NIS2 Estonia: Küberturvalisuse seadus 2026
Estonia transposed NIS2 by amending the Küberturvalisuse seadus (Cybersecurity Act, KüTS). The amending act was published as RT I, 30.12.2025, 4 and the new regime has applied since 1 January 2026, with further amendments in force from 1 October and 16 October 2026. This page sets out the three-month notification duty, the three-year runway to full conformity, the mandatory E-ITS or certified ISO/IEC 27001 requirement, the 24h/72h reporting chain, and what the Riigi Infosüsteemi Amet (RIA) can actually impose - which in Estonia is a misdemeanour penalty and a repeatable levy, not an administrative fine.
1 Introduction: NIS2 Directive & the Estonian context
Estonia is one of the most digitally advanced EU Member States, known for its electronic governance framework and robust cybersecurity infrastructure. To align with NIS2, Estonia amended its existing Cybersecurity Act, expanding obligations and strengthening security governance for both public and private sectors.
The framework that matters is the one in force from 1 January 2026. Two features of it catch organisations out. First, the deadlines are relative - three months to notify RIA and three years to reach conformity, both counted from the day you meet the definition, so there is no single national compliance date. Second, Estonia's penalties are misdemeanour penalties, not administrative fines, which changes the procedure that applies to you.
2 NIS2 implementation in Estonia
Estonia implemented NIS2 by amending the Küberturvalisuse seadus - the Cybersecurity Act, abbreviated KüTS - which was originally passed on 9 May 2018. The NIS2 amending act was published as RT I, 30.12.2025, 4 and entered into force on 1 January 2026. The Riigikogu passed it on 10 December 2025.
The amendments broaden the regulated sectors, introduce the essential/important entity model, move the security measures from individual services to the systems used in the entity's in-scope activities, and reinforce the supervisory powers of the Riigi Infosüsteemi Amet (RIA).
Status
Transposed and in force since 1 January 2026. Amended with effect from 1 October 2026 (vital-service references) and 16 October 2026 (near misses, security audits, the fine list). The text in force now has no end date.
Legal structure
One act and its regulations. The Küberturvalisuse seadus carries scope, the security measures (Section 7), incident notification (Section 8), supervision (Sections 14-17) and the penalties (Sections 18¹-18⁵). The detail sits in Government Regulation No. 121 on cybersecurity requirements, which makes the Estonian information security standard (E-ITS) mandatory, and in ministerial regulations on E-ITS itself and on incident-report content.
Supervisory approach
RIA does nearly all of it - competent authority, single point of contact, CSIRT (CERT-EE), large-scale crisis management and national coordinator for vulnerability disclosure, through its National Cyber Security Centre (NCSC-EE). The Consumer Protection and Technical Regulatory Authority (TTJA) has a narrower role: it is the cybersecurity certification authority under Regulation (EU) 2019/881.
3 Who is in scope
Estonia does not simply copy the Directive's annexes. Section 3 names entity types one by one, sorts them into essential (ülioluline) and important (oluline) entities, and pulls in public-sector bodies the Directive leaves optional.
Essential by type (Section 3(2))
- DNS service providers and top-level domain registries.
- Qualified trust service providers.
- Providers of a vital service under the kriisiolukorra ja riigikaitse seadus.
- Central government bodies and every local government unit, including municipal agencies and the institutions they administer.
- Providers of critical communications, maritime radio and operational radio network services.
- Public electronic communications networks and services - essential from medium size, important below it.
Essential if large, important if medium (Sections 3(3) and 3(4)(8))
Forty-two entity types - among them electricity, gas, oil and hydrogen undertakings, district heating and charging-point operators, air, rail, port and intelligent-transport-system operators, credit institutions, trading venues and central counterparties, drinking and waste water, pharmaceutical manufacturers, cloud, data-centre and content delivery network providers, internet exchange points, managed and managed security service providers and space ground infrastructure. They are essential at 250 or more employees and a balance sheet above EUR 43 million or turnover above EUR 50 million, and important at 50 or more employees and a balance sheet or turnover above EUR 10 million.
