# Cyber insurance and NIS2 in Estonia: what changed in 2026 URL: https://insurancelawestonia.ee/blog/2026-11-02-cyber-insurance-nis2-estonia/ Author: Dr Olavi-Jüri Luik, Partner, Head of Insurance Law, attorney at law (Advokaadibüroo WIDEN OÜ) Published: 2026-11-02 Last updated: 2026-11-09 > Estonia's Cybersecurity Act (NIS2): board responsibility, 24/72-hour reporting, fines, and how they affect cyber and D&O policies governed by Estonian law. Estonia is one of the most digitalised economies in Europe and its companies have repeatedly been hit by ransomware: Estonian media have reported manufacturing groups losing a month of production after attackers encrypted both on-premise and cloud backups, and publishers losing close to a million euros over several years of repeated attacks. Since 1 January 2026, the NIS2 Directive has been transposed through amendments to the Cybersecurity Act (*küberturvalisuse seadus*, KüTS).[^1] This post explains what the new regime means for cyber and D&O insurers writing Estonian risks. ## The regulatory framework in brief The amended KüTS applies to service providers classified as essential entities (*üliolulised üksused*) and important entities (*olulised üksused*), as well as to digital service providers and public bodies. The scope is much broader than the previous regime and covers many manufacturing, food, waste management, postal and digital businesses. The transition rules are narrower than a general three-year grace period. A service provider that already met the criteria of the Act before the information duty in KüTS § 3¹(1) took effect has three years from that date to bring its activities into compliance, but it had to submit the information required by § 3¹(1) to RIA within three months; digital service providers had a parallel three-month deadline for their registration duties, and providers of vital services that first became subject to the Act after 18 October 2024 follow a separate deadline set under crisis-preparedness legislation (KüTS § 28¹(1)–(4)). An entity that meets the criteria only later does not benefit from the three-year period (analytical conclusion).[^2] **Board-level responsibility (KüTS § 6¹).** The entity must designate at least one management board member who approves the security measures, monitors their implementation and is responsible for them. That person must undergo regular training. If no member is designated, the duties fall on all board members (§ 6¹(3)). Only the duty to *designate* a responsible member does not apply to an entity with a single board member (§ 6¹(1), third sentence); the approval, monitoring and training duties are not lifted, and in the author's reading they rest on that sole board member (analytical conclusion). Where the entity has no management board because of its legal form or structure, the duties apply to the person who performs management functions, and for a sole trader to the trader personally (§ 6¹(4)).[^2] **Incident reporting (KüTS § 8).** An early warning must be sent to the Information System Authority (*Riigi Infosüsteemi Amet*, RIA) within 24 hours and an incident notification within 72 hours of becoming aware of a significant incident, followed by a final report within one month of the incident notification (KüTS § 8 lg 7). If the incident is still unresolved at that point, the report counts as an interim report and a new final report is due within one month of resolution; RIA may also request an interim report before the final report (§ 8 lg 4³). In addition, under GDPR Article 33 the controller must notify a personal data breach to the Data Protection Inspectorate without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.[^2][^3] **Fines.** Maximum fines are EUR 10 million or 2% of worldwide turnover for essential entities and EUR 7 million or 1.4% for important entities (KüTS §§ 18², 18³).[^2] ## Why property policies are no substitute The NotPetya litigation remains instructive. Merck's claim of roughly USD 1.4 billion under its property programme was resisted under a traditional war exclusion; the New Jersey courts held that the exclusion, drafted for conventional warfare, did not extend to a cyberattack on a private company, and the dispute later settled. Mondelēz's claim of around USD 100 million settled in 2022. The market response, including the Lloyd's state-backed cyberattack clauses, means that policyholders can no longer expect property or general liability policies to respond to cyber losses. The 2026 *Nord Stream* judgment in London on the breadth of "directly or indirectly" war wording (see [war risk exclusions](https://insurancelawestonia.ee/blog/2026-11-03-war-risk-exclusions-drones-baltics)) further underlines the importance of carefully drafted war and state-attack language. ## Estonian contract law points for cyber insurers **Business interruption must be expressly agreed.** Under the Law of Obligations Act (*võlaõigusseadus*, VÕS) § 476(4), indemnity insurance covers loss of profit only if expressly agreed.[^4] Cyber BI wording (waiting periods, indemnity periods, dependent BI) therefore carries full weight. **Security conditions are subject to proportionality.