In short: Estonia brought the EU's NIS2 Directive into law by amending its Cybersecurity Act, and the amendments have been in force since 1 January 2026. The Act now covers nearly 6,500 Estonian companies and institutions, divided into essential and important entities. Each must send its details to the Information System Authority (RIA), make a board member responsible for security, manage its risks, and report a significant cyber incident within 24 hours.
How NIS2 became Estonian law
Estonia did not write a new law for NIS2 (Directive (EU) 2022/2555). The Riigikogu passed an act amending the Cybersecurity Act, Küberturvalisuse seadus (KüTS), on 10 December 2025. It was published in Riigi Teataja as RT I, 30.12.2025, 4, and the amending act entered into force on 1 January 2026.
The Information System Authority, Riigi Infosüsteemi Amet (RIA), is the competent authority and single point of contact under NIS2, and it does the work of the national incident response team. It also supervises compliance with the Act.
The Act has been amended twice since then, from 1 October 2026 and from 16 October 2026. This post follows the English translation of the Cybersecurity Act published in Riigi Teataja on 21 October 2026, which covers the version in force from 1 to 15 October 2026. It was checked on 28 October 2026 against the Estonian text in force from 16 October 2026, which the translation does not yet cover; where that amendment changes something below, the post says so.
Who is covered: essential and important entities
The Act calls the organisations it covers service providers and divides them into essential entities and important entities. Which group you are in decides how RIA supervises you and how large a fine can be.
Some organisations are covered whatever their size. Essential entities include domain name system service providers, the top-level domain name registry, qualified trust service providers, central and local government bodies, and critical entities under the Crisis Situation and National Defence Act. Important entities include legal persons governed by public law, the controllers and processors of databases under the Public Information Act, and family physicians who are not critical entities.
Most companies are covered by sector and size, measured as in the EU's definition of small and medium-sized enterprises (Commission Recommendation 2003/361/EC):
| Group | Size | Sectors (examples from § 3 of the Act) |
|---|---|---|
| Essential | 250 or more employees, and a balance sheet total over €43 million or turnover over €50 million | Data centres, cloud computing, content delivery networks, managed service providers, information security service providers, electricity, gas, district heating, drinking water, waste water, credit institutions, airlines, airports, rail and ports |
| Important | 50 or more employees, and a balance sheet total or turnover over €10 million | The same sectors, below the essential threshold; also waste management, chemicals, food wholesale and manufacturing, medical devices, certain manufacturing, online marketplaces, postal and courier services, social media platforms, online search engines and research organisations |
Providers of public electronic communications networks and services are essential at 50 employees and €10 million, and important below that.
One Estonian detail matters for groups of companies. When counting employees, turnover and balance sheet, the data of partner or linked enterprises is not taken into account if the entity is independent of them in the systems it uses to provide its services.
RIA says the amendments raised the number of Estonian companies and institutions that must comply from around 3,500 to nearly 6,500. Its examples of who the changes affect include airlines, rail, electricity companies, district heating providers, ports, credit institutions, cloud providers and hospitals, as well as some food, postal and waste management companies that meet the size criteria.
What a covered organisation must do
Send its details to RIA
Every service provider sends RIA at least:
- its name and registry code;
- its place of business and up-to-date contact details, including e-mail addresses, IP address ranges and telephone numbers;
- where relevant, its sector and subsector under the annexes to NIS2, and the countries where it provides services covered by NIS2.
The details are due within three months of becoming a service provider. An organisation that already met the criteria when the rules took effect had three months from 1 January 2026. Changes are reported without delay, and no later than two weeks after they are made. RIA's notice on the amendments says the details are submitted in the state portal eesti.ee.
Digital service providers, such as cloud, data centre, managed service and DNS providers, report a slightly longer set under § 4, including the EU countries where they provide the service. One established outside the EU but providing services in Estonia must designate a representative in the EU.
Make a board member responsible
A service provider designates at least one member of its management board who approves the security measures, oversees their implementation and is responsible for them. That board member takes regular training, so that they can understand and assess the risks and how to manage them. If no one is designated, the duties apply to every board member; a company with a single board member does not need to designate one.
RIA describes this as personal liability for board members.