Important (Sections 3(4) and 3(5))
- From medium size: waste management, chemicals, food production and wholesale, medical devices, manufacturing in NACE C 26-30, online marketplaces, postal and courier services, social media platforms, online search engines and research organisations.
- By name, whatever the size: the controllers and processors of state databases under the Public Information Act, public-law legal persons, the association of local governments, Arenguseire Keskus, the State Forest Management Centre (RMK), family-doctor practices that are not vital-service providers, non-qualified trust service providers and smaller public electronic communications providers.
4 Notifying RIA: the three-month duty
Estonia does not wait for you to be designated. Section 3¹(1) requires a service provider - and a domain-name registration service provider - to notify RIA itself, and section 4¹ gives it three months from the day it first meets the characteristics of a service provider.
What you must submit
- Name and registry code.
- Address of the place of business and up-to-date contact details, including e-mail addresses, Internet Protocol address ranges and telephone numbers.
- The relevant Annex I or II sector and subsector.
- A list of the countries in which you provide services within the Directive's scope.
Keeping it current
Changes must be notified without delay and no later than two weeks after the change was made (Section 3¹(4)). RIA itself compiles the list every two years, so the currency of the register depends on you, not on it.
The list is not public
Section 3¹(3) marks the information as intended for internal use for the purposes of the Public Information Act. Being on the list is not a matter of public record - a question boards ask and few guides answer.
Where to file it
In the state portal eesti.ee, business view, under E-services and Küberturvalisus (login required). RIA says the notification is submitted by a member of the management board, and the last notification filed can be viewed there.
5 The three-year conformity runway
Notifying RIA and complying with the Act are two different clocks, and the second is long. Estonia gives three years to bring activities into conformity, and the clock is your own.
| Duty | Deadline | Provision |
|---|---|---|
| Notify RIA under Section 3¹(1) | 3 months from meeting the characteristics of a service provider | Section 4¹(1) |
| Bring activities into conformity with the Act and its implementing rules | 3 years on the same trigger | Section 4¹(3) |
| The same, for entities already in scope on 1 January 2026 | 3 months (so 1 April 2026) and 3 years (so 1 January 2029) | Section 28¹(1) and (3) |
| Providers of a vital service | Not three years - the deadline is set in the provider's designation decision under Section 83(4)(3) of the kriisiolukorra ja riigikaitse seadus, and may not exceed five years from designation | Section 4¹(4), Section 28¹(4) |
What conformity means: E-ITS, or a certified ISO/IEC 27001
Section 7(5) hands the detail to Government Regulation No. 121 on network and information system cybersecurity requirements, as amended with effect from 7 September and 1 October 2026. It is more prescriptive than the Directive.
- E-ITS is the default. A service provider applies the Estonian information security standard (E-ITS) at least to the systems used in its in-scope activities (Regulation No. 121, Section 3(1¹)). The standard was reissued as Regulation No. 30 of the Minister of Justice and Digital Affairs, in force from 1 September 2026; documentation prepared under the previous version stays valid for up to three years from that date (its Section 12(2)).
- ISO/IEC 27001 is the only alternative, and it has to be certified. E-ITS does not apply if your measures meet ISO/IEC 27001 or EVS-EN ISO/IEC 27001, the scope covers those systems, and you have submitted a valid certificate to RIA (Section 3(2)). Alignment without a certificate does not qualify, and no other framework is recognised.
- The E-ITS route carries an audit every three years, and the audit conclusion goes to RIA within 30 days of receipt (Section 4(1)-(2)). A vital-service provider's first audit is due by the deadline in its designation decision (Section 4(1¹)).
- Small entities are spared E-ITS, not the baseline. Neither E-ITS nor the ISO route applies to a provider with fewer than 50 employees and a balance sheet or turnover of EUR 10 million or less (Section 3(2¹)) - which matters for entities in scope whatever their size. Every service provider must still adopt baseline measures in nine areas listed in the regulation's annex, from security organisation and user awareness to supplier management, incident handling and physical security (Section 5¹).
