conformant when it meets the harmonised European standard EN 301 549, which carries WCAG 2.1 Level AA inside it.
• Art. 9 requires you to publish and regularly update a detailed, comprehensive and clear accessibility statement, provide a feedback route, and point at the supervisory body.
• Art. 3(1) lists who is outside the act, and it is a short list.

One correction on Art. 9, because the wrong version circulates widely: the Croatian text says redovito ažurirati - regularly. It does not say annually. Reviewing it once a year is sound practice and it is what most bodies do, but do not cite the statute for a word it does not contain.

The deadlines are long past. A site published before 23 September 2018 had to conform by 23 September 2020; mobile applications by 23 September 2021.

Separately, the Zakon o pravu na pristup informacijama, NN 25/13, 85/15, 69/22, requires a public section explaining how citizens request information, naming the information officer and carrying the official request forms. This one gets forgotten more often than accessibility does, because no automated tool flags it.

Companies with no webshop at all

Consulting, B2B services, a portfolio site. No cart, no checkout, and still regulated.

Zakon o trgovačkim društvima Art. 21 requires business papers and the content of the company website to carry:

That has applied to websites since 1 April 2008. Failing it is an offence under Art. 630(1)(2), the same provision that covers not using your registered company name in business.

A note on the fine, because this is where most Croatian articles on the subject go wrong: the amounts were redenominated when Croatia adopted the euro on 1 January 2023. If you find a figure quoted in kuna, the page has not been updated since - read the current consolidated text instead of trusting the number.

GDPR and ePrivacy apply here too, and more often than people expect. If your site loads Google Analytics, a Meta pixel, or a font from a third-party CDN, you are processing personal data: the visitor's IP address leaves their browser before they have agreed to anything. That needs a privacy policy stating what you collect, why, for how long and who else receives it - and a consent mechanism that actually blocks those scripts until the visitor says yes. Pre-ticked boxes are not consent, and refusing has to be exactly as easy as accepting: one click, same screen, no maze.

Micro-enterprise webshops

This is where the confusion concentrates. The Zakon o zahtjevima za pristupačnost proizvoda i usluga, NN 89/2025 - Croatia's transposition of Directive (EU) 2019/882, in force since 28 June 2025 - does not apply to micro-enterprises providing services. That is Art. 4(2).

The threshold in Art. 5(18) is worth reading slowly, because it is routinely quoted wrong. It is fewer than ten employees on average annually and either annual income up to EUR 2m or total assets up to EUR 2m. Headcount AND (income OR assets) - not three conditions in a row. A shop with six people and EUR 3m of income is still exempt if its total assets sit below EUR 2m. We went through the whole thing article by article in Who NN 89/2025 actually binds.

Being outside that act does not put you outside the Zakon o elektroničkoj trgovini, NN 173/03, 67/08, 36/09, 130/11, 30/14, 32/19. Where you display a price it has to be clear and unambiguous, and it has to state whether delivery costs, other handling costs and taxes are included.

There is also a practical point about the exemption. It is measured on your figures, and your figures move. Hire the tenth person, or take a public-sector contract where procurement rules import the accessibility requirement anyway, and the exemption stops applying to a site that was never built for it. Retrofitting accessibility into a finished checkout costs several times what building it in would have.

Associations and non-profits

Under Art. 3(1) of NN 17/19, civil society organisations sit outside the public-sector accessibility act - unless they provide services essential to the public, or services aimed at people with disabilities. That carve-out from the carve-out is narrower than it first reads: an association running a public helpline may well be inside the act.

GDPR exempts nobody. Associations hold membership lists with names, OIBs and payment records, which is a more sensitive dataset than most small companies handle. Retention periods and who can see the list are the two things to write down first, because they are the two questions a complaint will start with.

If your site carries other people's content

A marketplace with third-party sellers, a forum, a comments section anyone actually uses - the Digital Services Act sits on top of everything above. Published terms of service, a working mechanism for reporting illegal content, and a statement of reasons when you take something down. The heavy transparency reporting scales with your user numbers; the notice-and-action mechanism does not.

What it comes down to

Every category above has at least one obligation that lives in the markup rather than in a policy document: a conformant statement page, an impressum block, a consent gate that fires before the script does, a price that says what it includes. All of them are cheap while the site is being built and expensive once it is finished.

This is information, not legal advice. Where a decision matters, check the current text of the law or ask a lawyer.