	NIS2 Implementation in the EU
	Estonia
	(Europe) Firm COBALT Law Firm Contributors Egon Talur Priit Põld Updated 30 Jan 2026
Status of the legislative process	Transposed
Status of the NIS2 Implementation Act	The NIS2 Directive has been transposed into Estonian law as of 1 January 2026 through amendments to the Cybersecurity Act.
Significant deviations of the National Implementation Act from the NIS2 Directive, if any	There are no significant deviations. The primary change is the expansion of the scope of the law, with the number of entities increasing by approximately 3,000, from about 3,500 to 6,500, compared to the previously applicable legislation.
Date of entry into force of the Implementation Act	The amendments to the Cybersecurity Act implementing the NIS2 Directive entered into force on 1 January 2026.

NIS2 Implementation in the EU

Back XLS

Status of the legislative process

Transposed

Status of the NIS2 Implementation Act

The NIS2 Directive has been transposed into Estonian law as of 1 January 2026 through amendments to the Cybersecurity Act.

Significant deviations of the National Implementation Act from the NIS2 Directive, if any

There are no significant deviations. The primary change is the expansion of the scope of the law, with the number of entities increasing by approximately 3,000, from about 3,500 to 6,500, compared to the previously applicable legislation.

Date of entry into force of the Implementation Act

The amendments to the Cybersecurity Act implementing the NIS2 Directive entered into force on 1 January 2026.