- Documentation is kept for seven years: a map of systems and related services, the measures applied and the risk analysis (Section 5), with the risk analysis updated after any significant incident, after any change affecting system security and at least every three years (Section 6).
- Outside the regulation: entities subject to DORA's risk-management requirements and those under the EU aviation-security rules (Section 1(2)).
6 Your management board's own duty
Section 6¹ puts a duty on the board itself, and the sanction for ignoring it is unusual: it does not fine you, it spreads the liability.
- Designate at least one member of the management board who approves the security measures, oversees their implementation and is responsible for them.
- Give RIA that person's name and contact details on request.
- That member must undergo regular training sufficient to understand and assess the risks, their impact on your services, and how they are managed (Section 6¹(2)).
- If you designate nobody, the obligations apply to every member of the board (Section 6¹(3)).
- Where the provider's legal form means there is no management board, the duties fall on whoever performs management functions; for a sole proprietor, on that person (Section 6¹(4)).
- The duty to designate does not apply where the provider has only one board member - there is nobody to choose between.
8 Incident reporting: 24h / 72h / one month
Section 8 sets the chain, with two features worth building in from the start - one about what you must presume, and one about what your suppliers must tell you.
| Stage | Deadline | Notes |
|---|---|---|
| Initial notification | 24 hours from becoming aware | Submitted to RIA. Security authorities notify through their own channel instead. |
| Incident notification | 72 hours from becoming aware | Updates the initial notification with a specified overview of the circumstances. |
| Trust service providers | 24 hours, not 72 | Section 8(4²) - the trust-service derogation, tighter rather than looser. |
| Interim report | At RIA's request, before the final report | Section 8(4³). |
| Final report | One month from the 72-hour notification | If the incident is unresolved at that point, the report counts as an interim report and a new final report is due one month after resolution. |
An incident is significant if any one of six tests in section 8(2) is met - and the first of them is your own risk assessment: impact "at least severe according to the severity of consequences determined in the system risk assessment" prepared under section 7(1)(1). The others cover breaching the maximum permitted disruption time, disrupting another provider's service, having to invoke extraordinary continuity measures, significant damage to you or your users, and the European Commission's implementing act. Section 8(3) adds that disruption in at least one more Member State is always significant.
Section 8(6) lets RIA inform the public of the incident itself, or require you to do so, after consulting you. Separately, Section 8(5) may require you to warn your own users: where appropriate, a provider must tell recipients who may be affected by a significant incident or a significant cyber threat within a reasonable time - or the public, if they cannot be reached individually - and, where possible, explain what they can do about the threat. That duty is on the fineable list.
9 NIS2 timeline & key dates (Estonia)
10 Sector-specific notes for Estonia
- Energy: electricity supply and generation undertakings, distribution and transmission system operators, gas, oil and hydrogen undertakings, district heating and charging-point operators are essential if large and important if medium-sized (Sections 3(3) and 3(4)(8)) - unless they are providers of a vital service such as electricity or gas supply, which are essential at any size.
- Cross-border electricity: entities covered by the network code on cross-border electricity flows (Delegated Regulation (EU) 2024/1366) face a separate offence of up to EUR 10,000,000 or 2% (Section 18⁴), and the legal representative such an entity designates under Article 15(1) of that regulation faces another (Section 18⁵). RIA has announced that cybersecurity supervision of electricity networks under the Commission regulation is joining its tasks; the competent authority is designated by ministerial directive (Section 5²).
- Digital infrastructure: DNS providers and TLD registries are essential at any size. Cloud, data-centre and content delivery network providers, internet exchange points and managed and managed security service providers are in scope only from medium size, and also carry the Section 4 main-establishment and representative rules.
- Public sector: every central government body and every local government unit is essential; public-law legal persons and the controllers and processors of state databases are important. The public-sector cloud regulation applies to them.
- Finance: credit institutions, trading venues and central counterparties are listed (Section 3(3)), but where DORA sets equivalent rules it applies with its specifics (Section 1(4)), and DORA entities are outside the security-requirements regulation.
