Estonia NIS2: amended Cybersecurity Act applies to ~6,500 entities

What changes

Estonia's amended Küberturvalisuse seadus transposing NIS2 entered into force on 1 January 2026, roughly doubling the number of regulated organisations. In-scope entities must register with the Information System Authority (RIA), apply risk-management measures and report significant incidents.

Who is affected

Medium and large Estonian companies in NIS2 sectors (energy, transport, banking, health, water, digital infrastructure and ICT services, manufacturing of critical goods, food, chemicals, postal, waste, research), plus certain smaller providers designated by RIA.

Sizes: medium, large · Sectors: Energy, Transport / logistics, Finance / insurance, Health, Software / SaaS, Manufacturing, Agriculture / food, Professional services · Applies if: We operate in a critical sector (NIS2); We rely on cloud services

What to do

Check the sector and size criteria in the Act and register with RIA if in scope. Implement the Estonian baseline security standard (E-ITS) or an equivalent, assign management responsibility, and set up 24h/72h incident reporting to CERT-EE.

Penalty

Essential entities up to €10M or 2% of turnover; important entities up to €7M or 1.4%

Sources

• European Commission – NIS2 transposition status by country (digital-strategy.ec.europa.eu)
• Lex Mundi – Status of the NIS2 Implementation Act: Estonia (www.lexmundi.com)

Last verified 7 September 2026. Informational only, not legal advice.

More NIS2 deadlines