Operates a social platform, in Estonia

Võlaõigusseadus, §§ 1061-1067 · Read the law's page

• If you produce, import into the EU, or put your name or trade mark on a product, including computer software, you answer for the death, bodily injury or damage to health it causes while defective (Arts. 1061(1), 1062(1), 1063(1)).
• If you cannot name the producer or your own supplier to the injured person within a reasonable time after being asked, you answer as the producer (Art. 1062(2)).
• Be ready to prove one of the defences in Art. 1064(1): that you did not put the product on the market, that it was probably not defective then, that it was not made for sale or distribution in your business, that the defect results from mandatory requirements in force then, or that the state of science and technology did not allow the defect to be discovered.
• If you make a raw material or component, be ready to show that the defect results from the design of the finished product or the finished-product producer's instruction (Art. 1064(2)).
• Do not rely on a contract term to limit or exclude your liability to the injured person; it is void (Art. 1067).

Delfi AS v. Estonia [GC], no. 64569/09, ECHR 2015

• Apply this ruling if you run a large, professionally managed Internet news portal on a commercial basis that publishes its own news articles and invites readers to comment on them. The Court stated that it does not concern an Internet discussion forum or bulletin board where users set out their ideas on any topic without input from the forum's manager, or a social media platform where the provider offers no content.
• If you run such a portal, remove comments that amount to hate speech or incitement to violence, and so are clearly unlawful on their face, without delay after publication, even without notice from the alleged victim or from third parties. The Court considered that Contracting States may be entitled to impose liability on a news portal that fails to do so without contravening Article 10 of the Convention.
• Do not rely on an automatic word-based filter and a notice-and-take-down button alone for hate speech and direct threats to physical integrity. The Court found the filter failed to catch manifest expressions of hatred and blatant threats, which stayed online for six weeks, and said a notice-and-take-down system works as an appropriate tool in many cases only if accompanied by effective procedures allowing for rapid response.
• Put in place a way for a victim of hate speech to bring a claim effectively against the authors of comments. The Court counted the lack of one, with the uncertain effectiveness of measures to establish the authors' identity, among the factors supporting the finding that the Estonian Supreme Court based its judgment on relevant and sufficient grounds.
• Do not count on the exemption in section 10 of the Information Society Services Act if you govern the information stored in your comments section: the Estonian Supreme Court held that such a portal provided a content service and so could not rely on it.

Infoühiskonna teenuse seadus §§ 12(2) and 15-2, RT I 2004, 29, 191 · Read the law's page

• If you provide an online intermediation service to business users, meet the requirements of Articles 11 and 12 of Regulation (EU) 2019/1150, the internal complaint-handling system and the mediation provisions, which Section 15-2 of the Infoühiskonna teenuse seadus backs with a fine.

Infoühiskonna teenuse seadus, RT I 2004, 29, 191, §§ 12 to 14, 15-3 to 15-5 and 16 · Read the law's page

• Comply with Articles 9 to 14, 16 to 18, 20 to 23, 25 to 28, 30 to 32 and 34 to 41 of the Digital Services Act, the obligations whose breach Section 15-3 of the Infoühiskonna teenuse seadus makes a misdemeanor.
• Meet the reporting obligations in Articles 15, 24 and 42 of the Digital Services Act, and put only correct, complete and non-misleading information in a report (Section 15-4).
• When the Consumer Protection and Technical Regulatory Authority supervises compliance with the Digital Services Act, give it access to your premises and information, give it correct, complete and non-misleading information, and respond to and correct information it finds incorrect, incomplete or misleading (Section 15-5).

Infoühiskonna teenuse seadus §§ 12(5), 12(6), 12-2 and 15-6 to 15-8, RT I 2004, 29, 191 · Read the law's page

• Remove terrorist content, or disable access to it, within one hour of receiving a removal order, and inform the authority that issued the order without undue delay once you have done so (Article 3(3) and (6) of Regulation (EU) 2021/784, whose breach Section 15-6 of the Infoühiskonna teenuse seadus punishes).
• When you receive a cross-border removal order under Article 4, take the measures provided for in Article 3 and the measures needed to be able to reinstate the content or access, and reinstate it immediately on receiving a decision that finds the order infringes the Regulation (Article 4(2) and (7)).
• Promptly inform the authorities competent for the investigation and prosecution of criminal offences when you become aware of terrorist content involving an imminent threat to life (Article 14(5), backed by Section 15-7).
• Meet the other duties of the Regulation that Section 15-8 backs with a fine: if you are exposed to terrorist content, apply terms and conditions against its misuse, take and report specific measures (Article 5(1) to (3), (5) and (6)); keep the safeguards for preserved content (Article 6(3)); publish your policy and transparency report (Article 7); run a complaint mechanism (Article 10); tell content providers of a removal (Article 11); designate a contact point for removal orders (Article 15(1)); and, if your main establishment is outside the Union, designate a legal representative (Article 17).

