Croatia: Fiscalization Technical Specification Version 2.7 Withdraws RSA-SHA1 and TLS 1.1, and the Fiscalization Application Certificate Will Be Replaced on September 8, 2026

Country Update — Croatia  |  11 August 2026  |  Topic: Fiscalization / E-Invoicing

The Croatian Tax Administration has published version 2.7 of the Technical Specification for users of fiscalization of invoices in final consumption, announced on July 6, 2026 with the specification document itself carrying July 21, 2026.

It withdraws RSA-SHA1 signing and TLS version 1.1 from the test environment from July 1, 2026 and from production from January 1, 2027, permitting dual RSA-SHA1 and RSA-SHA256 signing in production only until December 31, 2026.

Separately, on August 4, 2026 the Tax Administration announced that the fiscalization application certificate will be replaced at 05:00 on September 8, 2026, with the new public key available for download from September 1, 2026. Both are hard technical dates enforced by connection failure rather than by penalty.

Background

Croatia’s Fiscalization 2.0 program, introduced by the new Fiscalization Act, extended fiscalization from cash transactions to non-cash invoices and layered mandatory domestic electronic invoicing and electronic reporting on top of it, using a five-corner Peppol-based model.

KGT has reported on the framework, on the road to electronic invoicing and electronic reporting, and most recently on the upgrade to the FiskApplication of July 2026.

The fiscalization architecture depends on cryptography in two distinct places, and both are changing. The first is the signature a taxpayer applies to messages it sends to the Tax Administration, together with the transport layer securing the connection.

The second is the certificate the Tax Administration itself uses, whose public key taxpayers hold to verify the Administration’s responses. A change in the first requires the taxpayer to change its own software; a change in the second requires the taxpayer to install a new public key by a fixed time.

The Technical Specification for users of fiscalization of invoices in final consumption is the document that governs the first of these. It is versioned independently of the legislation, and it is the document against which a taxpayer’s messages either succeed or fail.

The base regulation on fiscalization remains the instrument published in the Official Gazette at number 153/2025, and no amendment to it was identified in the period covered by this update.

It is worth correcting one point of attribution that has circulated. Reports have described a FiskApplication upgrade of July 17, 2026. There is no such announcement.

The Tax Administration’s mid-July item of that date concerns something different: electronic completion of the PDV-P form for value added tax refunds in passenger traffic, published on July 15, 2026 and live from 00:00 on July 17, 2026.

That is a genuine and useful development, but it is a refund digitalization measure rather than a fiscalization application release. The current FiskApplication user guide is version 10.0, dated June 19, 2026 and published June 29, 2026; the last substantive functional release was announced on April 16, 2026; and the Tax Administration publishes no numeric version number for the application itself, describing releases only as additional refinements.

The Legislative Change

Neither development is a legislative change. Both operate within the existing framework of the Fiscalization Act and the fiscalization regulation, and neither alters any substantive obligation. They are binding in practice for a reason specific to fiscalization: the obligation is discharged by a successful exchange with the Tax Administration, and a cryptographic mismatch prevents that exchange from happening at all.

A taxpayer whose signing algorithm has been withdrawn, or whose transport layer version is no longer accepted, or which holds a superseded public key, does not fail to comply in a way that produces an assessment. It simply stops being able to fiscalize.

Version 2.7 of the Technical Specification for users of fiscalization of invoices in final consumption was announced on July 6, 2026, and the specification document carries July 21, 2026 in its published label. One point of caution belongs here: there is no news item on July 21 and no official explanation of the discrepancy between the announcement date and the document date, so organizations should treat July 21, 2026 as the document date and July 6, 2026 as the announcement date, and should verify the version they are working from.

The substance of version 2.7 is the withdrawal of legacy cryptography on a staged timetable. RSA-SHA1 signing and TLS version 1.1 were withdrawn from the test environment from July 1, 2026. They will be withdrawn from production from January 1, 2027. In the intervening period, dual signing with both RSA-SHA1 and RSA-SHA256 is permitted in production until December 31, 2026.