- Healthcare: the functioning of health services is one of the 22 vital services in the kriisiolukorra ja riigikaitse seadus, so its designated providers are essential entities. Family-doctor practices that are not vital-service providers are important by name (Section 3(4)(5)), and pharmaceutical and certain medical-device manufacturers are listed separately. RIA names hospitals among the organisations newly covered.
- Vital services: providers of a vital service do not get the three-year runway - their deadline is set in the designation decision under Section 83(4)(3) of the kriisiolukorra ja riigikaitse seadus, at most five years from designation, and their first E-ITS audit is due by the same deadline.
- Trust services: qualified providers are essential and other providers important, whatever their size; the incident notification deadline is 24 hours, not 72 (Section 8(4²)); and the Section 1(2) exemptions never apply to them (Section 1(2¹)).
11 Penalties & fines
Two things about Estonian penalties are routinely got wrong. They are misdemeanour penalties, not administrative fines - sections 18² and 18³ are drafted as offences and section 19 assigns extra-judicial proceedings. And they attach to a closed list of duties, not to the Act as a whole.
| Provision | Who | Maximum |
|---|---|---|
| Section 18²(1) | Essential entity that is a natural person, such as a sole proprietor | up to EUR 10,000,000 |
| Section 18²(2) | Essential entity that is a legal person | up to EUR 10,000,000 or 2% of total worldwide annual turnover in the preceding financial year, whichever is higher |
| Section 18³(1) | Important entity that is a natural person | up to EUR 7,000,000 |
| Section 18³(2) | Important entity that is a legal person | up to EUR 7,000,000 or 1.4%, whichever is higher |
| Section 18⁴ | Entity covered by Delegated Regulation (EU) 2024/1366 on cross-border electricity flows, for breaching that regulation | up to EUR 10,000,000; for a legal person, EUR 10,000,000 or 2%, whichever is higher |
| Section 18⁵ | The legal representative such an entity designates under Article 15(1) of that regulation | up to 300 fine units; for a legal person, EUR 32,000 |
| Section 18¹ | Anyone issuing an EU statement of conformity under Regulation (EU) 2019/881 that does not meet its conditions, or breaching its rules on supplementary cybersecurity information | up to 200 fine units; for a legal person, EUR 20,000 |
12 Supervision & the non-compliance levy
For a continuing breach the headline fine is rarely the operative provision. Section 17¹ is - and since 16 October 2026 RIA's audit powers over essential entities are wider.
EUR 70,000, repeatable
On failure to comply with a compliance notice, the upper limit of the non-compliance levy is EUR 70,000 for each imposition, under the rules in the Substitutional Performance and Non-Compliance Levies Act. It can be imposed again, which is what makes it effective against an entity that simply does not act.
Ex ante for essential, ex post for important
RIA supervises essential entities proactively, and important entities only as follow-up where it has grounds to believe sections 7 and 8 are not being met (Section 14(6)). Every measure weighs the circumstances of the case (Section 14(7)); repeat breaches, a missed 24-hour notification, ignoring a compliance order, obstructing an ordered audit and false information about measures or incidents all count as serious (Section 14(8)).
Checks and audits
Random checks of essential entities; a needs-based security audit of an essential entity, which may follow a significant incident or a breach; targeted audits of any provider, based on risk and at the provider's cost except in cases a ministerial regulation is to list (none had been issued by 16 October 2026); and regular audits of essential entities once every three years, unless the entity already has to audit regularly under the security-requirements regulation, as on the E-ITS route (Sections 16(1¹) and 17(1¹)).
Escalation for essential entities
Warnings, compliance orders, an order to publish the breach and a compliance monitoring officer for a set period. If an essential entity still does not comply, RIA can demand the temporary suspension of a certificate or authorisation for the services concerned, or the temporary suspension of a management board member's powers, until it does (Section 16(1⁴)-(1⁶)).
Cross-border work
Section 17³ provides mutual assistance where an entity operates in more than one Member State; section 17⁶ makes participation in peer review under Article 19 of the Directive voluntary.
13 Voluntary notification & vulnerability disclosure
Not every route to RIA is compulsory, and since 16 October 2026 the voluntary ones cover near misses too.
