EU regulations for insurers in Estonia: Rome I, DORA, PRIIPs

In short. EU regulations apply in Estonia directly and prevail over national law. In cross-border coverage disputes the two essential instruments are Rome I (Article 7, law applicable to insurance contracts) and Brussels I bis (Articles 10–16, jurisdiction in matters relating to insurance). For insurers' operations the key regulations are the Solvency II Delegated Regulation, the IDD delegated regulations, PRIIPs, DORA and the GDPR. Newer risks arise from the AI Act and the Russia sanctions regulation. Each entry gives the CELEX number and the current consolidated text in EUR-Lex as at 3 November 2026.¹

1. Applicable law and jurisdiction

1.1. Rome I Regulation (EC) No 593/2008, Article 7

CELEX 32008R0593. EUR-Lex.

Article 7 does not apply to reinsurance (Art 7(1)). A contract covering a large risk is governed by the law chosen by the parties, failing which by the law of the insurer's habitual residence unless another country is manifestly more closely connected (Art 7(2)). For mass risks situated in a Member State the choice is limited (Art 7(3)). Where a Member State imposes compulsory insurance, the contract satisfies the obligation only if it complies with that State's specific provisions (Art 7(4)).

Practical point. A master policy under foreign law may still need an Estonian local policy, or at least Estonian-compliant terms, for compulsory covers and for mass risks situated in Estonia. Estonian standard-terms protections may also apply where the contract is closely connected with Estonia (VÕS § 36). See Choice of law and jurisdiction.

1.2. Brussels I bis Regulation (EU) No 1215/2012, Articles 10–16

CELEX 32012R1215. Consolidated text of 26.02.2015.

Section 3 of Chapter II protects the weaker party. An insurer domiciled in a Member State may be sued in its own State or, where the action is brought by the policyholder, the insured or a beneficiary, at the claimant's domicile (Art 11(1)). The insurer may sue only in the courts of the defendant's domicile (Art 14(1)). Article 13 deals with direct actions by injured parties against liability insurers; jurisdiction agreements are valid only within Article 15.

Practical point. An exclusive foreign jurisdiction clause in a policy sold to an Estonian consumer or SME will usually not prevent suit in Estonia. The domestic counterpart is § 91 of the Code of Civil Procedure; see Estonian statutes and Direct action against liability insurers.

2. Insurance business

2.1. Solvency II Delegated Regulation (EU) 2015/35

CELEX 32015R0035. Current consolidated version 14.11.2024 (EUR-Lex document page).

Technical provisions, own funds, the SCR standard formula, governance and reporting. Relevant in disputes mainly in insolvency or portfolio transfer scenarios, and for reinsurance credit.

2.2. IDD Delegated Regulations (EU) 2017/2358 and 2017/2359

• 2017/2358: product oversight and governance (target market, product testing, distribution monitoring). CELEX 32017R2358; consolidated text of 02.08.2022.
• 2017/2359: information requirements and conduct-of-business rules for insurance-based investment products (conflicts, inducements, suitability and appropriateness). CELEX 32017R2359; consolidated text of 02.08.2022.

The FSA has issued an advisory letter on 2017/2358; see FSA guidelines.

2.3. IPID Implementing Regulation (EU) 2017/1469

CELEX 32017R1469. The standardised insurance product information document for non-life products. KindlTS § 103² and VÕS § 428(2⁴) refer to it. Relevant where the IPID and the wording diverge.

2.4. EIOPA Regulation (EU) No 1094/2010

CELEX 32010R1094. Consolidated text of 10.11.2025. Establishes EIOPA and its power to issue guidelines and recommendations on a comply-or-explain basis. See EIOPA guidelines and self-regulation.

3. Customer information and data

3.1. PRIIPs Regulation (EU) No 1286/2014

CELEX 32014R1286. Consolidated text of 09.01.2024. A key information document must be given to retail investors before conclusion of an insurance-based investment product (a product with a maturity or surrender value exposed to market fluctuations). VÕS § 428(2) refers to PRIIPs.

3.2. PEPP Regulation (EU) 2019/1238

CELEX 32019R1238. Consolidated text of 09.01.2024. The pan-European personal pension product, which insurers may also provide.

