The NIS2 Directive (Directive (EU) 2022/2555) raises cybersecurity requirements for "essential" and "important" entities in critical sectors and their suppliers, with management accountability and incident reporting duties.
2 deadlines tracked. Dates are the legally binding application dates.
Medium and large Estonian companies in NIS2 sectors (energy, transport, banking, health, water, digital infrastructure and ICT services, manufacturing of critical goods, food, chemicals, postal, waste, research), plus certain smaller providers designated by RIA.
Law in force since 2024-09-01; registration deadline was 2025-04-01, first cybersecurity manager notification and self-assessment report 2025-10-01; annual report by 1 October each year per NKDC guidance – confirm exact date with cyber.gov.lv
Medium and large companies registered in Latvia in NIS2 sectors (energy, transport, banking, health, water, digital infrastructure, ICT services, manufacturing of critical goods, food, chemicals, postal, waste, research), plus smaller firms that are the sole provider of a service or own critical ICT infrastructure.