Cybersecurity Database

Law

Amendment to the Cybersecurity Act (NIS 2, 2025)

Act amending the Cybersecurity Act and other acts (transposition of the NIS 2 Directive)

In force since 1 January 2026Record checked against the official source on 29 October 2026 · Methodology

Official source: https://www.riigiteataja.ee/akt/130122025004

Official sourceWayback Machine snapshot
Official number
RT I, 30.12.2025, 4
Date adopted
Entry into force

Summary

The act transposes the NIS 2 Directive in Estonia by amending the Cybersecurity Act (KüTS) and other acts. It extends obligations to essential and important entities in the directive's sectors, which must send their details to the Information System Authority (RIA) for the list of entities and apply technical, operational and organisational risk-management measures specified by regulation; at least one member of the management board approves them, oversees their implementation and is accountable for them. Significant incidents must be reported to RIA within 24 hours, followed by an update within 72 hours and a final report within one month. Fines reach up to EUR 10 million or 2% of worldwide annual turnover for essential entities and up to EUR 7 million or 1.4% for important entities.

Key dates

  1. Deadline for entities already in scope to send RIA the information required for the list of entities (three months after entry into force)
  2. Amendment to the Cybersecurity Act enters into force, introducing reporting of near misses and security audits of essential entities

Information

Jurisdiction
Estonia
Issuing body
Riigikogu (Parliament of Estonia)
Type
Law
Available languages
Estonian
Topics
Notes
The link points to the amending act published in the Riigi Teataja (RT I, 30.12.2025, 4). The consolidated text of the KüTS has since been updated twice: from 1 October 2026 the Crisis Situations and National Defence Act (KORKS) replaced the references to the Emergency Act, and the amending act adopted on 23 September 2026 (RT I, 06.10.2026, 1), in force since 16 October 2026, introduced the concept of a near miss, which can be reported voluntarily to RIA, and allows RIA to carry out spot checks, targeted security audits and regular audits of essential entities every three years. The consolidated version in force since 16 October 2026 is RT I, 06.10.2026, 2. Security measures are specified by Government Regulation No. 121 of 9 December 2022 on cybersecurity requirements, amended in 2025 and 2026, and by the new Estonian Information Security Standard (E-ITS), in force since 1 September 2026.

Record details

Original title
Küberturvalisuse seaduse ja teiste seaduste muutmise seadus (küberturvalisuse 2. direktiivi ülevõtmine)
Title in other languages
  • Legge di modifica della legge sulla cybersicurezza e di altre leggi (recepimento della direttiva NIS 2)
  • Loi modifiant la loi sur la cybersécurité et d'autres lois (transposition de la directive SRI 2)
  • Ley de modificación de la Ley de ciberseguridad y de otras leyes (transposición de la Directiva SRI 2)
  • Gesetz zur Änderung des Cybersicherheitsgesetzes und anderer Gesetze (Umsetzung der NIS-2-Richtlinie)
Licence / terms of use
Public domain / official act – Act published in the official gazette: legislative texts and official acts are excluded from copyright protection under national law.
Collected from
manual entry
Last verified
(verified via web)

How to cite

APA

Riigikogu (Parliament of Estonia). (2025). Küberturvalisuse seaduse ja teiste seaduste muutmise seadus (küberturvalisuse 2. direktiivi ülevõtmine) (RT I, 30.12.2025, 4). https://www.riigiteataja.ee/akt/130122025004

Chicago

Riigikogu (Parliament of Estonia). "Küberturvalisuse seaduse ja teiste seaduste muutmise seadus (küberturvalisuse 2. direktiivi ülevõtmine)." 10 December 2025. https://www.riigiteataja.ee/akt/130122025004.

BibTeX

@misc{ee_kuberturvalisuse_seaduse_muutmine_2025,
  author       = {{Riigikogu (Parliament of Estonia)}},
  title        = {{Küberturvalisuse seaduse ja teiste seaduste muutmise seadus (küberturvalisuse 2. direktiivi ülevõtmine)}},
  year         = {2025},
  note         = {RT I, 30.12.2025, 4},
  url          = {https://www.riigiteataja.ee/akt/130122025004},
  urldate      = {2026-10-29}
}

Metadata and summary: CC BY 4.0 · JSON