Short answer
Register with RIA within three months of starting the activity or becoming subject to the obligation. Changes in register data must be notified within 14 days. Registration is not a compliance certificate; it opens the supervisory relationship and creates a record of the entity, services and contact.
Who must register
NIS2 covers essential and important entities in the sectors listed in the Estonian Cybersecurity Act. The entity type depends on sector, size and role, not only on the number of employees. If you are unsure, document the assessment and ask RIA before assuming you are outside scope.
- Essential and important entities providing services in Estonia.
- Entities that become subject after a change in activity or group structure.
- Entities whose register data changes.
Read the full scope in NIS2 in Estonia.
Registration steps
- Confirm the obligation: sector, entity type, services and group structure.
- Prepare the data: legal entity, contacts, services and a security contact.
- Check the current RIA form: do not use an old PDF or a third-party template.
- Submit: keep the confirmation and a dated copy of the data.
- Update: notify changes within 14 days.
Deadline calculator
Enter the activity start or a register-data change. The calculation is local and does not send data anywhere.
Common errors
- Registering late because the obligation was not assessed.
- Listing the parent group instead of the legal entity that provides the service.
- Leaving the security contact generic or outdated.
- Forgetting the 14-day change notification.
- Treating registration as the end of the project.
Frequently asked questions
When must a NIS2 entity register in Estonia?
Register with RIA within three months of starting the activity or becoming subject to the obligation. Changes in register data must be notified within 14 days.
What is the NIS2 registration deadline?
The three-month deadline runs from the start of the activity or obligation. The 14-day deadline runs from the change in register data. The calculator shows calendar dates, not RIA processing time.
Does registration prove NIS2 compliance?
No. Registration opens the supervisory dialogue. It does not replace risk management, the ten duties, incident reporting or evidence.
What should be prepared before registering?
Legal entity data, contact details, sector and entity type, the services in scope and a named security contact. Check the current RIA form before submitting.