Is NIS2 in force in Latvia?

Yes. The Nacionālās kiberdrošības likums has applied since 1 September 2024, and its incident-reporting duties since 1 July 2025 (transitional point 11). The first self-assessment notifications to NKDC were due by 1 April 2025, the first cybersecurity manager notifications and self-assessment reports by 1 October 2025, and an amending law has applied since 18 June 2026. The European Commission closed its infringement case INFR(2024)0284 on 30 January 2026.

When do the 24 and 72 hours start in Latvia?

The act does not say. Art. 34(2) and (3) give the early warning 24 hours and the initial report 72 hours, 'ne vēlāk kā', without stating from when they run, and Cabinet Regulation No. 397, which sets the content and procedure of the reports, refers back to the act's time limits (point 119). The only instant Art. 34 names is in its first paragraph, 'Konstatējot kiberincidentu', on establishing that there is an incident, when the entity informs the incident-response institution at once. The directive counts from becoming aware of the significant incident. Reglyze counts the Latvian deadlines from the detection time recorded on the incident.

Who receives a Latvian entity's incident reports?

The competent incident-response institution (Art. 34(1)): for state and municipal institutions and private-law legal persons, the Latvijas Universitātes Matemātikas un informātikas institūts, whose unit CERT.LV performs the task (Art. 9(2)); for the Ministry of Defence, its institutions and the National Armed Forces, the Militārās izlūkošanas un drošības dienests. The reports are the forms of Annexes 10 to 14 to Regulation No. 397, filled in electronically, signed with a secure electronic signature and sent to the institution's e-mail address (point 119), which CERT.LV gives as cert@cert.lv. An essential entity also sends them to the Satversmes aizsardzības birojs (point 121), and an incident that is not significant is described in free form (point 120).

How does Latvia measure the size of an entity under the National Cybersecurity Law?

By the act's own definitions, with no reference to Recommendation 2003/361/EC (Art. 1(16) and (25)). An operator is large with at least 250 employees or, since 18 June 2026, a turnover above EUR 50 million or a balance sheet above EUR 43 million; it is medium with up to 249 employees and a turnover or a balance sheet of at least EUR 10 million. Below 250 employees only these figures decide, so an operator of 50 to 249 employees with both under EUR 10 million is not medium in Latvia, where the directive's test would count it. The act does not say whether group figures count. The free scope checker on this site and the scoping wizard inside Reglyze, which classifies an organisation before its assessment, both apply these definitions. The free checker does not ask for the balance sheet total, which under the act can make an operator medium or large on its own, and it says so whenever a balance sheet would change its verdict.

Must the management of a Latvian entity follow cybersecurity training?

The act words it differently from the directive. The head of the entity ensures and is responsible for its cybersecurity management and designates a cybersecurity manager (Art. 25(1)); it is the cybersecurity manager who must attend, at least once a year, a training organised by the incident-response institution (Art. 25(5)), which CERT.LV runs twice a year. The act sets no training duty for the management body, as Article 20(2) of the directive does.

← Back to Reglyze

Transposed & Enforced

NIS2 in Latvia

Everything you need to know about the NIS2 directive in Latvija: transposition law, competent authority, incident reporting, deadlines, and how Reglyze helps SMEs become compliant.

Latvia transposed NIS2 with a new act, the Nacionālās kiberdrošības likums, in force since 1 September 2024 and amended from 18 June 2026, with its details in Cabinet Regulation No. 397. The act writes its own essential and important lists and its own size test, makes every electronic communications undertaking and every public body essential at any size, and sends every incident to CERT.LV at once. It sets the 24 and 72 hours of a significant incident without stating from when they run.

Key facts at a glance

Transposition Law

Nacionālās kiberdrošības likums, the National Cybersecurity Law (Latvijas Vēstnesis 128A, 2024)

In force since: 2024-09-01

Competent Authority

Nacionālais kiberdrošības centrs (NKDC)

https://www.cyber.gov.lv/lv/minimalas-kiberdrosibas-prasibas-un-nis2

Start now in Latvia: nothing to redo later

Reglyze runs your Latvia NIS2 compliance on the EU baseline today: scoping, the AI-guided assessment, AI-drafted documents and incident notification to CERT.LV, the incident-response institution of the Latvijas Universitātes Matemātikas un informātikas institūts, on signed forms sent by e-mail, with a copy to the Satversmes aizsardzības birojs for essential entities.

