AKD first in Croatia with ISO 37301 certification and a new standard for compliance monitoring in state-owned enterprises

AKD first in Croatia with ISO 37301 certification: compliance as a new measure of accountability for state-owned enterprises

The Agency for Commercial Activity (AKD) announced on 26 February 2026 that it has completed a certification audit in accordance with the international standard ISO 37301 – Compliance Management System (CMS) and that it is the first organisation in Croatia to obtain certification to that standard.
According to the company’s announcement, this is a strategic project that began in September 2024 and is focused on strengthening corporate governance, integrity and business transparency, with a clear message that the compliance system is not about form, but about measurable processes. AKD emphasizes that by establishing a compliance management system it also fulfilled the legal obligation to introduce a compliance monitoring function, which in the new framework for managing state assets has been given the status of a mandatory internal control. In practice, this means that evidence is expected: how obligations are identified, how risks are measured, who is responsible for action and how deviations are managed. In state-owned enterprises, this topic is particularly sensitive because failures do not end only as a balance-sheet cost, but often become a matter of public trust, political accountability and the sustainability of key public services. Obtaining certification can therefore be read as an attempt to turn compliance into part of day-to-day governance, rather than a reaction after problems arise.

What is ISO 37301 and why it matters for organisations operating in the public interest

ISO 37301 is an international standard that sets requirements and provides guidance for establishing, implementing, maintaining and continually improving a compliance management system in organisations of different profiles, from private to public and non-profit. Its purpose is to build a framework that enables an organisation to identify and manage compliance obligations: from laws and by-laws, through regulatory requirements, to internal policies, ethical standards and contractual obligations to partners. The standard requires more than general statements about “zero tolerance”: it requires demonstrable processes on risk assessment, the adoption and implementation of policies, employee training, reporting to management and supervisory bodies, and corrective measures when irregularities are identified. In an environment where reputational risk and public expectations are high, such a framework helps an organisation show that it works “by the rules” even when processes are complex and responsibilities are shared across multiple levels of governance. An added value is comparability: ISO standards create a common language that facilitates communication with external auditors, regulators, banks, suppliers and international partners. For the public sector and state-owned enterprises this is particularly important because they are expected to simultaneously protect the public interest, maintain market discipline and avoid situations in which non-compliance grows into a systemic risk.

Law, guidelines and rulebook: how the state standardises the compliance monitoring function

The legal basis for the compliance monitoring function has been further strengthened by the adoption of the Act on Legal Entities Owned by the Republic of Croatia, published in “Narodne novine”, which entered into force on 1 October 2025 and in the chapter on internal control explicitly prescribes the obligation to establish a compliance monitoring function. The Act defines that this function covers tasks of aligning the functioning and business operations of a legal entity with applicable regulations and general acts, with additional tasks to be regulated by a rulebook of the Minister of Finance, which opens space for more detailed standards on independence, reporting and scope of work. The transitional provisions provide that until the rulebook is adopted, the Government’s 2019 decision on the obligation to introduce a business compliance monitoring function in legal entities in majority state ownership remains in force, which shows continuity of policy: the obligation has existed for years, but is now being moved from the level of a decision to the level of a law. The Ministry of Finance in June 2024 published extensive guidelines for organising this function, emphasising the principles of proportionality, independence and permanence, and the need for systematic management of compliance risk through prevention, warnings and controls. In parallel, a draft rulebook has been published in e-Consultations, which should operationalise the legal provision and harmonise practice in legal entities owned by the state, including rules on organisation, remit and reporting method. In such a framework, certification to ISO 37301 becomes important because it gives a company a methodology and external verification, while at the same time making it easier to demonstrate that it meets the expectations of domestic regulations.

Why AKD is in focus: “of special interest” status and sensitive activities

AKD is listed in the current decision on legal entities of special interest to the Republic of Croatia among the entities to which the state attaches special importance, which implies a higher level of expectations in management, oversight and public accountability. The reasoning of the decision states that this is a company 100% owned by the Republic of Croatia, with activities related to providing services to public administration bodies, producing official documents and information security. The content of the decision further describes the scope of work: AKD produces and personalises identity cards, passports, visas, driving licences, residence permits and other protected printed materials, and participates in activities related to certificates and qualified trust services. When operations are connected with identity, documents and security-sensitive processes, the question of compliance also gains a security dimension: controlled access, traceability, supplier reliability, data protection and the integrity of IT systems that support the issuance and use of documents are important. In such an environment, a compliance management system is not only a “legal topic”, but also an organisational discipline that connects management, the supervisory board, IT, procurement, security and operational teams. Certification to ISO 37301 can therefore also be viewed as an instrument to strengthen internal controls in an area the public often sees only when an incident occurs or when institutions respond to irregularities.

What the certification audit could have required: key elements of an effective CMS

AKD states in its announcement that the certification confirms the existence of all key elements of an effective compliance management system: from identifying and managing compliance risks, through clear policies and procedures, to a system of training, reporting and continuous improvement. In practice, such elements mean that an organisation must have an overview of obligations and risks, but also an audit trail: documented assessments, training records, procedures for reporting irregularities, and clear corrective action mechanisms. In compliance management systems, special attention is paid to how “paper-only” compliance is prevented, i.e., how it is ensured that employees understand the rules and that deviations are detected before they become a problem. The Ministry of Finance’s guidelines emphasise that the aim of the compliance monitoring function is to reduce the risks of penalties, court proceedings and reputational damage through an effective system of identification, management, warning, prevention and controls, which is very close to the logic of ISO 37301. AKD additionally highlighted alignment with international guidelines: CEO Jure Sertić stated that the system is aligned “with the highest international standards and guidelines”, referencing OECD recommendations and the forthcoming rulebook of the Ministry of Finance. In practice, such a statement means that the company is trying to position itself above the minimum legal threshold and focus on standards recognised beyond the national framework, which is an important signal both for partners and for the public.

