Estonia, Latvia and Lithuania NIS2 Implementation Guide: Laws, regulators, deadlines and fines in one place

All three Baltic states have now transposed NIS2, but on different timetables and with different national twists, so a group operating in Estonia, Latvia and Lithuania faces three registration routes, three regulators and three sets of compliance deadlines, some of which fall in 2026. Latvia's National Cybersecurity Law has applied since 1 September 2024, Lithuania's amended Law on Cyber Security since 18 October 2024, and Estonia's amended Cybersecurity Act since 1 January 2026. This guide sets out, for each country in alphabetical order, the law, the regulator, who is in scope, registration, security measures, incident reporting, sanctions and the transition dates, then what that means for a regional compliance programme and for service accounts, API keys and AI agents. It is for CISOs, compliance leads and auditors with Baltic entities. The Directive itself is covered in the NIS2 Directive Guide and the status of every Member State in the NIS2 Transposition Tracker; this page goes into the Baltic detail.

Key takeaways

• Three laws, three start dates. Latvia (1 September 2024) and Lithuania (18 October 2024) were among the earlier transpositions; Estonia's amendments took effect on 1 January 2026, so Estonian entities are earliest in their compliance journey.
• Registration is the first obligation everywhere. Estonia requires notification to the Information System Authority (RIA) within three months; Latvia requires self-assessment and notification to the National Cybersecurity Centre within one month; Lithuania places designated entities in the Cybersecurity Information System run by the National Cyber Security Centre (NKSC).
• Security baselines differ in name. Estonia leans on the Estonian Information Security Standard (E-ITS) or ISO/IEC 27001, Lithuania references LST EN ISO/IEC 27002:2023, and Latvia sets requirements through Cabinet regulations with conformity self-assessment and registered cybersecurity auditors.
• Fines follow the Directive's ceilings. Essential entities face up to EUR 10 million or 2 per cent of turnover and important entities up to EUR 7 million or 1.4 per cent, with national variations in how the turnover cap is applied (the Estonian figures are according to PwC Legal).
• Management accountability is explicit. Estonia requires a designated board member, Latvia makes the head of the entity responsible and requires a cybersecurity manager, and Lithuania allows fines on managers personally and, for essential entities, temporary suspension by court decision.

The three laws at a glance

Estonia

Status (checked 14 November 2026): the amended Cybersecurity Act transposing NIS2 has applied since 1 January 2026. RIA has said implementing regulations are still being developed, so expect secondary rules to keep arriving through 2026.

• Scope: according to RIA figures reported by KPMG, about 6,500 Estonian companies fall under the amended Act, roughly 3,000 of them newly covered. Essential entities are those in listed sectors with 250 or more employees and turnover above EUR 50 million; important entities have at least 50 employees and turnover or balance sheet total of at least EUR 10 million. Some providers are in scope regardless of size, including vital service providers, public legal entities, domain name service providers, trust service providers and family medical practices. Where a group runs IT and security centrally, group-wide figures may decide whether a company qualifies.
• Notification: entities must notify RIA within three months of the obligation arising; for those in scope on 1 January 2026 the deadline was 31 March 2026. Notification goes through eesti.ee and includes contact details, IP address ranges, the NIS2 sector and subsector, and the countries where in-scope services are provided. Changes must be reported within two weeks. Grant Thornton reported in 2026 that a large share of newly covered entities had not yet filed.
• Security measures: the Act relies on E-ITS, which aligns with ISO/IEC 27001 and the German IT-Grundschutz, and treats compliance with E-ITS or ISO/IEC 27001 as a means of meeting the NIS2 security obligations. RIA describes E-ITS as best suited to larger organisations and a primary security measures framework for small and micro-enterprises.
• Transition: the Act gives a transition period of up to three years to bring security measures into line, but notification obligations apply from the start.
• Incident reporting: significant incidents must be reported to RIA immediately and no later than 24 hours after becoming aware of them.
• Management: companies must appoint at least one management board member to approve security measures, oversee implementation and be accountable for them; if none is designated, the duties fall on the whole board.
• Supervision focus: RIA's 2026 supervision focuses on educational institutions, local governments, vital service providers and selected public sector bodies.