3.3. General Data Protection Regulation (EU) 2016/679

CELEX 32016R0679. Consolidated text of 04.05.2016. Article 9 (special categories, including health data) is central to underwriting and claims in personal lines; Article 22 to automated decision-making. Also relevant to cyber claims and the insurability of fines. See Cyber claims in Estonia.

3.4. Payment Services Regulation (PSR): pending adoption

Status on 5 November 2026: the Council adopted its first-reading position on 29 October 2026; the Regulation enters into force after approval by the European Parliament at second reading and publication in the Official Journal.²

The PSR moves most of PSD2's conduct and liability rules into a directly applicable regulation. For insurers the key changes are the fraud liability rules: payment service providers become liable, under defined conditions, for impersonation fraud in which the fraudster poses as bank staff or an official channel; name and IBAN must be verified before credit transfers; and large online platforms and search engines may share liability for fraudulent financial advertising. Relevant for crime and personal cyber claims and for subrogation against banks and platforms. See Crime and fidelity claims.

4. Operational resilience and AI

4.1. DORA: Regulation (EU) 2022/2554

CELEX 32022R2554. Applies from: 17.01.2025.

DORA covers insurance and reinsurance undertakings and insurance, reinsurance and ancillary insurance intermediaries (Art 2(1)(n)–(o)). It does not apply to small insurers within Article 4 of Solvency II, nor to intermediaries that are micro, small or medium-sized enterprises (Art 2(3)). Requirements: ICT risk management, incident reporting, resilience testing and ICT third-party risk. KindlTS § 105¹ governs notification of incidents and cyber threats. See War exclusions and cyber.

4.2. AI Act: Regulation (EU) 2024/1689

CELEX 32024R1689. Consolidated text of 27.07.2026.

Annex III, point 5(c) classifies as high-risk AI systems intended to be used for risk assessment and pricing in relation to natural persons in life and health insurance. Providers and deployers of such systems face risk-management, data-quality, transparency and human-oversight requirements. AI used in non-life underwriting or claims is not high-risk on this ground, but other obligations of the Act and GDPR Article 22 may apply.

2026 amendment. Regulation (EU) 2026/1744 (in force 27 July 2026) postponed the high-risk rules: they apply to Annex III systems, including life and health underwriting and pricing systems, from 2 December 2027 and to systems embedded in Annex I products from 2 August 2028. The general date of application of the AI Act, 2 August 2026, did not change.³ For coverage questions see AI risk insurance in Estonia.

4.3. Cyber Resilience Act: Regulation (EU) 2024/2847

CELEX 32024R2847. Application: manufacturers' reporting obligations (Art 14) from 11 September 2026; the Regulation as a whole from 11 December 2027.⁴

Sets cybersecurity requirements for products with digital elements across their life cycle, including the duty to report actively exploited vulnerabilities and severe incidents. Relevant for product liability and technology E&O cover of software and device manufacturers, cyber underwriting, and producer liability together with the new Product Liability Directive (a lack of security updates may make a product defective). See Product liability in Estonia.

5. Sanctions and aviation

5.1. Russia sanctions Regulation (EU) No 833/2014

CELEX 32014R0833. Consolidated text of 24.07.2026.

The regulation contains several insurance-related prohibitions. Article 3c(2), for example, prohibits providing insurance and reinsurance, directly or indirectly, in relation to aviation and space goods and technology listed in Annex XI to any person in Russia or for use in Russia; Article 3n concerns services, including financial assistance, related to the maritime transport of Russian crude oil and petroleum products and addresses the payment of insurance claims. Relevant to sanctions clauses, marine and aviation business and the question whether an insurer may withhold payment. See Sanctions and insurance.

5.2. Air carriers' insurance Regulation (EC) No 785/2004

CELEX 32004R0785. Consolidated text of 30.07.2020. Minimum insurance requirements for air carriers and aircraft operators, directly applicable in Estonia.

6. Summary table

Related pages

• Legal framework overview
• EU directives
• Choice of law and jurisdiction
• Sanctions and insurance
• Baltic comparison

References