On 23 September 2026 Estonia's Riigikogu adopted Bill 897 SE, an amendment to the Cybersecurity Act. According to the Digital Policy Alert tracker, the bill, introduced on 4 May 2026, broadens the statutory definition of a 'cyber incident' to cover events that compromise the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data. We could not read the full provisions or confirm an entry-into-force date, because the tracker's detail sits behind a login. What can be said rests on the definition itself and on the wider EU framework it builds on.
The strongest case for a broad definition
The argument for casting the net wide is serious. Estonia is one of the most digitised states in the world and one of the most persistently targeted. Its national cyber security centre, the Information System Authority (RIA), describes itself on its official site as the body that handles security incidents in Estonian computer networks and runs the reporting environment where incidents are submitted. A narrow definition leaves gaps. If only events that 'compromise security' count, an organisation can argue that a data-integrity problem, or a loss of authenticity such as spoofed records, was not reportable. Regulators then see only part of the threat picture. Early, consistent reporting is the raw material of national defence, and a definition built around the four classic properties of information security is hard to dispute on technical grounds.
The wording is not novel: it is NIS2's
The key fact for assessing the amendment is that the language is not Estonian invention. Article 6 of the EU's NIS2 Directive (2022/2555) defines an 'incident' as 'an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems.' The four properties and the 'stored, transmitted or processed' phrasing in the tracker's summary of Bill 897 SE follow that text closely.
That matters for innovation policy. The main risk in national transpositions is gold-plating, where a member state adds obligations beyond the common standard and so raises costs for firms that operate across borders. Copying the directive's definition does the opposite. A company with operations in Tallinn, Helsinki and Frankfurt can build one incident-classification process rather than three. Alignment is a deregulatory instinct, even when the scope looks larger on paper.
The tracker confirms only the definition. We cannot say whether the bill also changes reporting duties, penalties or the list of covered entities, and readers should not assume it does.
Where the real burden sits
A broad definition of an incident is not by itself a heavy burden. What costs money is the reporting threshold layered on top. NIS2 does not require every incident to be reported. It builds its notification duties around 'significant' incidents, and the compliance cost depends on how national law and RIA guidance define that term. Estonia has also already expanded the regulated perimeter. According to a NIS2 status tracker, the transposition amendments were passed in December 2025 and entered into force on 1 January 2026, and the explanatory memorandum puts the in-scope population at growing from about 3,500 to about 6,500 entities. That is a secondary, commercial source, so treat the figures as indicative. Even so, the scale makes the point: the practical effect of the 2026 amendment will be set by guidance, not by the definition clause.
There is a second risk, which is over-reporting. When a legal definition reaches any compromise of data, a small firm that loses a laptop or sees a failed phishing attempt may feel pressure to file notices defensively. If the regulator is flooded with low-value reports, the signal that matters gets harder to find. The remedy is not a narrower definition. It is clear, published thresholds, proportionate treatment of small entities, and a no-penalty posture for good-faith reports.
Estonia's defensive credibility is already high
Estonia is not a country that needs convincing about cyber risk. It hosts NATO's Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn. The centre was established on Estonia's initiative with six other nations on 14 May 2008 and received full NATO accreditation that October. By 2026 it brings together 39 member nations. Each April it runs Locked Shields, which this year drew more than 4,000 cyber defenders from 41 nations, according to the CCDCOE. SecurityWeek reported that 16 multinational teams took part and that the exercise began in 2010 with four nations and 60 people.
This context counts for something. A country that trains this deeply in incident response can credibly apply a broad, standard definition without crippling its tech sector. It also faces a particular temptation. Because Estonia is a showcase for state cyber capacity, it could be tempted to treat compliance as a performance metric. The test of the 2026 amendment is whether it makes the defensive system more informed without making Estonian start-ups the slowest to scale in the single market.
What to watch
Three things will decide whether Bill 897 SE is a model or a cautionary tale:
- Entry into force and transition time. Firms need a realistic window to update classification and escalation processes. The date has not been confirmed in the sources available to us.
- Threshold guidance from RIA. The definition says what an incident is. Guidance says what must be reported and when. Published examples would help small firms far more than statutory text.
- Enforcement posture. Supervision that rewards early disclosure builds the trust that national defence relies on. Punitive treatment of first-time reporters would push incidents underground.
The broader lesson for other member states still finishing their transpositions is that fidelity to the directive is a feature. Estonia's amendment appears to do the sensible thing: it harmonises, it avoids inventing new categories, and it leaves the hard proportionality choices to guidance where they can be tuned with evidence. The remaining job is to make sure that proportionality is actually delivered.