Short answer
If you provide a service in Estonia, start with NIS2/KüTS or your sector rule. If you make or sell a digital product in the EU, start with CRA. If you are a financial entity, DORA comes first. E-ITS and ISO 27001 are management-system frameworks that can supply evidence, but neither automatically satisfies another regime.
The practical mistake is to treat all five as one checklist. They ask different questions: NIS2 asks how you manage cyber risk as a service provider; DORA asks how a financial entity manages ICT and third-party risk; CRA asks whether a product is designed, updated and documented securely; AI Act asks what risk class an AI system falls into; ISO 27001 and E-ITS ask whether you can operate and evidence a management system.
Regulation map
| Framework | Who it covers | Core question | Key date |
|---|---|---|---|
| NIS2 / KüTS | Essential and important service providers in Estonia | Is cyber risk managed, reported and governed? | In force 1 Jan 2026 |
| DORA | Financial entities and critical ICT third-party providers | Is ICT and third-party risk operationally resilient? | Applies from 17 Jan 2025 |
| E-ITS | Public-task organisations; voluntary for most companies | Is the information-security management system auditable? | 2026 standard |
| ISO/IEC 27001 | Any organisation seeking a certifiable ISMS | Can you operate and improve an ISMS? | Voluntary |
| AI Act | Providers, deployers, importers and distributors of AI systems | What risk class and obligations apply? | Main rules from 2 Aug 2026; high-risk later |
| CRA | Manufacturers and sellers of products with digital elements | Is the product secure, supported and documented? | Reporting from 11 Sep 2026; main rules 11 Dec 2027 |
One organisation can be in several boxes. A software company can be a NIS2 service provider, a CRA manufacturer and an AI Act deployer at the same time. Map the roles before mapping the controls.
NIS2 and the Estonian Cybersecurity Act
Estonia transposed NIS2 through the Cybersecurity Act (küberturvalisuse seadus, KüTS), in force from 1 January 2026. The act covers essential and important entities across sectors such as energy, transport, health, digital infrastructure, water, waste, food and ICT service management. Size thresholds and sector rules determine whether a company is in scope; some small providers can still be caught by their role, for example trust services, DNS or network provision.
Core duties include the ten risk-management areas, incident reporting, supply-chain security and management-body accountability. Reporting follows the familiar sequence: an early warning within 24 hours, a notification within 72 hours and a final report within one month. The Estonian regulator for NIS2 is RIA. Entities in scope from 1 January 2026 had to submit their activity data to RIA within three months, by 31 March 2026; the transition period for implementing the measures runs until 1 January 2029. Fines can reach €10 million or 2% of worldwide turnover for essential entities and €7 million or 1.4% for important entities.
Registration and detailed guidance are available through RIA and nis2.ee.
NIS2 regulates the service provider, not the product. If you also sell software or connected hardware, CRA may apply separately.
DORA
DORA (Regulation (EU) 2022/2554) applies directly in Estonia from 17 January 2025. It covers banks, insurers, investment firms, payment institutions, crypto-asset service providers and other financial entities, plus critical ICT third-party providers designated under the regulation. The five pillars are ICT risk management, incident management, operational-resilience testing, ICT third-party risk and information sharing.
The register of information is often the first concrete deliverable: it records ICT contracts, service providers, supported functions and exit arrangements. DORA also requires a testing programme, incident classification and reporting, and contractual safeguards for critical providers. Finantsinspektsioon is the Estonian financial supervisor. Our DORA register guide includes a downloadable template.
E-ITS
E-ITS is Estonia’s national information-security standard, maintained by RIA. The 2026 version moved away from a fixed set of mandatory measures and a rigid ISO 27001 mapping: organisations select measures based on risk and assess their maturity. Public-sector organisations with public-task obligations use E-ITS; for most private companies it is voluntary unless a contract or sector rule says otherwise.
An E-ITS audit is not an ISO 27001 certificate and does not automatically prove NIS2 compliance. It can, however, produce useful evidence for risk management, measures and management review. See the E-ITS guide for the 2026 changes and audit scope.
ISO/IEC 27001
ISO/IEC 27001 is a voluntary international standard for an information-security management system. Certification is issued by an accredited certification body after a two-stage audit; a consultant or penetration tester cannot issue the certificate. The 2022 version has 93 Annex A controls in four groups and requires a risk-based Statement of Applicability.
ISO 27001 is often requested in procurement or by international customers. It can support NIS2, DORA or E-ITS evidence, but the mapping must be documented. The ISO 27001 guide explains the stages and the evidence auditors ask for.
AI Act
The EU AI Act (Regulation (EU) 2024/1689) applies directly in Estonia. It uses a risk-based model: prohibited practices, high-risk systems, limited-risk transparency duties and minimal-risk systems. High-risk obligations include risk management, data governance, logging, human oversight, accuracy, robustness and cybersecurity. The 2026 amendment changed parts of the timetable and simplified some duties.