The practical reading is that the test environment has already moved, and that any taxpayer testing against it after July 1, 2026 must already be using RSA-SHA256 and TLS 1.2 or above. Production tolerance ends with the calendar year.

The second development concerns the Tax Administration’s own certificate. On August 4, 2026 the Tax Administration announced that the certificate of the Fiskalcis application will be replaced at 05:00 on September 8, 2026.

The new public key will be available for download from September 1, 2026, either through the certificate search facility of the financial agency FINA or from the Tax Administration’s own site. This is an unusually precise operational instruction: it names a time of day, and it opens a one-week window in which the new key can be obtained before the switch.

A taxpayer that has not installed the new public key by 05:00 on September 8, 2026, should expect verification of the Tax Administration’s responses to fail from that moment.

Depending on how a given implementation handles a verification failure, that may manifest as an inability to confirm fiscalization, as an error state, or as a halt. None of those outcomes is acceptable in a live retail or invoicing environment, and all of them are avoidable by a change made in the preceding week.

Scope

Both developments apply to every user of Croatian fiscalization of invoices in final consumption. That population is broad: it includes retail and hospitality operations fiscalizing cash transactions, and, under Fiscalization 2.0, businesses fiscalizing non-cash invoices. There is no size threshold and no exemption based on transaction volume.

The cryptographic withdrawal applies to the taxpayer’s own signing and transport configuration. Where fiscalization is performed by a third-party point-of-sale or middleware product, the change falls on that product, but the compliance consequence falls on the taxpayer.

Where fiscalization is performed from an enterprise system such as SAP, the change falls within the taxpayer’s own landscape and needs to be planned as an internal change.

The certificate replacement applies to every implementation that verifies the Tax Administration’s responses, which is to say every properly implemented integration. It is a one-time action with a fixed deadline, and it is the item in this update most likely to cause an outage if missed.

The electronic PDV-P form, live from July 17, 2026, has a narrower scope: it applies to sellers making refunds of value added tax in passenger traffic to buyers with no residence or habitual abode in the European Union. It allows the form to be completed electronically, with a barcode enabling customs officers at the exit office to retrieve the data automatically.

Separately, a draft bill amending the Value Added Tax Act, transposing Council Directive (EU) 2025/516 with application from January 1, 2027 and improving and extending the existing one-stop shop and import one-stop shop schemes, has been opened for consultation on the Government’s consultation portal by the Ministry of Finance. That portal is a client-rendered application and its opening and closing dates could not be verified, so the consultation dates and the bill’s detailed content should be treated as unconfirmed at the time of writing.

Timeline

• January 16, 2026 — FiskApplication additional refinements announced, including CSV export and an updated user guide.
• April 16, 2026 — last substantive FiskApplication functional release announced, adding issuer identification number in inbound invoice results, business premises free-text search, CSV and XLSX export, and a new awaiting-matching status.
• June 19, 2026 — FiskApplication user guide version 10.0 dated; published June 29, 2026.
• July 1, 2026 — RSA-SHA1 signing and TLS version 1.1 withdrawn from the test environment.
• July 6, 2026 — Tax Administration announces technical improvements in the fiscalization system, comprising version 2.7 of the Technical Specification.
• July 15, 2026 — Tax Administration publishes notice of electronic completion of the PDV-P form for value added tax refunds in passenger traffic.
• July 17, 2026 — electronic PDV-P completion live from 00:00.
• July 21, 2026 — date carried by the published version 2.7 Technical Specification document.
• August 4, 2026 — Tax Administration announces replacement of the Fiskalcis application certificate.
• September 1, 2026 — new public key available for download via FINA certificate search or the Tax Administration site.
• September 8, 2026 at 05:00 — the Fiskalcis application certificate is replaced.
• December 31, 2026 — last day on which dual RSA-SHA1 and RSA-SHA256 signing is permitted in production.
• January 1, 2027 — RSA-SHA1 signing and TLS version 1.1 withdrawn from production; separately, the reported application date of the draft Value Added Tax Act amendment transposing Directive (EU) 2025/516.

