NIS2 in Estonia

The law

The NIS2 amendments took effect on 2026-01-01. Estonia changed its existing Cybersecurity Act. The consolidated text in force from 2026-10-16 adds regular audits for essential entities.

Name

Küberturvalisuse seadus (KüTS), RT I, 30.12.2025, 4Cybersecurity Act, as amended by the NIS2 transposition act

Published

2025-12-30

In force

2026-01-01

Text

Read the KüTS

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Estonia differs

• § 3(2) point 8 KüTS Public electronic communications network providers with 50 or more staff and more than EUR 10 million turnover or balance sheet are essential entities. Under the Directive they would be important.
• § 3(2) point 8 KüTS Public electronic communications service providers with 50 or more staff and more than EUR 10 million turnover or balance sheet are essential entities. Under the Directive they would be important.
• § 3(7) KüTS Partner and linked company figures are not added when your systems for the services are independent of the partner or linked company.
• § 3(6) KüTS The Act does not apply Article 3(4) of the Annex to Recommendation 2003/361/EC. The size test differs from the Directive for entities with public owners.

Also note

• The Act sets essential status for entities in Annex I sectors that are large. It sets important status for medium entities in Annex I sectors and for entities in Annex II sectors.
• The Act describes a large entity as 250 or more staff together with a balance sheet above EUR 43 million or a turnover above EUR 50 million.
• Entities in scope on 2026-01-01 have 3 years to comply. A company that comes into scope later also has 3 years from that point.
• Approved certification mechanisms count as 1 factor when RIA picks a supervision measure.

Registration

Notify RIA within 3 months after your company first meets the criteria. Entities in scope on 2026-01-01 had until 2026-04-01. Report changes within 2 weeks.

Portal

eesti.ee state portal, business view, Küberturvalisus e-service

Rule

Deadline counts from the day you come into scope

Deadline

2026-04-01

Later entrants

3 months after you come into scope

You need

A board member of the company logs in to eesti.ee and files in the business view: E-teenused > Küberturvalisus.

Changes

Report changes to your data within 14 days

Incident reporting

1. 24 hEarly warning
2. 72 hIncident notification
3. 1 monthFinal reportafter the 72-hour notification

Send the reports to RIA (Riigi Infosüsteemi Amet).

Trust service providers send the 72-hour notification within 24 hours. The 72-hour duty covers incidents with a significant impact.

Measures and proof

Essential

RIA supervises essential entities actively. From 2026-10-16 it can run a security audit once every 3 years, and an audit after an incident or a breach. Entities that follow the Estonian information security standard (E-ITS) audit every 3 years and send the result to RIA within 30 days. An ISO/IEC 27001 certificate exempts you from E-ITS.

Important

RIA supervises important entities after the fact. It acts when it has grounds to think the entity breaks the Act, mainly sections 7 and 8.

The dates, in order

1. 2026-01-01 Act in force: security measures, incident reporting and management duties start
2. 2026-04-01 Registration deadline for entities in scope on 2026-01-01Derived from a rule in the law
3. 2026-10-16 RIA can run regular security audits of essential entities every 3 yearsEssential entities only
4. 2029-01-01 End of the 3-year transition: full compliance for entities in scope on 2026-01-01Derived from a rule in the law Next

Duties of management

The company names at least 1 board member. This person approves the security measures, oversees them and answers for them. The board member takes regular training. A company with 1 board member is exempt from the naming duty.

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.