TTJA is named as the future market-surveillance authority for AI in Estonia, but the practical supervisory picture is still developing. A penetration test can support the cybersecurity evidence for a high-risk system; it does not replace the conformity assessment, technical documentation or human-oversight design. The AI Act guide includes a browser-only risk-class self-check.
CRA
The Cyber Resilience Act (Regulation (EU) 2024/2847) applies to products with digital elements made available on the EU market in the course of a commercial activity. It covers hardware, software, separately marketed components and remote data processing needed for a product function. Products already covered by certain sector rules, such as medical devices or aviation, may fall outside CRA where those rules provide equivalent protection.
Manufacturers must perform a cybersecurity risk assessment, meet the essential requirements in Annex I, handle vulnerabilities for the support period (generally at least five years), document components including an SBOM, carry out conformity assessment, issue an EU declaration of conformity and affix the CE marking. Reporting obligations started on 11 September 2026; the main obligations apply from 11 December 2027.
Reporting goes through ENISA’s Single Reporting Platform: 24 hours for an early warning, 72 hours for the main notification, then a final report within 14 days after a corrective measure for an actively exploited vulnerability, or within one month for a severe incident. Our CRA guide includes a scope self-check, and the SBOM guide covers the component inventory behind the vulnerability process.
Evidence that survives scrutiny
Regulators and auditors rarely accept a policy document as proof that a control works. They look for a trail: a risk assessment with owners, a decision about measures, an implementation record, a test or monitoring result, and a corrective action. The same evidence can often serve several frameworks if the mapping is explicit.
- Scope and roles: which entity, service, product or system is in scope; who is the provider, deployer, manufacturer or importer.
- Risk register: assets, threats, likelihood, impact, treatment and residual risk.
- Technical evidence: configuration, access control, logging, backup restore tests, vulnerability management and scoped security testing.
- Supply chain: contracts, due diligence, SBOM, support periods and exit plans.
- Incident readiness: classification, contacts, 24/72-hour templates, escalation and post-incident review.
- Governance: management approval, internal audit, training and review minutes.
Keep the evidence close to the control it supports. A folder of screenshots without an owner, date and scope is difficult to defend.
Where to start
- Map the legal role: service provider, financial entity, product manufacturer, AI provider/deployer, importer or distributor.
- Map the sector: NIS2/KüTS, DORA, medical devices, aviation, vehicles or another sector rule.
- Map the product: does it have digital elements and a network connection? Is it made available commercially in the EU?
- Do a gap assessment against the actual text: not against a generic checklist or a vendor’s marketing page.
- Build the evidence trail: risk register, test results, supplier records, incident process and management review.
- Sequence the work: fix legal scope first, then high-risk technical gaps, then documentation and audit readiness.
Tehisabiline is an Estonian cybersecurity company. We perform authorised penetration tests and technical audits, and we help teams turn the results into evidence. We are not a law firm, an accredited certification body or a notified conformity-assessment body.
FAQ
Is NIS2 already in force in Estonia?
Yes. Estonia transposed NIS2 through the Cybersecurity Act (KüTS), which entered into force on 1 January 2026. The act sets risk-management, incident-reporting, supply-chain and management-accountability duties for essential and important entities.
Does DORA apply directly in Estonia?
Yes. DORA is an EU regulation and applies directly from 17 January 2025. Estonian financial entities and critical ICT third-party providers fall within its scope, and Finantsinspektsioon is the relevant financial supervisor.
Is ISO 27001 mandatory in Estonia?
No. ISO/IEC 27001 is a voluntary international management-system standard. A customer, public procurement or sector rule may require it, but the certificate does not automatically prove NIS2, DORA, E-ITS or CRA compliance.
What is the CRA reporting deadline?
CRA reporting obligations apply from 11 September 2026. Manufacturers must submit an early warning within 24 hours, a main notification within 72 hours, and a final report within 14 days after a corrective measure for an actively exploited vulnerability, or within one month after the 72-hour notification for a severe incident.
Does CRA apply to software, or only hardware?
CRA applies to hardware and software products with digital elements that are made available on the EU market in the course of a commercial activity and have a direct or indirect connection to a device or network. Separately marketed components and remote data processing needed for a product function can also fall within scope.
Can a penetration test prove compliance?
No. A penetration test can provide technical evidence, but it does not replace a risk assessment, technical documentation, an SBOM, a support-period process, conformity assessment or a declaration of conformity.
Sources
- Cybersecurity Act (KüTS), Riigi Teataja.
- DORA, Regulation (EU) 2022/2554.
- E-ITS 2026, RIA.
- ISO/IEC 27001:2022.
- AI Act, Regulation (EU) 2024/1689.
- CRA, Regulation (EU) 2024/2847.
- European Commission: CRA reporting obligations.
This page is explanatory, not legal advice. Confirm scope, exceptions and deadlines against the current legal text and the competent authority.