Businesses Affected

Every business fiscalizing in Croatia is affected by both developments. In practice the risk concentrates in three groups.

The first is businesses whose fiscalization runs through legacy point-of-sale software or an older middleware component. RSA-SHA1 and TLS 1.1 are old technologies, and an implementation still using them in mid-2026 is by definition one that has not been maintained.

Those are the implementations least likely to be upgraded in time and least likely to have an owner monitoring Tax Administration announcements.

The second is businesses fiscalizing from an enterprise system, where the change is internal and therefore requires an internal change request, a test cycle and a release window. September 8 and January 1 are both awkward dates in most change calendars, and the certificate change in particular allows only a one-week window between key availability and cutover.

The third is businesses that have recently completed testing. Because the test environment moved on July 1, 2026 while production tolerance runs to December 31, 2026, a taxpayer can pass in production while failing in test, or can have tested successfully in June against a configuration that the test environment no longer accepts. Any test evidence dated before July 2026 should be treated as stale.

Sellers operating value added tax refunds in passenger traffic are affected by the electronic PDV-P facility, which is an operational improvement rather than an obligation, but one that changes the interaction with customs at the exit office.

Required Actions

• Diarize September 8, 2026 at 05:00 as a hard cutover and plan to install the new Fiskalcis public key during the week beginning September 1, 2026. This is the single most time-critical action in this update and the one most likely to cause an outage if missed.
• Identify who in your organization or supply chain is responsible for the public key, and confirm in writing that they are aware of the date. In practice this responsibility is frequently unassigned because certificate replacements are rare.
• Confirm your current signing algorithm and transport layer version. If either is RSA-SHA1 or TLS 1.1, plan the upgrade to RSA-SHA256 and TLS 1.2 or above now rather than in December.
• Obtain version 2.7 of the Technical Specification for users of fiscalization of invoices in final consumption and verify the version you hold, noting the discrepancy between the July 6 announcement and the July 21 document date.
• Test against the test environment. Because the test environment withdrew legacy cryptography on July 1, 2026, a successful test is now direct evidence that your production configuration will survive January 1, 2027.
• Treat any fiscalization test evidence dated before July 2026 as superseded, and re-run it.
• Where fiscalization is performed by a third-party product, obtain the vendor’s written confirmation that it supports RSA-SHA256 and TLS 1.2 or above, that it will handle the September 8 certificate replacement, and by what date.
• Confirm that your FiskApplication user guide is version 10.0 of June 19, 2026, and note that the Tax Administration publishes no numeric version for the application itself.
• Where relevant, evaluate the electronic PDV-P facility for value added tax refunds in passenger traffic, live since July 17, 2026.
• Monitor the Government consultation portal for the draft Value Added Tax Act amendment transposing Directive (EU) 2025/516, and treat currently circulating detail on its content and consultation dates as unconfirmed.

Practical Implications

These are unglamorous developments, and they carry more immediate operational risk than most legislative news. A certificate replacement at a named hour, three weeks out, is a scheduled outage for anyone who does not act. It will not generate a penalty, an assessment, or a notice. It will generate an inability to fiscalize, which in a Croatian retail environment means an inability to trade normally.

The staged cryptography withdrawal is the more interesting design decision. By moving the test environment six months ahead of production, the Tax Administration has created a facility that few taxpayers seem to be using: a way to establish today, at no risk, whether the configuration will survive January 1, 2027.

Organizations that test now convert a future outage into a present work item. Organizations that do not will discover the problem on the first working day of 2027, which is among the worst possible moments in a retail calendar.

There is a governance point here that generalizes beyond Croatia. Cryptographic dependencies in fiscalization and clearance regimes are typically owned by nobody in particular. The tax function does not regard a signing algorithm as its concern; the technology function does not monitor tax authority announcements.