Latvia

Status (checked 14 November 2026): the National Cybersecurity Law has been in force since 1 September 2024 (adopted by the Saeima on 20 June 2024). An amending law of 4 June 2026 took effect on 18 June 2026, and a change to Section 20(11), on commercial companies, foundations and associations important to national security, takes effect on 1 October 2026. Check the consolidated Latvian text on likumi.lv, as the English translation does not yet include the 2026 amendments.

• Scope: Section 20 lists essential service providers (including large companies in sectors such as energy, transport, banking, health, drinking water and digital infrastructure, top-level domain registries, electronic communications merchants, qualified trust service providers and state institutions). Section 21 lists important service providers, including medium-sized companies in those sectors and medium or large companies in sectors such as postal, waste, chemicals, food, manufacturing and digital providers. Section 1 defines large as at least 250 employees, or net turnover above EUR 50 million together with a balance sheet above EUR 43 million.
• Notification and cybersecurity manager: entities self-assess and notify the National Cybersecurity Centre within one month (Section 22), report changes within two weeks, and notify their cybersecurity manager within five working days (Section 25). The transitional deadlines for the first round were 1 April 2025 for self-assessment notifications, 1 October 2025 for the cybersecurity manager notification and 1 October 2025 for the first conformity self-assessment report.
• Duties: the head of the entity is responsible for cybersecurity. The cybersecurity manager runs a security screening at least once a year, completes annual CSIRT training and ensures annual staff instruction. Entities keep a cyber risk management and business continuity plan (Section 28).
• Incident reporting (Section 34): early warning within 24 hours of a significant incident, initial report within 72 hours (24 hours for trust service providers), and a final report within one month of the initial report, or a progress report if handling continues. These provisions apply from 1 July 2025.
• Audit (Sections 43 and 44): entities submit conformity self-assessment reports; the authorities can order a conformity audit by an independent, registered cybersecurity auditor at the entity's expense. Until the new Cabinet regulations take effect, and no later than 1 December 2026, auditors must meet the registration requirements in Cabinet Regulation No. 397 of 25 June 2025.
• Sanctions (Section 46): up to EUR 10 million for essential service providers and EUR 7 million for important service providers, with caps of 2 per cent and 1.4 per cent of net turnover where turnover exceeds EUR 500 million; up to EUR 10 million (or 2 per cent) for owners of critical ICT infrastructure, imposed by the Constitution Protection Bureau; and coercive fines of up to EUR 10,000 at a time. Section 46 does not apply to public administration bodies.
• Financial entities: entities covered by DORA (Regulation 2022/2554) apply their sector rules for third-party risk, resilience testing and incident reporting. See the DORA and NIS2 Overlap Mapping Guide.

Lithuania

Status (checked 14 November 2026): the amended Law on Cyber Security has been in force since 18 October 2024, with the implementing Government resolution in force from 12 November 2024. The register of essential and important entities was completed from 17 April 2025, which is the date most grace periods count from.

• Scope: essential and important entities as in NIS2, plus national identification criteria such as third-party services to the public administration sector and essential research and experimental development. Jurisdiction extends to DNS service providers and similar entities established in Lithuania.
• Registration: designated entities are included in the Cybersecurity Information System administered by the NKSC, and the grace period for measures starts from inclusion.
• Grace periods: up to 24 months in total: 12 months for organisational risk management measures and 24 months for technical measures, counted from each entity's inclusion in the system, so check your own inclusion date.
• Security measures: the implementing rules reference LST EN ISO/IEC 27002:2023 and require a cybersecurity audit at least every three years, under an audit methodology planned for approval in 2026. Required measures include approved cybersecurity policy documents, periodic risk analysis, assigned responsible persons, incident management, supply chain security and technical controls.
• Incident reporting: large-scale incidents need an initial report within 24 hours of detection and a detailed follow-up within 72 hours; other incidents within 72 hours. Automatic incident registration on the NKSC platform is to be in place within 12 months of registration in the system.
• Sanctions: fines of up to EUR 10 million or 2 per cent of global annual turnover for essential entities, graded by entity type and violation level. Managers or other responsible persons can be fined EUR 250 to EUR 3,000, or EUR 2,000 to EUR 6,000 for repeat offences. Temporary suspension of a manager applies only to essential entities and only by court decision.