Manage risks with proportionate security measures
The core duty is in § 7. A service provider applies, on a permanent basis, appropriate and proportionate technical, operational and organisational security measures to:
- manage the risks to its systems, including by preparing a risk assessment;
- prevent or minimise the impact of a cyber incident on the people who use its service and on other services;
- prevent cyber incidents, or detect and respond to them.
Proportionate means that the measures take into account, among other things, the organisation's exposure to risk, its size, and the likelihood and severity of incidents. Outsourcing does not move the duty: if someone else manages or hosts the system, the service provider is responsible for making sure they apply the security measures.
The detailed requirements are set by a government regulation, including the Estonian Information Security Standard (E-ITS). According to RIA's outlook for 2026, every organisation in scope previously had to follow E-ITS; since the amendments, smaller organisations need only the general requirements, or primary information security measures, that RIA defined in 2025. RIA's report for September 2026 adds that a new version of E-ITS entered into force on 1 September 2026. It removes the previous rigid layer of measures prescribed by the state, reduces the obligation to commission external audits and gives internal assessment a greater role.
Report significant cyber incidents
An incident has a significant impact if, among other things, its consequences are at least severe according to the organisation's own risk assessment, the service cannot be restored within the maximum downtime its service level agreement allows, it disrupts another provider's service, or it causes or may cause significant damage. An incident that disrupts a service in another EU member state always counts as significant.
| Report to RIA | Deadline |
|---|---|
| Initial notification | Without delay, no later than 24 hours after becoming aware of the incident |
| Incident notification, updating the first one | Without delay, no later than 72 hours after becoming aware of it |
| Interim report | When RIA asks for one |
| Final report | Within one month of the incident notification |
The 24-hour clock also applies when the significant impact is not obvious but can reasonably be presumed. Trust service providers have 24 hours for the incident notification as well. If the incident is not resolved by the time of the final report, that report counts as an interim one, and a new final report is due within one month of resolution.
Two more duties are easy to miss. If someone else manages or hosts the system, the service provider must make sure they report an incident to it within 24 hours. And where relevant, the service provider informs the people who may be affected, or the public if they cannot be reached individually.
Meet the deadlines
The Act gives service providers three years to bring their activities into line with its requirements: from 1 January 2026 for organisations that were already in scope then, and from the day they come into scope for the others. The three months for sending details to RIA are separate. Critical entities follow the time limit set under the Crisis Situation and National Defence Act instead.
Supervision and fines
RIA supervises essential entities directly. It supervises important entities after the fact, when it has reason to believe that one does not comply, in particular with the rules on security measures and incident reporting.
In supervision, RIA can carry out on-site inspections, targeted security audits paid for by the service provider except in cases set by regulation, and security scans; it can also issue warnings and compliance notices. Since 16 October 2026, the Estonian text also allows regular security audits of essential entities once every three years, except where the entity already has to audit regularly under the security requirements regulation.
Breaches of the rules on security measures and incident reporting carry fines of up to:
- essential entities: €10 million, or for a company up to 2% of total worldwide annual turnover in the previous financial year, whichever is higher;
- important entities: €7 million, or for a company up to 1.4% of that turnover, whichever is higher.
Ignoring a compliance notice can also bring a non-compliance levy of up to €70,000 each time it is imposed.
Where testing fits
The Act asks for a risk assessment and for measures that prevent incidents or detect and respond to them, and it gives RIA the power to check them with security audits and scans. Testing is one way to find out whether those measures hold before someone else does: a web application penetration test checks the applications you expose to the internet, and security consulting can help map the Act's requirements to your systems.
Check how it applies to you with RIA or your legal adviser. If you want to know where to start, talk to a tester.
Sources
- Küberturvalisuse seaduse ja teiste seaduste muutmise seadus (küberturvalisuse 2. direktiivi ülevõtmine), Riigi Teataja, 30 December 2025
- Cybersecurity Act, Riigi Teataja, 21 October 2026
- Küberturvalisuse seadus, Riigi Teataja, 6 October 2026
- Uuest aastast laienes küberturvalisuse seadus, RIA, 2 January 2026
- What to expect in cyberspace in 2026, RIA, 11 February 2026
- Situation in Cyberspace – September 2026, RIA, 6 October 2026