Your national rules (Nacionālās kiberdrošības likums, the National Cybersecurity Law (Latvijas Vēstnesis 128A, 2024)) layer national specifics on top of NIS2. When they apply to you, what you have built carries straight over: your scores, your documents and your evidence are kept, not reset. You simply add the national layer (registration with NKDC and local incident notification) onto your existing work. You never start from scratch.

Priority sectors for NIS2 in Latvia

NIS2 covers 18 sectors across Annex I (highly critical) and Annex II (other critical); the class depends on the annex and the size together, and an Annex II entity is never essential by its size alone. These are the sectors where Latvia's transposition and NKDC supervision focus most.

Electronic communications, digital infrastructure and ICT services

Every electronic communications undertaking is essential whatever its size (Art. 20(3)), and so are TLD registries, DNS service providers and qualified trust service providers (Art. 20(1), (2), (4)). Internet exchange points, cloud, data centre and CDN providers and ICT management or cybersecurity service providers are essential when large and important when medium (Arts. 20(8), 21(1)(1)), measured by the act's own size test. The digital types apply Regulation No. 397 as far as it does not contradict Implementing Regulation (EU) 2024/2690 (point 6).

State institutions, municipalities and public media

Direct administration bodies and other state institutions, derived public persons, municipalities among them, and the public electronic media are essential at any size (Art. 20(5) to (7)); state security institutions are out. NKDC may take off the list a public body whose disruption cannot significantly affect public security, defence or health (Art. 22(4¹), as amended). The temporary ban on managers does not apply to public bodies (Art. 45(11)).

Security services, education information systems and research

Three types are Latvia's own or worded its own way: providers of security services are important when medium or large (Art. 21(1)(2)(p)), the maintainer of an information system processing the personal data of learners of accredited education institutions is important at any size (Art. 21(1)(5), (2)), and research institutions are important when medium or large (Art. 21(1)(2)(o)).

Key deadlines

2024-07-04

The Nacionālās kiberdrošības likums, adopted by the Saeima on 20 June 2024, was published in Latvijas Vēstnesis (Nr. 128A).

2024-09-01

The act entered into force and repealed the Information Technology Security Law (transitional point 1).

2025-04-01

Last day for the first self-assessment notifications to NKDC, by essential and important service providers and by domain name registration service providers (transitional points 7 and 9).

2025-06-25

The Cabinet adopted Regulation No. 397, Minimālās kiberdrošības prasības: the minimum requirements, the status form, the significance criteria and the incident report forms (published on 1 July 2025).

2025-07-01

The incident-reporting duties of Art. 34(2) to (5) began to apply (transitional point 11).

2025-10-01

Last day for the first notification of the cybersecurity manager and for the first self-assessment report (transitional points 10 and 12).

2026-01-30

The European Commission closed its NIS2 infringement case against Latvia, INFR(2024)0284, after a reasoned opinion of 7 May 2025.

2026-06-18

The amending law of 4 June 2026 (OP 2026/115.1) entered into force: either financial figure now makes an operator large, NKDC approves the list and decides a contested status, and the head of the entity designates the cybersecurity manager within three months.

2026-10-01

Companies, foundations and associations significant for national security joined the essential list (Art. 20(11), as amended).

In scope + 1 month

A person that comes into scope later notifies NKDC within one month (Art. 22(1)), reports any change within two weeks (Art. 22(2)), and designates its cybersecurity manager within three months of the notification (Art. 25(2)).

Is your company in scope? Common Latvia scenarios

Two worked examples of how NIS2 scoping plays out in Latvia. Not sure where you land? Run the free NIS2 scope checker.

A 5-person Latvian electronic communications undertaking

Essential entity, whatever its size

Every electronic communications undertaking is essential (Art. 20(3)). It notifies NKDC within one month of qualifying (Art. 22(1)), designates a cybersecurity manager within three months of that notification and notifies NKDC and SAB within five working days (Art. 25(2)), and reports every incident to CERT.LV at once (Art. 34(1)): a significant one as an early warning within 24 hours and an initial report within 72 hours, sent to SAB as well (Regulation No. 397, point 121).

A Latvian MSP with 120 employees, EUR 6 million turnover and a EUR 3 million balance sheet

Outside the act's size test

By the act's definitions it is neither large (fewer than 250 employees, and neither figure above EUR 50 or 43 million, Art. 1(16)) nor medium (neither figure reaches EUR 10 million, Art. 1(25)), so the ICT management services type of Arts. 20(8) and 21(1)(1) does not reach it, unless it is the only provider of its service in Latvia or its disruption could significantly affect public security, defence or health (Art. 20(9), (11)). Under the directive's test its 120 employees would make it medium-sized and in scope. The free scope checker on this site and the scoping wizard inside Reglyze both apply the act's definitions and find it outside; the free checker does not ask for the balance sheet, and says that one of at least EUR 10 million would bring it in. Its customers in scope still apply Regulation No. 397's outsourcing rules to it (points 86 to 92).

