War and geopolitical risk claims in Estonia and the Baltics

Estonia borders Russia, and property, energy, cargo, marine, cyber, political violence and life risks in the Baltic states are exposed to drone incidents, sabotage of infrastructure, hybrid attacks and sanctions. For an insurer, each event raises two kinds of question at once: coverage (does a war, terrorism, sabotage or cyber-war exclusion apply, and who must prove it?) and compliance (may the insurer pay at all?). War and geopolitical risk is one of the focus areas of my practice. The legal analysis is set out in the guides on war exclusions and cyber and sanctions and insurance and in the post on war risk exclusions after Nord Stream; this page describes the service.

1. Typical situations

• A drone, missile fragment or debris strikes an insured building, plant or vessel, and the property and business interruption claims turn on whether the event is war, a hostile act, terrorism, sabotage or malicious damage.
• Damage to subsea cables, pipelines or energy infrastructure, with contingent business interruption claims and uncertain attribution.
• A state-linked cyber operation against an insured, raising a cyber-war or state-backed attack exclusion.
• A claim involving a designated person, a restricted vessel or restricted goods, or a ransom demand from a group that may be sanctioned.
• Life and accident claims of members of the Defence Forces or the Defence League, or of persons travelling to conflict zones.
• Local war-risk extensions to property policies, set against specialist political violence covers placed internationally.

2. Coverage under Estonian law

Exclusion, not obligation. The Supreme Court requires a court first to decide whether a clause excludes the insured risk or regulates the policyholder's duty of care, the test being whether the condition depends mainly on the policyholder's conduct and fault.¹ War, terrorism and cyber-war exclusions describe events outside the policyholder's control. In my assessment they are therefore genuine exclusions, and the limits on release for breach of obligations in the Law of Obligations Act (võlaõigusseadus, VÕS) § 452 lg 2 do not apply to them.²

Standard terms. An exclusion must be properly incorporated and must not be so unusual or incomprehensible that the policyholder could not reasonably expect or understand it (VÕS § 37 lg 1 and 3). It is interpreted as a reasonable person in the position of the policyholder would understand it and, in case of doubt, against the insurer (§ 39 lg 1). A term concerning the main subject matter of the contract is not treated as unreasonably disadvantageous (§ 42 lg 2); whether a given exclusion defines the main subject matter is a question of interpretation. London wordings used without adaptation are where the doubts arise: "war between major powers", "military operation" or "hostile act" in a NATO state that is not a party to the conflict.

Proof and causation. The insurer bears the burden of proving the facts on which the exclusion rests, including the link between the loss and the war. Government attribution statements are evidence; whether they are conclusive depends on the wording. "Directly or indirectly" causation language widens an exclusion, as the English Commercial Court's 2026 Nord Stream judgment discussed in the post linked above shows, but an Estonian court applying Estonian law is not bound by that judgment.

Large risks. For the transport classes and for policyholders above the thresholds in VÕS § 427 lg 2–3, the semi-mandatory rules do not apply. That matters for obligations and procedure; it does not change the analysis of a genuine exclusion.

3. Sanctions

A transaction that violates an international sanction is void; if authorisation is later granted, it becomes valid from the date it was made (International Sanctions Act (rahvusvahelise sanktsiooni seadus, RSanS) § 7). For financial sanctions the competent authority is the Financial Intelligence Unit (Rahapesu Andmebüroo) (§ 11 lg 3 p 3).³ For claims this means screening of parties, payees and the insured interest before payment, refusing payment where it is prohibited, and applying for authorisation where the law allows. A refusal based on sanctions should still state the consequence of the one-year period for bringing an action, or that period will not run (VÕS § 475 lg 3). Ransom payments are not prohibited as such, but a payment to a designated person is.

4. Cyber operations

Market clauses on cyber war and state-backed cyber attacks define their thresholds and attribution mechanisms in detail. Under Estonian law their key terms must be transparent, and an attribution mechanism operates as an agreement on evidence that has to be read with the standard-terms rules. Service providers within the Cybersecurity Act (küberturvalisuse seadus, KüTS) must notify a cyber incident with a significant impact to the Information System Authority without delay and at the latest within 24 hours (KüTS § 8 lg 1);⁴ those reports and the authorities' findings may become evidence on what happened and who was behind it. See breach coach for cyber incidents.

5. What I do

• Coverage opinions on war, terrorism, sabotage, political violence and cyber-war exclusions, with an explicit confidence level.
• Investigations: establishing the facts of the incident and the attribution evidence available from public sources, authorities and technical experts.
• Claims letters: reservation of rights and declinations that identify the legal basis precisely.
• Wording reviews: consistent definitions of war, terrorism, sabotage and malicious damage across property, business interruption and cyber sections of Baltic programmes.
• Representation in Estonian courts and arbitration, and expert opinions on Estonian law for courts and tribunals abroad.
• Baltic programmes: Latvian and Lithuanian law through WIDEN's teams in Riga and Vilnius (see pan-Baltic coverage).

Related pages

• War exclusions and cyber insurance under Estonian law
• Sanctions and insurance in Estonia
• Subsea infrastructure, the shadow fleet and shipowner liability
• War risk exclusions after Nord Stream
• Exclusions vs obligations
• D&O, cyber, crime, liability and war-risk claims

References