Järelepärimine

Dear Information System Authority,

I am contacting you in connection with our ongoing internal examination into whether our company is affected by NIS2 in Estonia and whether a registration obligation applies to us.

Meanwhile we understand the deadline of self-registration is April 1, 2026, the deadlines in respect of

• Contracting and auditor from this list: https://www.eisay.ee/e-its-ja-iso-27001-alaste-teenustega-tegelevate-ettevotete-loetelu and
• Having the first audit completed

are not entirely clear.

Although according to the general rule a service provider should perform the audit within three months once it should be considered a service provide under the act, based on our online research the applicable deadline of the first audit completion is only January 01 2028, having regard to the recent entry into force of the cybersecurity act and the self-registration deadline of 01 April 2026 meanwhile we could not find an exact deadline as regards contract execution with the auditor.

Could you help us with understanding these deadlines?

Thank you very much for your help and kind regards,

Blanka Barat-Szucs| Dr. Jur. | Legal Counsel| Legal | PSI CRO

Mobile: +36 20 255 1043 |  Fax: +36 1 555 6750|

Dózsa György Street 84/B.| Budapest| 1068| Hungary

Email: [email protected]

Website: www.psi-cro.com

PSI Earns Four CRO Leadership Awards in 2024 

The contents of this email message and any attachments are intended solely for the addressee(s) and may contain information which is confidential, proprietary and/or legally privileged. If you are not the intended recipient of this message or their agent, or if this message has been addressed to you in error, please immediately alert the sender by reply email and then delete this message and any attachments. If you are not the intended recipient, you are hereby notified that any use, dissemination, copying, or storage of this message or its attachments is strictly prohibited