What Latvia businesses need to know

Latvia transposed NIS2 with a new act, the Nacionālās kiberdrošības likums (National Cybersecurity Law), adopted on 20 June 2024, published in Latvijas Vēstnesis on 4 July 2024 and in force since 1 September 2024; it repealed the Information Technology Security Law. A technical correction followed (OP 2024/144.1), and an amending law of 4 June 2026 has applied since 18 June 2026. The European Commission closed its infringement case INFR(2024)0284 on 30 January 2026.
The Nacionālais kiberdrošības centrs (NKDC), within the Ministry of Defence, is the competent authority and single point of contact (Art. 4) and supervises essential and important entities; the Satversmes aizsardzības birojs (SAB) supervises the owners of ICT critical infrastructure (Art. 41). The details sit in Cabinet Regulation No. 397 of 25 June 2025, Minimālās kiberdrošības prasības.
The act lists its own types, essential ('būtisko pakalpojumu sniedzējs', Art. 20) and important ('svarīgo pakalpojumu sniedzējs', Art. 21), and defines size itself, with no reference to Recommendation 2003/361/EC. A large operator has at least 250 employees or, since 18 June 2026, a turnover above EUR 50 million or a balance sheet above EUR 43 million (Art. 1(16)); a medium operator has up to 249 employees and a turnover or a balance sheet of at least EUR 10 million (Art. 1(25)). Below 250 employees, only these figures decide.
Essential at any size: TLD registries, DNS service providers, every electronic communications undertaking, qualified trust service providers, state institutions, derived public persons (municipalities among them) and the public electronic media (Art. 20). Important at any size: maintainers of an education information system and the other trust service providers (Art. 21). Security services providers are in the important list when medium or large (Art. 21(1)(2)), a national addition.
A person assesses its own status and, if it qualifies, notifies NKDC within one month (Art. 22(1)), on the form of Annex 1 to Regulation No. 397, signed with a secure electronic signature and sent to the Ministry of Defence's official e-address (point 7); changes go in within two weeks (Art. 22(2)). NKDC keeps the list, which is restricted-access information, and can decide the status of a person that did not notify or notified wrongly (Art. 22, as amended).
Every cyber incident is reported at once to the incident-response institution (Art. 34(1)): CERT.LV, the unit of the Latvijas Universitātes Matemātikas un informātikas institūts that acts for state and municipal institutions and private-law legal persons (Art. 9(2)). For a significant incident: an early warning within 24 hours (Art. 34(2)), an initial report (sākotnējais ziņojums) within 72 hours, 24 for trust service providers (Art. 34(3)), an interim report on request, and a final report within one month of the initial report or, for an unresolved incident, a progress report and the final report after its resolution (Art. 34(5), (6)). The forms of Annexes 10 to 14 to Regulation No. 397 are signed with a secure electronic signature and sent by e-mail, which CERT.LV gives as [email protected]; an essential entity also sends them to SAB (point 121).
The act sets the 24 and 72 hours without stating from when they run: neither Art. 34 nor Regulation No. 397 names a starting point for them, where the directive counts from becoming aware of the significant incident. Reglyze counts the Latvian deadlines from the detection time recorded on the incident.
Significance is national: an incident is significant if it meets the definition in Article 3(1) of Implementing Regulation (EU) 2024/2690 or one of the criteria of Regulation No. 397 (point 118), such as harm to a person's life or health, a disrupted essential or important service, or a cross-border effect. An incident that is not significant is still described to CERT.LV in free form (point 120).
The head of the entity ensures and is responsible for its cybersecurity management and designates a cybersecurity manager (kiberdrošības pārvaldnieks), notified to NKDC and SAB within five working days (Art. 25). The act words no training duty for the management body, as Article 20(2) of the directive does: the yearly training it requires is the cybersecurity manager's, organised by the incident-response institution (Art. 25(5)).
Regulation No. 397 sets the measures: a cybersecurity policy, a catalogue of ICT resources and information systems, a cyber-risk management and continuity plan and an incident log; a security class A, B or C for each information system; multi-factor authentication; staff briefings within a month of a new account and every calendar year. No ICT outsourcing contract may go to a provider from Russia, Belarus or a state recognised as a sponsor of terrorism (point 86), and an essential entity's A-class systems go only to NATO, EU, EFTA or IP4 providers (point 101). Reglyze assesses Latvian entities on the NIS2 baseline and does not claim a point-by-point assessment against Regulation No. 397.