** Estonian law distinguishes between risk exclusions and policyholder obligations (precautionary measures). The Supreme Court has held that, as a rule, a condition whose occurrence depends mainly on the policyholder's conduct is an obligation, whatever its label, and that the insurer is then released only to the extent that the breach affected the occurrence of the insured event, which the insurer must prove (see judgments of 28.06.2024, 2-22-2313/65, which remitted the classification to the lower court, and 25.03.2026, 2-23-10549/35).[^5] Below the large-risk thresholds of VÕS § 427(3), a clause providing for full release irrespective of causation will not be enforced in that respect. MFA, backup segregation and patching conditions should be drafted and applied with this in mind. **Proposal forms matter.** Answers about security controls are pre-contractual information. Misrepresentation may give the insurer a right of withdrawal (VÕS § 441, *taganemine*), subject to the causation rule in VÕS § 442(2), or, in case of fraud, a right of avoidance under the General Part of the Civil Code Act. These are distinct remedies with different consequences and deadlines. **Notification duties run in parallel.** The policyholder's duty to notify the insurer (VÕS § 448) is separate from the KüTS and GDPR notifications. Under VÕS § 452(2), late notification releases the insurer only within strict limits (e.g. not where the post-loss obligation was breached without intent, and in cases of gross negligence only where the breach affected the investigation or the extent of the insurer's liability). ## Are NIS2 fines insurable? Many cyber policies cover regulatory fines "where insurable by law". Estonian law contains no express prohibition on insuring administrative fines, but the punitive and preventive purpose of a fine weighs strongly against insurability, especially for intentional breaches; VÕS § 452(1) and the Supreme Court's 2025 statement that the insurer's lack of an obligation to perform where the policyholder, the insured or the beneficiary intentionally caused the insured event is a general principle of insurance point in the same direction.[^6] That statement was made in a case on a bankruptcy trustee's compulsory liability policy and the term applied there, so its weight for fines under a cyber policy is that of an argument by analogy. Insurers and policyholders should assume that KüTS fines are generally not recoverable, while defence and investigation costs in regulatory proceedings typically are. ## The D&O dimension KüTS § 6¹ gives concrete content to the general standard of care in the Commercial Code (ÄS § 187). After a major incident, claims against the designated board member (by the company, its creditors or a bankruptcy trustee) are foreseeable, and under ÄS § 187(2) the director bears the burden of proving diligence. D&O underwriters should review cyber exclusions in D&O wordings and coordinate them with the insured's cyber programme (see [D&O insurance in Estonia](https://insurancelawestonia.ee/blog/2026-09-29-d-and-o-insurance-estonia-director-liability)). ## Checklist for insurers writing Estonian cyber risks 1. Confirm whether the insured is an essential or important entity under KüTS. 2. Align incident response requirements in the policy with the 24/72-hour regulatory timelines. 3. Review security conditions for compliance with Estonian proportionality rules. 4. Clarify the treatment of fines and regulatory defence costs. 5. Review war and state-backed attack exclusions for clarity; ambiguities in standard terms are construed against the insurer (VÕS § 39(1)). ## Conclusion The NIS2 transposition turns cyber security into a board-level legal duty in Estonia. Cyber insurance does not discharge those duties, but it provides the incident response capability and financial protection needed when they are tested. For insurers, Estonian contract law, with its proportionality rules and reversed burden of proof in director liability, should be built into wording and claims strategy from the outset. *Author: Olavi-Jüri Luik. Law as of November 2026.* ## Related pages - [Cyber claims in Estonia](https://insurancelawestonia.ee/guides/cyber-claims-estonia) - [Crime and fidelity claims in Estonia](https://insurancelawestonia.ee/guides/crime-fidelity-claims-estonia) - [Policy wording review under Estonian law](https://insurancelawestonia.ee/guides/policy-wording-review-estonian-law) - [D&O insurance in Estonia](https://insurancelawestonia.ee/blog/2026-09-29-d-and-o-insurance-estonia-director-liability) - [Estonian insurance contract law](https://insurancelawestonia.ee/estonian-insurance-contract-law) ## References [^1]: Cybersecurity Act (küberturvalisuse seadus, KüTS) (RT I, 06.10.2026, 2; in force from 16.10.2026); NIS2 amendments RT I, 30.12.2025, 4 (in force 01.01.2026). [^2]: KüTS § 6¹(1)–(4), § 8, §§ 18², 18³, § 28¹. [^3]: Regulation (EU) 2016/679 (GDPR), Article 33. [^4]: Law of Obligations Act (võlaõigusseadus, VÕS) § 476(4) (RT I, 20.06.2026, 18; in force 01.09.2026). [^5]: Supreme Court Civil Chamber judgments of 28.06.2024, 2-22-2313/65, paras 13, 15–17 ; and 25.03.2026, 2-23-10549/35, paras 11–13 . [^6]: VÕS § 452(1); Supreme Court Civil Chamber judgment of 15.10.2025, 2-21-16822/84, para 15.