NIS2 obligations in Estonia

Competent authority & CSIRT Legal ref: Chapter 1, Art. 5

• The Estonian Information System Authority performs the following tasks: competent authority and single point of contact; computer security incident response team; coordinator for coordinated vulnerability disclosure; participant in the network of national computer security incident response teams ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Chapter 1, Art 1.

• The Act provides for: requirements for the maintenance of the network and information systems used by essential entities and important entities and domain name registration service providers, as well as liability and supervision; grounds for handling cyber incidents and requirements for addressing security vulnerabilities and cyber threats; requirements for preventing and responding to large-scale cyber incidents and crises; requirements for co-operation, information sharing and peer review in the field of cybersecurity; the competent authorities in the field of cybersecurity and the requirements for designating the competent authority carrying out cybersecurity supervision in the field of cross-border electricity flows. ecs-org.eu · 28 Oct 2026 · secondary source
• The sectoral classification corresponds to NIS2 ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Chapter 1, Art.3

• A service provider and a domain name registration service provider submit to the Estonian Information System Authority, at least the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• name and registry code. ecs-org.eu · 28 Oct 2026 · secondary source
• The address of the place of business and up-to-date contact details, including e-mail addresses, Internet Protocol address ranges and telephone numbers. ecs-org.eu · 28 Oct 2026 · secondary source
• Where appropriate, the relevant sector and subsector. ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• where appropriate, a list of the countries in which it provides services. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Chapter 2, Art.8

• Service providers will report incidents to the Estonian Information System Authority. ecs-org.eu · 28 Oct 2026 · secondary source
• Reporting requirements : ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours or 24 hours with updated information. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the Estonian Information System Authority. ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Chapter 5, Art,18

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Chapter 2, Art 7.

• European and international standards ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Law

What changed recently

1. 1 Jan 2026
   National NIS2 law enters into force (per tracker) ecs-org.eu secondary source