Estonia — NIS2 cybersecurity implementation

What changes?

Meet Estonian cybersecurity obligations if the entity falls in the implemented essential/important-entity scope.

Who is affected?

Estonian covered essential/important entities; not all small webshops or service firms

When?

2026-01-01. Verified national transposition already in force; do not assume every small business is bound.

What to do

1. Check whether your business matches this scope: Estonian covered essential/important entities; not all small webshops or service firms
2. Check entity/sector scope and implement required risk-management, registration and incident reporting.
3. Confirm exemptions, thresholds and transitional arrangements in the linked primary source before implementing changes.
4. Assign a responsible person and keep evidence of your applicability assessment and preparation.

Existing tools and providers

RIA business guides, E-ITS/VE-ITS materials, existing security service providers

Primary source

Estonia Cybersecurity Act (KüTS) / NIS2 2022/2555

Checked 11 October 2026. Date evidence matched in freshly retrieved primary HTML.