How NKDC enforces NIS2 in Latvia

The Nacionālais kiberdrošības centrs (NKDC) supervises essential and important entities, and the Satversmes aizsardzības birojs (SAB) the owners of ICT critical infrastructure (Art. 41). Supervision covers on-site inspections, remote monitoring, document checks and security scanning (Art. 42); each entity files a self-assessment report by 1 October, every year or every three years (Art. 43; Regulation No. 397, points 141 and 142), and NKDC or SAB can order an audit by an independent auditor where a breach is suspected or found (Art. 44). They can issue warnings and binding orders, suspend a system or a service, and, in an essential entity or ICT critical infrastructure, temporarily bar a manager from management functions (Art. 45). Neither that ban nor the financial sanctions of Art. 46 apply to public bodies (Art. 45(11), 46(12)).

NIS2 in Latvia: frequently asked questions

Is NIS2 in force in Latvia?: Yes. The Nacionālās kiberdrošības likums has applied since 1 September 2024, and its incident-reporting duties since 1 July 2025 (transitional point 11). The first self-assessment notifications to NKDC were due by 1 April 2025, the first cybersecurity manager notifications and self-assessment reports by 1 October 2025, and an amending law has applied since 18 June 2026. The European Commission closed its infringement case INFR(2024)0284 on 30 January 2026.
When do the 24 and 72 hours start in Latvia?: The act does not say. Art. 34(2) and (3) give the early warning 24 hours and the initial report 72 hours, 'ne vēlāk kā', without stating from when they run, and Cabinet Regulation No. 397, which sets the content and procedure of the reports, refers back to the act's time limits (point 119). The only instant Art. 34 names is in its first paragraph, 'Konstatējot kiberincidentu', on establishing that there is an incident, when the entity informs the incident-response institution at once. The directive counts from becoming aware of the significant incident. Reglyze counts the Latvian deadlines from the detection time recorded on the incident.
Who receives a Latvian entity's incident reports?: The competent incident-response institution (Art. 34(1)): for state and municipal institutions and private-law legal persons, the Latvijas Universitātes Matemātikas un informātikas institūts, whose unit CERT.LV performs the task (Art. 9(2)); for the Ministry of Defence, its institutions and the National Armed Forces, the Militārās izlūkošanas un drošības dienests. The reports are the forms of Annexes 10 to 14 to Regulation No. 397, filled in electronically, signed with a secure electronic signature and sent to the institution's e-mail address (point 119), which CERT.LV gives as [email protected]. An essential entity also sends them to the Satversmes aizsardzības birojs (point 121), and an incident that is not significant is described in free form (point 120).
How does Latvia measure the size of an entity under the National Cybersecurity Law?: By the act's own definitions, with no reference to Recommendation 2003/361/EC (Art. 1(16) and (25)). An operator is large with at least 250 employees or, since 18 June 2026, a turnover above EUR 50 million or a balance sheet above EUR 43 million; it is medium with up to 249 employees and a turnover or a balance sheet of at least EUR 10 million. Below 250 employees only these figures decide, so an operator of 50 to 249 employees with both under EUR 10 million is not medium in Latvia, where the directive's test would count it. The act does not say whether group figures count. The free scope checker on this site and the scoping wizard inside Reglyze, which classifies an organisation before its assessment, both apply these definitions. The free checker does not ask for the balance sheet total, which under the act can make an operator medium or large on its own, and it says so whenever a balance sheet would change its verdict.
Must the management of a Latvian entity follow cybersecurity training?: The act words it differently from the directive. The head of the entity ensures and is responsible for its cybersecurity management and designates a cybersecurity manager (Art. 25(1)); it is the cybersecurity manager who must attend, at least once a year, a training organised by the incident-response institution (Art. 25(5)), which CERT.LV runs twice a year. The act sets no training duty for the management body, as Article 20(2) of the directive does.

Official sources

Primary references for NIS2 in Latvia. Verify the latest text and deadlines directly with the authority.

Ready to become NIS2 compliant in Latvia?

Reglyze is the AI-powered NIS2 compliance platform built for European SMEs. Start free: scoping, gap assessment, and policy generation tailored to NKDC requirements.