What NIS2 and DORA mean for companies in Estonia, Latvia and Lithuania, and the policies worth having in place
Since 1 January about 6,500 Estonian companies and organisations have been covered by the Cybersecurity Act, roughly 3,000 more than before. The amended act brings the EU NIS2 Directive into Estonian law. Covered companies had three months to register with the Information System Authority (RIA), so for most of them the deadline passed at the end of March. In May, Grant Thornton estimated that more than 2,000 of the newly covered companies had probably not registered yet.
For many, the first real contact with this law will be an incident. Say ransomware locks your systems at 23:00 on a Friday.
- If your company is covered by the Cybersecurity Act and the incident has a significant impact, RIA expects a first notice within 24 hours of you finding out.
- If you are a bank, DORA’s reporting rules apply instead. Your first report goes to Finantsinspektsioon within four hours of classifying the incident as major, and no later than 24 hours after you spotted it, weekend or not. Most other financial firms, such as payment institutions and crypto firms, have the same deadlines, but one that falls on a weekend can usually wait until noon on the next working day, here Monday.
- If personal data was hit, the data protection authority wants to hear within 72 hours, unless the breach is unlikely to put people at risk.
Only DORA has a weekend rule. RIA’s 24 hours and the 72 hours for personal data keep running on Saturday and Sunday. So if personal data is involved, you have two authorities and two deadlines at the same time.
Who is covered in Estonia
Put simply, there are two conditions: size and sector. You need at least 50 employees and an annual turnover or balance sheet above €10 million, and you need to work in one of the listed sectors. If you belong to a group, the group’s figures normally count, unless the systems you use for your service run independently of the rest of the group. The list covers far more than banks and energy companies. It also includes:
- industrial food production, processing and wholesale
- parts of manufacturing, such as electronics, machinery and vehicles
- chemicals and waste management
- postal and courier services
- online marketplaces, search engines and social networks
- managed IT and security service providers
Some organisations are covered whatever their size.
Companies that were in scope when the law took effect have three years, until the start of 2029, to bring everything in line. Registration was the exception, with three months. RIA still expects significant incidents to be reported within 24 hours, so do not treat the three years as a pause.
We would not plan around 2029. Latvia and Lithuania started earlier, and your customers will ask long before then.
The rules next door
- Latvia: the National Cybersecurity Law has applied since 1 September 2024. Registration was due by 1 April 2025. The cybersecurity manager had to be appointed and the first internal cybersecurity assessment filed by 1 October 2025. After that it is repeated every one to three years, depending on the company.
- Lithuania: the amended Law on Cyber Security has applied since 18 October 2024. Covered companies were entered in the register by April 2025, had to meet the organisational requirements by 17 April 2026 and must meet the technical ones by 17 April 2027. The government’s detailed rules include a security policy, a cybersecurity manager who does not also run the systems, yearly training for all staff and security clauses in supplier contracts.
A subsidiary in Latvia or Lithuania falls under the local law if it meets the test there. Branches can be treated differently: Latvia’s Ministry of Defence says its law does not apply to a branch, because a branch is not a legal person. Cloud, data centre and managed IT providers answer to the country of their main establishment in the EU.
If the law skips you, your customers may not
NIS2 makes covered companies responsible for security in their supply chain. Under Estonia’s law, a covered company that lets someone else manage or host its systems must make sure that provider reports incidents to it within 24 hours. Lithuania’s rules add more detail: vet suppliers, put security clauses into contracts and require quick notice of breaches.
So the law can reach you through your customers anyway. A software company with 30 people may not be covered and still get a security questionnaire, an audit clause and a clause requiring incident notice within 24 hours from its largest customer. If you can answer that questionnaire within a week, the renewal gets a lot easier.
Finance runs on DORA
Banks, payment and electronic money institutions, investment firms, insurers and crypto firms licensed under MiCA have applied DORA, the EU Digital Operational Resilience Act, since 17 January 2025. For them, DORA’s rules on ICT risk and incident reporting take the place of the NIS2 ones. If you received a MiCA licence this year, DORA applied from day one.
This year supervisors started reading what they had collected. By the end of March 2026 they had gathered the second annual register of contracts with ICT service providers. In June the European supervisory authorities published their first report on major ICT incidents: 3,383 across the EU in 2025, about a third affecting more than one country. Only about one in ten was related to cybersecurity. About half were system failures, and almost a third started at an outside provider.
DORA is about staying operational whatever the cause, so supervisors look closely at contracts with ICT providers:
- what the provider does
- where the data is
- audit rights and incident notice
- the right to terminate
- an exit plan you could actually carry out
Since November 2025 the EU has also directly overseen 19 tech providers designated as critical for the sector, including AWS, Microsoft and Google Cloud. That does not reduce your own duties. From 1 November Finantsinspektsioon takes DORA incident reports through the data collection portal it runs with Eesti Pank, instead of email.
What the board must do
Under NIS2 the management board approves the security measures, oversees them and can be held liable if they fall short. In Estonia the management board must name at least one member who approves the security measures, follows how they are carried out and trains regularly, unless the board has only one member. If it names nobody, these duties apply to every member. RIA also expects regular training for staff and managers alike. Under DORA the management body carries the final responsibility for ICT risk.
In Estonia the fines go up to €10 million or 2% of the company’s worldwide annual turnover for the previous financial year, whichever is higher, for essential entities, and up to €7 million or 1.4% for important ones.
The policies
You won’t find this list in any law. It is how we group what NIS2 and DORA ask for. Short documents that people actually use beat long ones nobody opens, and the board signs off on each.
- Information security policy. Scope, roles and the board member in charge.
- Risk assessment. What you protect, what threatens it and what you do about it, plus a yearly check that the measures work.
- Incident response and reporting plan. Who decides whether an incident is serious, who calls whom, and ready templates for every report and deadline that applies to you.
- Business continuity and backups. Restore from a backup at least once a year and time how long it takes.
- Supplier security and contract clauses. Checks before signing, security requirements, breach notice, audit rights and exit. Under DORA see Articles 28 to 30.
- Access control, encryption and asset inventory. Who can access what, MFA on critical accounts, encryption where the data needs it and access removed on the day someone leaves.
- Vulnerability and patch management. How fast you fix known flaws. If you make software or connected devices that are sold in the EU, or sell them under your own brand, the Cyber Resilience Act has required you since 11 September 2026 to report actively exploited vulnerabilities and severe incidents through ENISA’s reporting platform, with an early warning within 24 hours. Software sold purely as an online service is mostly outside it.
- Training and AI rules. Training for everyone every year, and written rules on what staff may put into AI tools. The AI Act also requires companies that use AI tools to take measures to support AI literacy among staff.
Companies under DORA also need an ICT risk management framework, the register of information and a testing programme.
Where to start this month
- Check every country where you have a company or branch, and check whether group figures count for you.
- If the law covers you in Estonia and you have not registered with RIA yet, do it now.
- Name the responsible management board member and book the training.
- Pull your ten most important contracts with IT suppliers and check them against points 5 and 6.
- Write or update the policies and have the board approve them.
We work in Estonia, Latvia and Lithuania, so you deal with one team for the scope check, the policies, supplier contracts and board training. Book a call at baltentra.legal. It takes 15 minutes. You can also write to info@baltentra.legal.