• Compliance risk management: mapping obligations, assessing risks and defining controls for areas such as procurement, contracting, conflicts of interest and data protection.
• Policies and procedures: clear rules, responsibilities and protocols for decision-making, with approval mechanisms and monitoring of implementation.
• Training and communication: employee training and advisory plans, with verification of understanding and documentation of participation.
• Reporting irregularities and handling: reporting channels, whistleblower protection, case handling and the introduction of corrective measures.
• Reporting and oversight: regular reports to management and supervisory bodies and effectiveness indicators, so that the system is a management tool and not a formality.

OECD guidelines and the international context: integrity as a condition of modern governance

In 2024, the OECD published revised Guidelines on Corporate Governance of State-Owned Enterprises, which serve as an international reference framework for professionalising the ownership function, transparency of objectives and strengthening integrity in state-owned enterprises. The Guidelines, among other things, emphasise separating the state’s role as owner from its regulatory role, clear objectives and responsibilities, and robust internal control systems that reduce room for irregularities, abuse and political influence that is not grounded in publicly explained criteria. In the Croatian context, the link between ISO 37301 and OECD expectations is clear: ISO provides an auditable system, while the OECD calls for institutional maturity and comparability of governance standards among countries. When a state-owned enterprise establishes a certification-verifiable compliance system, it sends a signal of readiness for external scrutiny and for a governance culture based on evidence rather than ad hoc interpretations. This does not mean that a certificate automatically guarantees the absence of irregularities, but it means that there is a structure that facilitates detecting, documenting and correcting failures. That is precisely why in the public sector there is an increasing emphasis on system discipline: periodic reviews, continuous improvement and measuring the effectiveness of controls.

A broader message to other state-owned enterprises: from legal obligation to functional practice

AKD says that with this step it positions itself as a leader of good practice and a reference point for other enterprises in establishing compliance systems, strengthening integrity and transparent, accountable governance. In the months after the law entered into force, pressure for documented and measurable internal controls will likely grow, especially when by-laws are adopted that more precisely regulate the compliance monitoring function. Management boards will have to decide where the compliance function sits organisationally, whom it reports to, what resources it has and how conflicts of interest are prevented in highly exposed areas such as public procurement, contract management or security-critical IT systems. The Ministry of Finance’s guidelines leave room for the principle of proportionality, but at the same time require that each legal entity can convincingly explain why it chose that model and how it ensures independence and effectiveness. In addition, the draft rulebook provides for application to certain subsidiaries, which raises the question of how compliance standards “flow” through state-owned groups and how it is ensured that subsidiaries do not remain the weaker link. In such a framework, ISO 37301 certification can be a tool that accelerates alignment of practice, but also a benchmark against which progress is more easily compared.

What follows: implementation, oversight and the system’s real effectiveness

For AKD, ISO 37301 certification can have more consequences than reputational benefit: as a company that works with documents, identity and IT solutions, it is exposed to the expectations of various regulators and contractual partners, and a compliance management system can help align those requirements into a single framework. At the same time, certification implies maintaining the system, periodic reviews and readiness for corrections, which is crucial to avoid a situation in which the standard becomes a “one-off project”. For the system of state-owned enterprises, the broader picture is clear: after 1 October 2025, the 2024 guidelines and the preparation of the rulebook, a greater focus is expected on demonstrable governance and on the role of the compliance monitoring function as the second line of defence in the control system. At the same time, the question remains open of the dynamics of adopting and implementing by-laws and the way their application will be supervised, which in practice will decide whether standards will be harmonised or remain uneven among enterprises. In any case, the direction is set: compliance is increasingly understood less as an administrative formality and more as a system that must be able to withstand oversight, audit and public scrutiny.

Sources:
- AKD – official announcement on ISO 37301 certification ( akd.hr )
- Narodne novine – Act on Legal Entities Owned by the Republic of Croatia (enters into force on 1 October 2025; Art. 52 on the compliance monitoring function) ( narodne-novine.nn.hr )
- Ministry of Finance of the Republic of Croatia – Guidelines for the business compliance monitoring function in legal entities in majority ownership of the Republic of Croatia (June 2024.) ( mfin.gov.hr )
- Ministry of Finance of the Republic of Croatia – Decision on legal entities of special interest to the Republic of Croatia (the list includes AKD and the explanation of activities) ( mfin.gov.hr )
- OECD – OECD Guidelines on Corporate Governance of State-Owned Enterprises (revised edition 2024.) ( oecd.org )
- ISO – ISO 37301:2021 Compliance management systems — Requirements with guidance for use (description of the standard) ( iso.org )
- e-Consultations – Draft Rulebook on the compliance monitoring function in legal entities owned by the Republic of Croatia (draft text) ( esavjetovanja.gov.hr )