NIS2 in Estonia

Key facts at a glance

Is your company in scope? Common Estonia scenarios

Two worked examples of how NIS2 scoping plays out in Estonia. Not sure where you land? Run the free NIS2 scope checker.

What Estonia businesses need to know

• Estonia transposed NIS2 by amending its 2018 Cybersecurity Act, the Küberturvalisuse seadus (KüTS), rather than replacing it: the amending act, RT I, 30.12.2025, 4, adopted by the Riigikogu on 10 December 2025, has applied since 1 January 2026 (§ 11) and amended nine other acts. The European Commission's infringement case INFR(2024)0267, at the reasoned-opinion stage since 7 May 2025, was still open on 28 October 2026.

• Riigi Infosüsteemi Amet (RIA), the Estonian Information System Authority, is the competent authority, the single point of contact and the CSIRT (§ 5(3)), and supervises every service provider (§ 14(1)). It receives the notifications for its list and every incident report, for every sector.

• The act lists the types itself (§ 3). Essential at any size: DNS service providers, vital service providers under the crisis and national defence act, central government and local government public administration units, providers of critical-importance communications, maritime radio and operational radio network services, qualified trust service providers and TLD registries (§ 3(2)). Important at any size: controllers and processors of a database under the Public Information Act, public-law legal persons, associations of local authorities, family doctors that are not vital service providers, and non-qualified trust service providers (§ 3(4)).

• The size test is cumulative: medium means 50 or more employees AND a balance sheet or turnover above EUR 10 million, large 250 or more employees AND a balance sheet above EUR 43 million or turnover above EUR 50 million (§ 3(2) point 8, § 3(3) to (5)). An Estonian entity of 60 employees whose turnover and balance sheet both stay under EUR 10 million is outside the act, where the Recommendation's test would make it medium. Partner and linked enterprises are not counted for an entity independent of them in the systems it uses for its services (§ 3(7)).

• Local government is essential at any size, next to central government: every municipality and city, their agencies and the institutions they administer, the rural municipality and city districts and the joint offices of local authorities (§ 2 point 16, § 3(2) point 4).

• There is no designation decision: every service provider and domain name registration service provider notifies RIA within three months of qualifying (§ 3¹(1), § 4¹(1)), through the state portal eesti.ee, and reports every change within two weeks (§ 3¹(4)); the digital types file their own data and report changes within three months (§ 4(1), (6)). RIA draws up its list every two years, for internal use (§ 3¹(2), (3)).

• A service provider has three years from qualifying to bring its activity into line with the act and fulfil its obligations, the notification keeping its own three months (§ 4¹(3)); an entity in scope before 1 January 2026 has three years from that day (§ 28¹). The directive sets no such period.

• Every report goes to RIA (§ 8): a first notice (esmane teade) without delay and at the latest 24 hours after becoming aware of the incident ('teada saamist', the words of the directive's Estonian text), also when its significant impact is not obvious but can reasonably be assumed (§ 8(1)); an incident report (intsidenditeade) at the latest 72 hours after becoming aware of the significant-impact incident, 24 hours for trust service providers (§ 8(4¹), (4²)); an interim report (vahearuanne) at RIA's request; and a final report (lõppraport) within one month of the incident report, followed, for an incident not yet resolved, by a new final report within one month of its resolution (§ 8(7)). A disruption of the service in another Member State always makes an incident significant (§ 8(3)).

• The data to report and the procedure are set by a ministerial regulation under § 8(8), which is not on Reglyze's record, so this page names no reporting channel. An entity that entrusts the administration or the hosting of a system to another person answers for that person's security measures (§ 7(3)) and for that person telling it of an incident within 24 hours of becoming aware of it (§ 8(1¹)).

• The security measures are permanent, appropriate and proportionate, with a risk analysis (§ 7(1)), and their requirements are set by regulation, the Estonian information security standard (Eesti infoturbestandard, E-ITS) among them (§ 7(5)). Riigi Teataja lists the Government's regulation no 121 on cybersecurity requirements and the minister's regulation no 30 on E-ITS under the act; their content is not on Reglyze's record, Reglyze assesses Estonian entities on the NIS2 substrate, and it does not claim an assessment against E-ITS.

• The service provider designates at least one management board member (juhatuse liige) who approves the security measures, oversees their implementation and answers for them, unless the board has a single member (§ 6¹(1)); that member trains 'korrapäraselt', regularly, with no interval set (§ 6¹(2)). Without a designation the duties bind every board member (§ 6¹(3)), and a sole trader is bound himself (§ 6¹(4)).

NIS2 in Estonia: frequently asked questions

Is NIS2 in force in Estonia?

Yes. The act amending the Cybersecurity Act (RT I, 30.12.2025, 4) has applied since 1 January 2026 (§ 11): Estonia transposed NIS2 into its 2018 Küberturvalisuse seadus rather than replacing it. Entities already in scope had three months from that day to notify RIA and have three years to bring their activity into line (§ 28¹). The European Commission's infringement case INFR(2024)0267 was still open on 28 October 2026.

How does the Estonian size test differ from the directive's?

It is cumulative. The act counts an entity as medium when it has 50 or more employees AND a balance sheet or turnover above EUR 10 million, and as large with 250 or more employees AND a balance sheet above EUR 43 million or turnover above EUR 50 million (§ 3(3) to (5)), where the Recommendation counts an enterprise as at least medium from 50 persons alone. The Recommendation's rule on enterprises controlled by public bodies is not applied (§ 3(6)), and partner and linked enterprises are not counted for an entity independent of them in its systems (§ 3(7)).

Where does an Estonian entity report a cybersecurity incident?

To Riigi Infosüsteemi Amet (RIA), which is the competent authority, the single point of contact and the CSIRT (§ 5(3), § 8): the first notice within 24 hours of becoming aware of the incident, the incident report within 72 hours (24 for trust service providers), the final report within one month of the incident report. The data and the procedure are set by a ministerial regulation under § 8(8) that is not on Reglyze's record, so this page names no portal or address; the registration notification, by contrast, goes through the state portal eesti.ee.

What does the Estonian act require of the management board?

The service provider designates at least one management board member who approves the security measures, oversees their implementation and answers for them (§ 6¹(1)); that member trains regularly ('korrapäraselt'), with no interval set (§ 6¹(2)). Without a designation the duties bind every board member (§ 6¹(3)), and a provider with a single board member needs no designation (§ 6¹(1)). In an essential entity RIA can require the temporary suspension of a board member's powers after unheeded precepts (§ 16(1⁵)).

Does an Estonian entity answer for its IT provider?

Yes. An entity that entrusts the administration of a system to another person, or hosts it with another person, answers for that person applying the security measures (§ 7(3)) and for that person telling it of an incident within 24 hours of becoming aware of it (§ 8(1¹)).