Küberturvalisuse seadus (Cybersecurity Act), RT I, 30.12.2025, 4, §§ 6-1 and 7, as amended by RT I, 06.10.2026, 1 · Read the law's page

• Apply, on an ongoing basis, appropriate and proportionate technical, operational and organisational security measures, built on your own risk analysis, to manage the risks to the system you use in your activities or to provide your service, to prevent or minimise a cyber incident's impact on your service's recipients and on other services, and to prevent, detect or resolve a cyber incident.
• Account for your own needs and security requirements, current European and international standards where relevant, the cost of the measures, their proportionality to your risk exposure and to the likelihood and severity of a cyber incident including its societal and economic impact, and a systemic, comprehensive approach that protects both the systems and their physical environment.
• Where you delegate management of your system to another person, or host it with another person, you remain responsible for ensuring that person applies the security measures.
• Designate at least one management board member (or, if you have only one, that member, or the equivalent office-holder if you have no board) to approve your security measures, monitor their implementation and answer for that duty, and have that person complete regular training to understand and assess cyber risk, its impact on your services, and how to manage it.
• This binds an essential entity (ülioluline üksus) or an important entity (oluline üksus) under the Cybersecurity Act's Section 3, whose lists mirror NIS2's Annex I and Annex II; meeting those criteria brings you in, with no declaration. A domain name system service provider or top-level domain name registry operator is essential at any size (Section 3(2) points 1 and 7). A cloud computing, data centre, content delivery network, managed service or managed security service provider is essential at 250 or more employees with a balance sheet over EUR 43 million or turnover over EUR 50 million (Section 3(3)), and important from 50 employees with a balance sheet or turnover over EUR 10 million (Section 3(4) point 8); an online marketplace, online search engine or social media platform provider is important from that 50-employee size (Section 3(5)). A domain name registration service provider is not bound by this duty and only reports its details to RIA (Section 3-1). Energy, transport, health, drinking water, public administration and the other sector classes are reached the same way, but a credit institution, a trading venue operator and the securities register keeper are exempt and follow Regulation (EU) 2022/2554 (DORA) instead (Credit Institutions Act Section 82^4(3), Securities Market Act Section 124^6(9), Securities Register Maintenance Act Section 30^2(2)).
• The specific technical, methodological and, where relevant, sector-specific content these measures must have, including the Estonian Information Security Standard (E-ITS), comes from a Government or ministerial regulation issued under this duty.

Küberturvalisuse seadus (Cybersecurity Act), RT I, 30.12.2025, 4, §§ 8 and 8-1, as amended by RT I, 06.10.2026, 1 · Read the law's page

• Submit an initial report to RIA without delay and no later than 24 hours after becoming aware of a cyber incident that has, or could reasonably be expected to have, a significant effect on your system's security or your service's continuity, unless you are a security authority.
• A cyber incident has a significant effect if any of: it rates at least severe under your own risk analysis; it prevents you continuing your service beyond the maximum permitted outage in your service-level agreement or continuity requirements; it disrupts another provider's service continuity; resolving it requires extraordinary measures from your risk analysis or continuity documentation; it has caused or risks significant damage to you, another provider or your service's users; or a European Commission implementing act names it as significant. An incident that also disrupts your service in another EU member state is always significant.
• Where you delegate the administration of your system to another person or host it with another person, make sure that person notifies you within 24 hours of becoming aware of a cyber incident that has, or could reasonably be expected to have, a significant effect on your system's security or your service's continuity (Section 8, subsection 1-1).
• Follow with an incident report no later than 72 hours after becoming aware of the significant incident, updating the initial report, unless you are a trust service provider, in which case you submit it within 24 hours instead.
• Submit an interim report if RIA asks for one, and a final report within one month of the incident report, or, if the incident is still unresolved at that point, treat that report as interim and submit a further final report within one month of resolution.
• Where relevant, notify within a reasonable time any person the significant incident or a significant cyber threat may affect, or the public where you cannot notify affected persons individually; inform the public yourself if RIA requires it, where public awareness serves prevention, resolution or the public interest.
• You may also voluntarily notify RIA of a cyber incident, a security vulnerability or a cyber threat, and from 16 October 2026 of a near-miss cyber incident, including a vulnerability report submitted anonymously.
• This binds the same essential and important entities as this jurisdiction's companion risk-management row, on the same Section 3 and Section 2(2) scope.

Reklaamiseadus, RT I 2008, 15, 108, § 30(2-1) to (2-3) and § 34-1 · Read the law's page

• If you are a provider of political advertising services, meet the obligations of Articles 5 to 17 and Article 21 of Regulation (EU) 2024/900, including the mechanism that lets people notify you of a political advertisement that does not comply (Article 15), which Section 34-1 of the Reklaamiseadus backs with a fine.

Võlaõigusseaduse ning võlaõigusseaduse, tsiviilseadustiku üldosa seaduse ja rahvusvahelise eraõiguse seaduse rakendamise seaduse muutmise seadus (uue tootevastutuse direktiivi ülevõtmine) · Read the law's page

• Treat software as a product: software you develop or supply in your business answers like any other product, whether sold alone or built into another product (draft § 1063(1)).
• Keep supplying the software updates and upgrades a product needs to stay safe while it is within your control; a defect caused by software, an update, a missing safety update or a substantial modification within your control is not excused by saying it arose after you put the product on the market (draft §§ 1061(3[1]), 1061(3[2]), 1064(2[2])).
• Keep the technical documentation you could produce if a court orders disclosure on the injured person's application; failing to produce it presumes the product defective (draft §§ 1065[1](1), 1065(2)).
• If you are outside the EU, your importer or authorized representative answers for the product in your place, then your fulfilment service provider, then a distributor or online platform that does not name the responsible business within one month (draft § 1062[1](6), (7), (9), (10)).
• Be ready to prove one of the defences in § 1064(1), including that the defect could not be discovered given the state of science and technology when the product was put on the market, put into service or under your control (draft § 1064(1) point 5).
• Do not rely on a contract term to limit or exclude your liability to the injured person; it is void (draft § 1067).