- Voluntary notification (Section 8¹). A service provider may notify RIA of near misses, incidents, vulnerabilities and cyber threats beyond what Section 8 requires; anyone else may also report significant incidents. RIA may handle mandatory notifications first (Section 12(3²)).
- Near misses. The Act now defines a near miss as an event that could have compromised the availability, authenticity, integrity or confidentiality of data or services but was prevented or did not materialise (Section 2(22¹)), alongside a cyber-incident definition in the Directive's terms (Section 2(19)). RIA sends ENISA anonymised aggregate data every three months, near misses included (Section 12(4¹)).
- Coordinated vulnerability disclosure. Section 5(3)(4) makes RIA the national coordinator for the purposes of Article 12(1) of the Directive, and a vulnerability report may be made anonymously (Section 8¹(2)).
- Information-sharing arrangements (Section 17⁵). Joining one is voluntary, but a service provider must tell RIA when it joins or leaves (Section 17⁵(5)).
- The cyber incident registry (Section 13). Notifications are recorded in a restricted-access register for internal use, and incident data is kept for five years after the incident is resolved.
14 How Estonia differs from the Directive
Nine features of the Estonian regime are not obvious from reading NIS2, and each changes what a compliance programme has to do.
- The security baseline is a national standard. E-ITS applies unless you hold an ISO/IEC 27001 certificate covering the in-scope systems and have sent it to RIA, and the E-ITS route carries an audit every three years.
- Every local government unit is essential, and the controllers and processors of state databases are important whatever their size.
- The size test is cumulative - 50 or more employees and more than EUR 10 million in turnover or balance sheet.
- The penalties are misdemeanour penalties, not administrative fines - a different procedure, with extra-judicial proceedings under section 19.
- The runway is three years, and it is relative - counted from when you meet the definition, not from a national date.
- The EUR 70,000 non-compliance levy is repeatable per imposition, and is the provision that actually applies pressure on a continuing breach.
- Your own risk assessment sets the reporting threshold, and you report on reasonable presumption of significant impact, not on established impact.
- Your outsourcing provider owes you a 24-hour notification, and ensuring that is your statutory responsibility.
- Failing to designate a responsible board member spreads the duty to the whole board rather than attracting a penalty of its own.
15 How to prepare for NIS2 in Estonia
- Confirm scope, then notify: check Section 3's own lists and its cumulative size test. If you meet the characteristics of a service provider, section 3¹(1) requires you to tell RIA within three months, through eesti.ee - and for anyone already in scope on 1 January 2026 that deadline was 1 April 2026.
- Designate your board member: section 6¹ requires one named member of the management board to approve the security measures and take responsibility for them - and if you designate nobody, the duty falls on all of them.
- Choose your route: E-ITS with an audit every three years, or an ISO/IEC 27001 certificate covering the in-scope systems, sent to RIA. Alignment with a framework does not count.
- Work back from your own three-year date: conformity is due three years from when you met the definition, so establish that date before building the plan.
- Document now: the system map, the measures and the risk analysis must be documented and kept for seven years, and the risk analysis must be refreshed after every significant incident or security-relevant change.
- Build the chain into your incident plan: 24 hours, 72 hours, interim on request, final report one month later, filed through raport.cert.ee - and remember you report on reasonable presumption of significant impact, and may have to warn affected users.
- Put the 24-hour pass-through in your supplier contracts: section 8(1¹) makes you responsible for ensuring that whoever manages or hosts your systems notifies you within 24 hours, and section 7(3) for their security measures. Both have to be written into the contract before an incident.
- Check the NIS2 support grant: entities newly covered by the Act that have notified RIA can apply to the Enterprise and Innovation Foundation (EIS) for up to EUR 120,000 - EUR 5,000 covering 100% of a cybersecurity roadmap, then EUR 10,000-100,000 covering 50% of the development work and up to EUR 20,000 covering 50% of auditing it. Work must not start before you apply, and projects must end by 31 December 2027.
- Train leadership and staff: the designated board member must train regularly (Section 6¹(2)), and E-ITS requires continuous staff training.