Running one Baltic compliance programme

A regional group can run one control framework and meet all three laws, provided it maps each country's evidence and deadlines. ISO/IEC 27001 with 27002 controls is the common denominator: Estonia accepts it as a route to compliance, Lithuania references 27002, and Latvian minimum requirements are assessable against it. See the ISO 27001 to NIS2 and DORA Mapping Guide.

For the cross-border supplier requirements that sit behind all three laws, see the NIS2 Supply Chain Security Guide, and for board duties the NIS2 Management Liability Executive Briefing.

What it means for AI agents and non-human identities

None of the three laws names non-human identities, but each requires access control, risk management and incident handling that cannot be met while machine credentials are unmanaged. The Directive's Article 21 measures, detailed for digital providers in the NIS2 Implementing Regulation 2024/2690 Guide, include access control and authentication policies, and the national baselines carry them through.

• Inventory: list service accounts, API keys, certificates and AI agents per in-scope entity, with owners. Estonian E-ITS and Lithuanian 27002 controls both expect an asset and access inventory.
• Least privilege and rotation: remove standing broad rights from automation accounts and rotate secrets, so a leaked key does not become a significant incident.
• Incident detection: a 24 hour first notice is only achievable if misuse of a machine credential is logged and alerted on; agree what counts as significant before an incident.
• Suppliers: third-party integrations and SaaS connections are supply chain risks under all three laws; track the tokens they hold.

See the Non-Human Identity (NHI) Guide for the controls.

Common failure patterns

• Assuming one registration covers the group: each legal entity in scope registers with its own national authority.
• Reading the English translation as current: Latvia's English text predates the June 2026 amendments; always check the consolidated national-language version.
• Treating the Estonian transition as a reason to wait: the three-year period covers measures, not notification, which was due by 31 March 2026 for entities in scope on 1 January.
• Missing the Lithuanian grace period clock: it runs from inclusion in the Cybersecurity Information System, so the 12 and 24 month deadlines depend on each entity's own inclusion date, not on the law's start date.
• No named accountable person: without a designated board member in Estonia or a notified cybersecurity manager in Latvia, accountability defaults to the whole board or the head of the entity.

Practitioner checklist

• Confirm in-scope status for every Baltic legal entity, using group-wide figures where Estonian rules allow.
• Check registration is complete with RIA, the Latvian National Cybersecurity Centre and the NKSC, and that contact data is current.
• Name the accountable board member (Estonia) and notify the cybersecurity manager (Latvia).
• Build one incident runbook with a 24 hour first notice and the 72 hour and one month follow-ups.
• Map controls once to ISO/IEC 27001 and 27002, and record E-ITS equivalence for Estonia.
• Track Lithuanian grace periods from the date of inclusion and plan the three-yearly audit.
• Prepare Latvian conformity self-assessments and choose a registered auditor.
• Inventory and govern service accounts, API keys and AI agents in every in-scope entity.

Standards and references

• Likumi.lv: National Cybersecurity Law (English translation)
• Likumi.lv: Nacionālās kiberdrošības likums (consolidated Latvian text)
• RIA: The ministry's perspective, developments and next steps
• EUR-Lex: Directive (EU) 2022/2555 (NIS 2)
• PwC Legal: NIS-2 implementation in Estonia
• PwC Legal: NIS-2 implementation in Lithuania
• Grant Thornton Baltic: The Cybersecurity Act is in force
• CEE Legal Matters: Lithuania, implementation of the NIS2 Directive

Related NHI Mgmt Group resources: NIS2 Transposition Tracker · NIS2 Directive Guide · Czechia NIS2 Implementation · Finland NIS2 Implementation · NIS2 Readiness Checklist. This guide summarises the Estonian, Latvian and Lithuanian NIS2 laws as they stood on 14 November 2026 and is not legal advice.