Cyber Resilience Act reporting duties start on 11 September 2026
infopol

Does Your Company Operate in a Sector Covered by KüTS?

From 2026, companies face strict obligations and real accountability.

7 key changes:

The law lists specific sectors (e.g. e-commerce, IT services, energy, transport) where cybersecurity requirements apply. The size threshold — 50+ employees or turnover/balance sheet exceeding €10 million — then determines whether the full essential entity obligations apply to you.

  • 1The exemption only applies when both conditions are met simultaneously: fewer than 50 employees AND turnover or balance sheet total up to €10 million.
  • 2If either threshold is exceeded, the exemption does not apply and the requirements come into force.
  • 3This means "we have an IT partner" or "we use the cloud" does not exempt you from having functioning security controls and documented evidence.

"Network and information systems cybersecurity requirements" (exemption description for service provider size)

www.riigiteataja.ee
Infopol solves this

Infopol turns the requirements into a checklist, creates the necessary documents and collects evidence in one place — so you can meet your obligations without it becoming a separate project.

If you operate an online marketplace, you are a named service category under the law to which cybersecurity requirements apply.

  • 1"Online marketplace operator" is a separately named category under the law.
  • 2If you also meet the size thresholds from the previous point, you fall under mandatory requirements.
  • 3In practice this means web application security, supplier management, and incident processes must be demonstrable.

Cybersecurity Act (KüTS) § 3 (types of essential entities and threshold for e-commerce)

www.riigiteataja.ee
Infopol solves this

Infopol builds a ready-made structure: roles, procedures, logs and evidence in one place — so "show us the proof" never turns into a search operation.

The law demands personal accountability from management — and if no one is designated, every board member is liable.

  • 1Every service provider must designate at least one board member who approves security measures, monitors their implementation, and is personally accountable for the outcomes.
  • 2That responsible board member must undergo regular training to be capable of assessing risks, their impact on services, and risk management approaches — ignorance is not a defence.
  • 3If no board member is designated, all obligations under this section automatically apply to every board member individually — there are no exceptions.

KüTS § 61 (Service provider board member obligations)

www.riigiteataja.ee
Infopol solves this

Infopol documents the board member designation, training history, and security measure approvals — making it clear at any point who is accountable and when obligations were last fulfilled.

The regulation establishes baseline security measures that must be genuinely in use — not just documented.

  • 1Requirements are framed as security domains for which controls and evidence must exist.
  • 2This forces you to build a system, not individual documents: who does it, when, and where is the proof.
  • 3Without this, audits, partner security questionnaires, and incident follow-ups all fail.

"Network and information systems cybersecurity requirements" § 5¹ "Baseline security measures"

www.riigiteataja.ee
Infopol solves this

Infopol turns security measures into workflows and evidence: who approves, who acts, what is done, what is missing.

Supplier and third-party service management is a separate security domain that must be actively governed.

  • 1Large customers and buyers must verify supply chain security — which means they will start checking you too.
  • 2If you cannot show how you manage supplier risks, you will lose contracts and tenders.
  • 3This is not theoretical: questionnaires, audit requests, and "please provide evidence" are becoming the norm.

Network and information systems cybersecurity requirements § 5¹ paragraph 1 point 4 (supplier management)

www.riigiteataja.ee
Infopol solves this

Infopol provides supply chain control forms and evidence structure — so "we have partners" becomes "we manage risks and can prove it".

KüTS places a mandatory obligation on service providers to report and manage cyber incidents.

  • 1Notification must happen after becoming aware of an incident — and assumes you have a process, not improvisation.
  • 2Incident logs, timelines, and decisions must be reproducible.
  • 3Without a process, a violation occurs already during the response phase.

KüTS § 11 (digital service provider notification obligation)

www.riigiteataja.ee
Infopol solves this

Infopol provides a ready-made incident workflow, logging, and report structure — so a notification "clock" does not catch you off guard.

GDPR requires that you can demonstrate how you protect data, and in the event of a breach you must act fast.

  • 1If you cannot demonstrate compliance, it is treated as practically equivalent to non-compliance.
  • 2In a breach situation, the supervisory authority notification timeline is time-critical.
  • 3Without documentation and workflows it is impossible to respond in time.

GDPR art 24 and art 33 (and where applicable art 34)

eur-lex.europa.eu
Infopol solves this

Infopol consolidates GDPR evidence (policies, roles, processes, logs) in one place — so the question "prove it" does not turn into panic.