The result is a class of compliance failure that is entirely predictable, entirely avoidable, and reliably missed. Assigning explicit ownership of authority certificates and cryptographic requirements is a cheap control with a high return.

The attribution error circulating about a July 17, 2026 FiskApplication upgrade is worth noting for its own sake. The real July 17 item was the electronic PDV-P form, and the FiskApplication’s last functional release was in April. A readiness assessment built on the reported version of events would have looked for an application change that does not exist while missing a cryptographic change that does.

Finally, on the value added tax side, the draft bill transposing Directive (EU) 2025/516 places Croatia among the member states legislating for the digital age package with application from January 1, 2027.

Because the consultation portal cannot be read server-side, organizations should not rely on secondary accounts of the bill’s content, several of which include detail — thresholds, transitional windows and later application dates — that could not be confirmed in the official text.

Expected Next Steps

The new Fiskalcis public key should be expected to become available on September 1, 2026, and organizations should confirm the download route through the FINA certificate search or the Tax Administration site in advance rather than on the day.

Further versions of the Technical Specification should be expected as the January 1, 2027, production withdrawal approaches, and organizations should monitor the Tax Administration’s fiscalization pages directly.

Guidance or a reminder notice on the production withdrawal of RSA-SHA1 and TLS 1.1 should be expected in the fourth quarter of 2026, but organizations should not wait for it.

The draft Value Added Tax Act amendment transposing Directive (EU) 2025/516 should be expected to complete consultation and to proceed to the Government and then to Parliament, with application from January 1, 2027. Its content should be confirmed against the official text when it becomes readable.

Further FiskApplication refinements should be expected, and organizations should note that they are announced without numeric version numbers, which makes the user guide version the practical reference point.

KGT will report separately on the completion of the certificate replacement, on further Technical Specification versions, and on the progress of the Croatian transposition of the digital age package.

How Can KGT Support You?

KGT is a specialist indirect tax technology firm. Our SAP-integrated e-invoicing and e-reporting add-ons generate, validate and transmit country-compliant structured documents directly from SAP ECC and SAP S/4HANA, keeping tax determination, document mapping, status handling and the audit trail inside the system of record rather than in a downstream converter. Because the add-ons validate against the current national schemas, schematrons and code lists before transmission, a change of specification version becomes a configuration and regression-test exercise rather than a redesign.

We also deliver SAP Document and Reporting Compliance (DRC) services end to end: fit-gap assessment against the national mandate, activation and configuration of the relevant country versions, eDocument and eStatement setup, interface and connectivity design, master and transactional data remediation, test strategy including negative testing against the authority’s own validation artifacts, and post-go-live monitoring of rejections and status reconciliation. If you would like a readiness review against the developments described above, or an impact assessment for your SAP landscape, we would be glad to help.

Official sources

• Tax Administration of the Republic of Croatia, notice to fiscalization users on technical improvements in the fiscalization system (Technical Specification version 2.7), July 6, 2026: View source
• Tax Administration of the Republic of Croatia, Technical Specification for users of fiscalization of invoices in final consumption, version 2.7: View source
• Tax Administration of the Republic of Croatia, electronic completion of the PDV-P form for value added tax refunds in passenger traffic, July 15, 2026: View source
• Tax Administration of the Republic of Croatia, FiskApplication user guide version 10.0 of June 19, 2026: View source
• Tax Administration of the Republic of Croatia, FiskApplication functional release, April 16, 2026: View source
• Tax Administration of the Republic of Croatia, fiscalization non-cash invoices news index: View source
• Government of the Republic of Croatia, e-Consultations portal, draft amendments to the Value Added Tax Act: View source
• Ministry of Finance of the Republic of Croatia: View source

This publication is provided for general informational purposes only and does not constitute tax, legal, or professional advice. Please consult your advisor before acting on any information contained in this update.