Estonia NIS2 Transposition (Cybersecurity Act amendments)

Amendments to the Estonian Cybersecurity Act extending scope and reporting to NIS2 entities under the Information System Authority (RIA).

JurisdictionEstonia
CategoryCybersecurity
StatusActive
Effective date
Latest development

Analysis

Estonia has transposed the NIS2 Directive via amendments to its existing Cybersecurity Act (Küberturvalisuse seadus), with the Act amending the Cybersecurity Act and other acts (transposition of the 2nd Cybersecurity Directive) entering into force on 1 January 2026 and designating the Information System Authority (Riigi Infosüsteemi Amet, RIA) as the central competent authority and single point of contact.Estonia: Act amending Cybersecurity Act takes effect Estonia - EU NIS2 Directive The Bill on the transposition of the EU Cybersecurity Directive passed the first reading - Riigikogu

Key Requirements

1. Scope and entity classification (essential & important entities)

2. Governance and management-level responsibility

3. Cybersecurity risk-management measures

4. Incident reporting obligations

5. Registration and supervision by RIA

  • Entities falling under the amended Estonian Cybersecurity Act must self‑register with RIA (or CERT‑EE / NCSC‑EE as operated by RIA) within defined time windows.
  • Estonian transposition trackers and implementation summaries note self‑registration obligations for entities in scope after entry into force, with an initial window of a few months.NIS 2 status in Estonia – Cybersecurity Act, RIA, CERT-EE
  • Estonian-focused implementation articles describe self‑registration via CERT‑EE by early 2026.NIS2 directive implementation in Estonia – Copla
  • RIA is the national competent authority, single point of contact and CSIRT/NCSC‑EE under the amended Act.
  • RIA acts as the central supervisory and coordinating authority, single point of contact and CSIRT for NIS2, with sectoral regulators handling specific industries.Estonia - EU NIS2 Directive
  • Implementation analyses emphasise RIA’s expanded roles and enforcement powers under the Küberturvalisuse seaduse ja teiste seaduste muutmise seadus.How Estonia Built the EU's Most Battle-Tested NIS2 Framework

6. Enforcement, sanctions, and audits

  • The amended Estonian Cybersecurity Act introduces substantial administrative fines for non‑compliance, aligned with NIS2’s upper limits.
  • NIS2 allows Member States to impose fines up to at least €10 million or 2% of global turnover for certain violations.Directive (EU) 2022/2555 – NIS2, EUR-Lex
  • Estonian implementation materials confirm that essential and important entities are subject to fines up to €10,000,000 or 2% of the entity’s total annual worldwide turnover.Current status of the implementation of NIS 2 in Estonia (PDF)
  • RIA has strong supervisory powers, including on‑site inspections, mandatory testing and corrective orders.
  • Analyses of the Estonian NIS2 framework highlight RIA’s powers to conduct on‑site inspections, order mandatory penetration tests at the entity’s expense, impose corrective measures, and publicly name non‑compliant organizations.How Estonia Built the EU's Most Battle-Tested NIS2 Framework
  • NIS2 requires Member States to empower competent authorities with such supervisory and enforcement tools.Directive (EU) 2022/2555 – NIS2, EUR-Lex

Compliance Challenges

1. Identifying in‑scope entities and group structures

  • Challenge: Determining whether an organization (and its group entities) is in scope under the Estonian Cybersecurity Act amendments based on sector and size thresholds.
  • Draft law analyses show that scope depends on exceeding 50 employees and €10m thresholds and being active in listed sectors, which can be complex for diversified groups.Transposition of the NIS2 Directive into national law – Estonia (PDF)
  • EU‑wide NIS2 guidance notes that corporate groups, subsidiaries and cross‑border operators face interpretation challenges regarding which entity is designated as essential or important.Directive (EU) 2022/2555 – NIS2, EUR-Lex

2. Scaling security controls for newly in‑scope entities

3. Incident reporting maturity and operational burden

  • Challenge: Implementing continuous monitoring and structured incident reporting (within 24/72-hour timelines) requires mature detection, triage and communication processes.
  • NIS2’s strict reporting timelines (early warning, incident notification, final report) are demanding for organizations without 24/7 monitoring and established CSIRT/SOC functions.Directive (EU) 2022/2555 – NIS2, EUR-Lex
  • Estonian guidance on incident reporting obligations to RIA confirms rapid notification requirements, implying significant operational overhead.Current status of the implementation of NIS 2 in Estonia (PDF)

4. Governance, liability and board-level engagement

  • Challenge: Ensuring boards and management bodies understand their personal responsibility and potential liability for NIS2 compliance.
  • NIS2 introduces explicit duties for management bodies and potential liability for breaches of obligations.Directive (EU) 2022/2555 – NIS2, EUR-Lex
  • Estonian legal commentaries underline that management must actively oversee cybersecurity and can face sanctions where governance is inadequate.Estonia - EU NIS2 Directive

5. Meeting audit requirements and technical compliance deadlines

  • Challenge: Achieving full technical compliance and completing required audits within transition timelines.
  • EU and industry trackers note that the deadline for completing first NIS2 compliance audits in several Member States, including Estonia, has been pushed from 31 December 2025 to mid‑2026 or later, reflecting practical difficulties.NIS2 Directive Transposition Tracker – ECSO
  • Estonian implementation summaries describe phased deadlines (self‑registration, governance controls, technical compliance, first audits) extending into 2027–2028 for full maturity.NIS2 directive implementation in Estonia – Copla

Implementation Best Practices

1. Conduct a formal NIS2 applicability and gap assessment

2. Align with recognized frameworks (ISO 27001 / ENISA guidance)

3. Establish or strengthen incident response and reporting processes

  • Action:
  • Set up or enhance an internal CSIRT/SOC function with 24/7 monitoring where proportionate.
  • Define playbooks for incident detection, triage, classification, and reporting to RIA within NIS2 timelines.
  • Integrate with CERT‑EE/NCSC‑EE communication channels.
  • These practices directly support NIS2 incident reporting obligations, including early warning and structured reporting.Directive (EU) 2022/2555 – NIS2, EUR-Lex
  • Estonian implementation documents confirm the obligation to notify RIA of significant incidents

Recent developments

  • — EU‑wide implementation tracker updated on 2026-09-12 listing Estonia as “in force” and “complete” for NIS2 via amendments to the 2018 Cybersecurity Act, identifying RIA and CERT‑EE as key authorities and signaling to industry that Estonia is now in the enforcement and compliance‑ramp‑up phase rather than legislative drafting.[13][14] (source)
  • — European cybersecurity industry tracker noting Estonia as having completed NIS2 transposition, listing transposition and entry‑into‑force dates and characterizing the national law (Network and Information System Security Act 2026 / amended Cybersecurity Act) as fully implementing NIS2 requirements for essential and important entities.[8] (source)
  • — Country‑specific NIS2 guide confirming that the binding instrument in Estonia is the amended Cybersecurity Act rather than the directive itself, with NIS2‑related amendments in force from 2026-01-01 and providing practical orientation for entities on how national rules and supervisory structures apply in practice.[12] (source)
  • — Overview update confirming that Estonia has completed NIS2 transposition via amendments to the Cybersecurity Act, with the principal transposition entering into force on 2025-07-01 and the national framework now fully aligned with Directive (EU) 2022/2555, including expanded obligations for essential and important entities.[1] (source)
  • — Tracker entry explaining that Estonia has NIS2 transposed and in force through amendments to the Cybersecurity Act (KüTS) adopted on 2025-12-10 and effective 2026-01-01, with newly in‑scope entities required to register with the Information System Authority (RIA) within three months and subject to multi‑year transition periods for some obligations.[7] (source)
  • — Legal client briefing describing the December 10, 2025 law transposing NIS2 into Estonia’s Cybersecurity Act, effective 2026-01-01, highlighting the major expansion of in‑scope entities (about 3,000 additional subjects) and the resulting extension of existing cybersecurity requirements to new primarily private‑sector entities.[6] (source)
  • — Analysis of the Act amending the Cybersecurity Act and other acts, which took effect on 2026-01-01 to transpose NIS2, broadening the scope to more entities and infrastructures and introducing detailed requirements on incident handling, vulnerability and threat management, and large‑scale incident prevention and mitigation.[2] (source)
  • — Professional services briefing detailing that NIS2 was transposed into national law in Estonia with effect from 2026-01-01, increasing the number of companies and institutions subject to mandatory cybersecurity requirements by about 3,000 (to ~6,500) and granting a three‑year transition period for entities to align with and implement the new requirements.[10] (source)
  • — Status update noting that the Cybersecurity Act amendments were passed in December 2025 and entered into force on 2026-01-01, significantly extending the regulated perimeter across energy, transport, health, digital infrastructure and public administration, with an initial self‑registration window of roughly three months and multi‑year transition periods.[5] (source)
  • — Compliance blog summarizing Estonia’s NIS2 transposition via the “Küberturvalisuse seaduse ja teiste seaduste muutmise seadus” adopted in December 2025 and in force since 2026-01-01, noting RIA as the competent authority, scope expansion from roughly 3,500 to 5,500–7,000 entities, and a three‑year transition period for full compliance.[11] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates