Estonia

Section 32^1 of the Kutseõppeasutuse seadus (Vocational Educational Institutions Act) gives a school the right to process a pupil's personal data in order to use an artificial intelligence application in teaching. The school processes the pupil's general data, the personal data, including special categories, that the pupil enters into the application to complete the curriculum, and other personal data, including special categories, that the pupil enters while using it.

The school keeps the personal data for up to three months after the pupil leaves the school. The application must let the pupil delete the other personal data that the pupil entered while using it, which point 3 of subsection 2 describes, and where the two kinds of data cannot be told apart, must let the pupil delete all the data the pupil entered.

The application must not allow a school representative access to those other data, or, where the two kinds of data cannot be told apart, to any of the data the pupil entered. The minister responsible for the field may by regulation set further safeguards for the use of an artificial intelligence application in teaching.

Section 20^1 of the Põhikooli- ja gümnaasiumiseadus (Basic Schools and Upper Secondary Schools Act) gives a school the right to process a pupil's personal data in order to use an artificial intelligence application in teaching. The school processes the pupil's general data, the personal data, including special categories, that the pupil enters into the application to complete the curriculum, and other personal data, including special categories, that the pupil enters while using it.

The school keeps the personal data for up to three months after the pupil leaves the school. The application must let the pupil delete the other personal data that the pupil entered while using it, which point 3 of subsection 2 describes, and where the two kinds of data cannot be told apart, must let the pupil delete all the data the pupil entered.

The application must not allow a school representative access to those other data, or, where the two kinds of data cannot be told apart, to any of the data the pupil entered. The minister responsible for the field may by regulation set further safeguards for the use of an artificial intelligence application.

Section 82^15(1) requires an investment firm that engages in algorithmic trading, including high-frequency algorithmic trading technique, to apply suitable and effective systems and risk controls so that its trading IT system is resilient, has sufficient capacity, applies appropriate trading thresholds and limits and prevents erroneous orders. In applying those measures the firm follows Commission Delegated Regulation (EU) 2017/589 and Regulation (EU) 2022/2554.

Section 82^15(5) requires an effective business continuity arrangement to deal with trading system failures, and full testing of the systems. Finantsinspektsioon, the Financial Supervision Authority, supervises compliance with the Act. Under section 82^15(8) the firm notifies the Financial Supervision Authority, and the competent supervisory authority of the trading venue, that it engages in algorithmic trading.

On request the firm gives the Financial Supervision Authority information on its algorithmic trading and the systems it uses, including a description of its trading strategies, the trading parameters or limits, the testing of the systems and the main compliance and risk controls.

A firm that uses high-frequency algorithmic trading technique records precise, chronological data on every order submitted, cancelled and executed and every quotation made on a trading venue, and gives them to the Financial Supervision Authority on request.

Section 82^16(1) requires a firm that gives a client direct electronic access to a trading venue to apply effective systems and controls to assess the client's suitability, review that assessment regularly, ensure that the client observes appropriate trading thresholds and limits and monitor the client's trading, and does not allow direct electronic access without those measures.

The firm concludes a binding written agreement with the client under which the firm remains responsible for meeting the requirements of the Act.

A controller must notify the Estonian Data Protection Inspectorate (AKI) without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Estonia, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

The Personal Data Protection Act (PDPA) gives the General Data Protection Regulation (GDPR) domestic effect in Estonia and is enforced by the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI). Section 8 of the PDPA sets the age at which a child can consent to information society services at 13, below the GDPR default of 16.

Distinctively, Estonia's Information System Authority (RIA) operates a citizen-facing Data Tracker (Andmejalgija) that lets a person see, in one place, which public-sector systems connected via X-Road have processed their data, an operational implementation of the GDPR Article 15 access right rather than a separate statutory right.

Transferring personal data of a person in Estonia outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier.

General Data Protection Regulation (GDPR) Article 22 gives a person in Estonia the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

The Personal Data Protection Act adds no rule of its own on automated decisions by a private controller; its automated-processing provision (§ 21) sits in the chapter on law-enforcement authorities.

General Data Protection Regulation (GDPR) Articles 12 to 21 apply directly: access, rectification, erasure, restriction, portability, and objection, exercisable against the controller. The public sector's access right is distinctively implemented as unified infrastructure through RIA's Data Tracker service, letting a citizen see which public-sector systems have processed their data in one place rather than requesting this separately from each controller.

The Estonian Data Protection Inspectorate (AKI) is the supervisory authority. Under Section 73(2) of the Isikuandmete kaitse seadus (Personal Data Protection Act), AKI is the out-of-court authority (kohtuvaline menetleja) for the misdemeanors (vaartegu) that the Act's penalty provisions create.

Sections 65 to 67 punish infringements of the General Data Protection Regulation (GDPR) processing principles, the conditions for consent, the data subject rights in Articles 12 to 22 and the transfer rules in Articles 44 to 49 with a fine of up to EUR 20,000,000, or, for a legal person, up to EUR 20,000,000 or 4 percent of its preceding financial year's worldwide annual turnover, whichever is greater. The limitation period for these misdemeanors is three years under Section 73(1).

GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category.

Illegal obtaining of access to a computer system by elimination or avoidance of a means of protection is punishable by a pecuniary punishment or up to three years' imprisonment. The offense escalates to up to five years' imprisonment where the act causes significant damage, reaches a computer system holding a state secret or classified information, or reaches a computer system of a vital sector.

Because the base offense requires eliminating or avoiding an established means of protection, accessing a page that carries no such protection, the ordinary case of public-web crawling, does not fall within Section 217 on the text of the section alone.

Section 206 punishes illegal alteration, deletion, damaging or blocking of data in a computer system with a pecuniary punishment or up to three years' imprisonment, rising to five years where the act is committed against numerous systems using the devices or programs described in Section 216-1, by a group, against a vital-sector system, or causes significant damage.

Section 207 punishes illegal interference with or hindering of the functioning of a computer system by uploading, transmitting, deleting, damaging, altering or blocking data on the same three-year and five-year tiers. Unlike Section 217, neither offense is limited to access obtained by circumventing a protective measure, so a scraper that overloads, disrupts or corrupts a target system can fall within these sections even against a page with no access controls.

A maker of a database who has made a substantial investment, in nature, value or size, in collecting, obtaining, verifying, arranging or presenting its contents may prohibit extraction or re-utilization of the whole or a substantial part of that database, per Section 75-3 and 75-4. The right runs for fifteen years from the first of January of the year following completion of the database, restarting if the database is made available to the public before that term expires, per Section 75-7.

A lawful user of a database made available to the public may extract or re-utilise a substantial part without authorization or payment for private non-electronic use, for teaching or scientific research to the extent justified by the non-commercial purpose and with the source indicated, or for public security or an administrative or judicial procedure, per Section 75-6.

Section 75-6 further allows extraction and re-utilisation in the cases covered by the text-and-data-mining exceptions of Sections 19-1 and 19-2 of the Act and certain other exceptions it names.

The Act Amending the Financial Supervision Authority Act and Other Acts (Finantsinspektsiooni seaduse ja teiste seaduste muutmise seadus, RT I, 11.10.2024, 1), proclaimed by the President of the Republic on 2 October 2024, implements Regulation (EU) 2022/2554 (DORA) and Directive (EU) 2022/2556 in Estonian financial-sector law.

Section 1 gives the Financial Supervision Authority (Finantsinspektsioon) the task of performing the duties DORA assigns to it and of cooperating with the cybersecurity authorities of Estonia and other member states, and requires it to take part in the DORA Oversight Forum.

New Section 47^11 of the Financial Supervision Authority Act makes the Authority cooperate with the Information System Authority (Riigi Infosüsteemi Amet), including by consulting it under DORA Article 42(5), and requires the Authority to forward to Eesti Pank without delay any notice or report under DORA Article 19(4) that it receives from a vital-service provider.

Section 7 adds Section 82^4 to the Credit Institutions Act, which requires a credit institution to comply with DORA, including by using and managing network and information systems as DORA provides, to develop, manage and test its ICT continuity and ICT response and recovery plans under DORA Article 11, and which exempts it from the cybersecurity requirements of Chapter 2 of the Cybersecurity Act.

New Section 92^4 of the Credit Institutions Act requires a credit institution to notify the Authority and the Information System Authority of a major ICT-related incident as DORA Article 19 provides.

A penalty provision the Act adds to other financial-sector acts punishes breaches of DORA Articles 5 to 14, 16 to 18, 19(1) and (3) to (5), and the other listed Articles, with a fine of up to EUR 5,000,000 or up to twice the profit gained or loss avoided, and for a legal person alternatively up to 10 percent of its or its consolidation group's consolidated turnover. The provisions Section 11(1) lists enter into force on 17 January 2025, and the rest of the Act took effect on 21 October 2024.

Section 7 requires an essential or important entity to apply, on an ongoing basis, appropriate and proportionate technical, operational and organisational security measures, based on its own risk analysis, to manage the risks to the system it uses in its activities or to provide its service, to prevent or minimise a cyber incident's impact on the recipients of its service and on other services, and to prevent, detect or resolve a cyber incident.

It must account for its own needs and security requirements, current European and international standards where relevant, the cost of the measures, their proportionality to its risk exposure and to the likelihood and severity of an incident including its societal and economic impact, and a systemic, comprehensive approach protecting both the systems and their physical environment.

A service provider that delegates system management to, or hosts its system with, another person remains responsible for ensuring that person applies the security measures. The specific technical, methodological and sector-specific content of these measures, including the Estonian Information Security Standard (Eesti infoturbestandard, E-ITS), is set by a Government or ministerial regulation issued under Section 7, subsections 5 and 6.

Section 7(7), in force since 1 January 2026, directed a provider named in a European Commission implementing act under Directive (EU) 2022/2555 Article 21(5) to follow that act's requirements for the service it covers. Section 7(7) is repealed with effect from 16 October 2026 by the Act published as RT I, 06.10.2026, 1.

Section 6-1, also added by the 2025 amendment, requires a service provider to designate at least one management board member, or for a single-member board that member, or the equivalent office-holder for a provider with no board, who approves the security measures, monitors their implementation, is accountable for that duty, and completes regular training to understand and assess cyber risk.

Section 2(2) defines 'digitaalse teenuse osutaja' (digital service provider), an entity class reached by this duty, as an umbrella covering a domain name system service provider, a top-level domain name registry operator, a domain name registration service provider, a cloud computing service provider, a data centre service provider, a content delivery network service provider, a managed service provider, a managed security service provider, an operator of an online marketplace, and a provider of an online search engine or social media platform.

Section 3(2) names a central government public administration entity as an essential entity. Section 3(2) also names a local government public administration entity as an essential entity, so this duty reaches both public and private duty-bearers. Section 1(2) excludes state-secret and classified-foreign-information systems from the Act. Section 1(2) also excludes systems the Ministry of Defence needs for international military cooperation and national military defence preparation.

Estonia's security authority (julgeolekuasutus) performs the competent-authority tasks of Directive (EU) 2022/2555 Article 8(1) to the extent Section 14 provides. Under Section 14(5) that covers administrative supervision of the security authorities' own systems. Both Section 7 and Section 6-1 entered into force on 1 January 2026 as part of Estonia's NIS2 transposition. Section 7 already stood in the Act before then, and the 2025 amendment reworded it.

A subject is given a three-year transition period to bring its activities into line with these requirements. Under Section 4-1(4), a vital-service provider (elutähtsa teenuse osutaja) instead brings its activity into line within the term set in the manner provided by Section 83(4)(3) of the Crisis Situations and National Defence Act (kriisiolukorra ja riigikaitse seadus).

Section 83(4)(3) of that Act provides that the term for meeting the Cybersecurity Act's requirements is to be no longer than five years from designation as a vital-service provider. RIA's own account of the amendment states that from 2026 the number of Estonian undertakings subject to these requirements grew by about 3,000, to roughly 6,500.

Section 1(4) applies this Act with the derogations that follow from an EU legal act regulating the operation of a provider's network and information system and its cyber-incident notification equivalently to this Act. Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.

Section 8 requires an essential or important entity, other than a security authority, to submit an initial report to RIA (Riigi Infosüsteemi Amet, the Estonian Information System Authority) without delay and no later than 24 hours after becoming aware of a cyber incident with a significant effect on system security or service continuity, or one whose significant effect is not obvious but can reasonably be expected.

Section 8(2) defines 'significant effect' by six alternative conditions: the incident rates at least severe under the entity's own Section 7 risk analysis; it prevents continuing the service beyond the maximum permitted outage in a service-level agreement or continuity requirement; it disrupts another service provider's continuity; resolving it requires extraordinary measures identified in the risk analysis or continuity documentation; it has caused or risks significant damage to the entity, another provider or the service's users; or it is significant under a European Commission implementing act adopted under Directive (EU) 2022/2555 Article 23(11).

Section 8(3) makes an incident always significant where it also disrupts the service in at least one other EU member state. Section 8, subsection 4-1, requires an incident report no later than 72 hours after becoming aware of the significant incident, updating the initial report. A trust service provider instead submits that incident report within 24 hours under Section 8, subsection 4-2. Section 8, subsection 4-3, requires an interim report on RIA's request.

Section 8(7) requires a final report within one month of the incident report, treated as interim and followed by a further final report within one month of resolution if the incident remains unresolved at that point. Section 8(5) requires the entity to notify, within a reasonable time, a person whom the significant incident or a significant cyber threat may affect, or the public where affected persons cannot be individually notified.

Section 8(6) lets RIA itself inform the public after consulting the entity, or require the entity to, where public awareness serves prevention, resolution of the incident, or the public interest generally.

Section 8-1 lets a service provider voluntarily notify RIA of a cyber incident, security vulnerability or cyber threat, and lets any other person notify it of a significant-effect incident, security vulnerability or cyber threat, including a vulnerability report submitted anonymously, processed under the same Sections 8 and 12 procedure.

From 16 October 2026 a notification under Section 8-1 may also concern a near-miss cyber incident, and a notification by any other person may also concern a cyber incident without a significant effect. From 16 October 2026 Section 2, point 19, defines a cyber incident as an event that damages the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data, or of services offered through or accessible via a network and information system.

From that day Section 2, point 22-1, defines a near-miss cyber incident (napilt toimumata jäänud küberintsident) as an event that could have damaged that availability, authenticity, integrity or confidentiality but was prevented or did not occur.

Section 5(3) designates RIA as the competent authority and single point of contact under Directive (EU) 2022/2555 Article 8, the authority for large-scale incidents and crises under Article 9, the national computer security incident response team (CSIRT) under Article 10, the coordinated-vulnerability-disclosure coordinator under Article 12, and Estonia's participant in the CSIRTs network under Article 15. All these duties entered into force on 1 January 2026 as part of Estonia's NIS2 transposition.

Section 1(4) applies this Act with the derogations that follow from an EU legal act regulating the operation of a provider's network and information system and its cyber-incident notification equivalently to this Act. Regulation (EU) 2022/2554 (DORA) is, by its Article 1(2), the sector-specific Union legal act under Article 4 of Directive (EU) 2022/2555 for the financial entities identified as essential or important under national rules transposing that Directive.

Section 103^1(1) of the Electronic Communications Act (Elektroonilise side seadus) allows the use of the electronic contact details of a natural person who is a user or customer of a communications service for direct marketing only with that person's prior consent. Section 103^1(1) requires the consent to meet the conditions that Regulation (EU) 2016/679 (the General Data Protection Regulation (GDPR)) sets.

Section 103^1(2) allows the use of the electronic contact details of a legal person that is a user or customer for direct marketing if each use gives a clear and understandable chance to refuse such use free of charge and in a simple way, and the person can exercise the right to refuse through the electronic communications network.

Section 103^1(3) lets a person who obtained a buyer's electronic contact details in connection with the sale of a product or the provision of a service use them to market its own similar products or services despite section 103^1(1), if the buyer gets a clear and understandable chance to refuse free of charge and in a simple way when the details are first collected and every time they are used, and can exercise the right to refuse through the electronic communications network.

Section 103^1(4) bans the use of electronic contact details for direct marketing where the person on whose behalf the information is sent cannot be identified, where the information carries no instruction or information that lets the recipient exercise the right to refuse, where the information does not meet the requirements of section 5, paragraph 2 of the Information Society Services Act, where it urges people to visit websites that do not meet those requirements, or where the user, customer or buyer has refused the use.

Section 103^1(5) puts the burden of proving the consent on the person on whose behalf the direct marketing is done. Section 103^1(6) provides that the section does not apply to a real-time multi-party voice call. Section 133(4) has the Data Protection Inspectorate (Andmekaitse Inspektsioon) exercise state and administrative supervision of section 103^1 and apply administrative coercion in the manner chapter 5 of the Personal Data Protection Act sets. Section 103^1 took effect on 10 July 2010.

Section 12(5) makes the Security Police Board (Kaitsepolitseiamet) the supervisor of the measures for removing terrorist online content and executing removal orders under Article 3(3) and (6), Article 4(2) and (7), Article 6(1) and (2) and Article 14(5) of Regulation (EU) 2021/784.

Section 12(6) makes the Consumer Protection and Technical Regulatory Authority the supervisor of the technical requirements, content preservation and reporting measures under Article 5, Article 6(3), Articles 7, 10 and 11, Article 15(1) and Article 17 of that Regulation. Section 12-2(1) has the Security Police Board issue the removal order provided for in Article 3 of the Regulation and scrutinize the cross-border removal order provided for in Article 4.

Section 15-6(1) punishes a failure to meet the requirements in Article 3(3) and (6) and Article 4(2) and (7) with a fine of up to 300 fine units. Section 15-6(2) sets the fine for a legal person that commits the same act at up to EUR 400,000. Section 15-6(3) sets the fine for a repeated or systematic act under paragraph 2 at up to four percent of the hosting service provider's turnover in the preceding financial year.

Section 15-7 punishes a failure to meet the requirements in Article 14(5) with a fine of up to 300 fine units, or up to EUR 1,200 for a legal person. Section 15-8 punishes a failure to meet the requirements in Article 5(1) to (3), (5) and (6), Article 6(3), Articles 7, 10 and 11, Article 15(1) and Article 17 with a fine of up to 300 fine units, or up to EUR 1,200 for a legal person.

Under Section 16(3), the Security Police Board is the out-of-court body for the misdemeanors in Sections 15-6 and 15-7. The provisions took effect on 14 July 2024.

Section 12(3) makes the Consumer Protection and Technical Regulatory Authority (Tarbijakaitse ja Tehnilise Järelevalve Amet, TTJA) the independent digital services coordinator within the meaning of Article 49(2) of the Digital Services Act. Section 12(4) has the Authority exercise state supervision over compliance with the requirements laid down in the Digital Services Act.

Section 12-1 has the Authority take part in cross-border cooperation with the digital services coordinators of the other Member States and the European Commission under Chapter IV of the Digital Services Act. Section 13 lets the competent law enforcement authority apply the special supervision measures in Sections 30, 49, 50, 51 and 52 of the Law Enforcement Act (Korrakaitseseadus) to supervise compliance with the Information Society Services Act.

Section 13-2(1) requires an order from a law enforcement authority to an intermediary service provider to take measures against illegal content to meet the conditions in Article 9(2) of the Digital Services Act. Section 13-2(2) requires an order from a law enforcement authority to an intermediary service provider to supply specific information about a specific recipient of the service to meet the conditions in Article 10(2) of the Digital Services Act.

Under Section 14(2), the maximum penalty payment for failing to comply with a precept (ettekirjutus) arising from the Digital Services Act is five percent of the average daily income in the preceding calendar year for a natural person and five percent of the average daily worldwide turnover in the preceding financial year for a legal person, counted from the date stated in the precept.

Section 15-3 punishes a failure to comply with Articles 9 to 14, 16 to 18, 20 to 23, 25 to 28, 30 to 32 and 34 to 41 of the Digital Services Act with a fine of up to 300 fine units, and a legal person that commits the same act with a fine of up to six percent of its worldwide turnover in the preceding financial year.

Section 15-4 punishes a failure to meet the reporting obligations in Articles 15, 24 and 42 of the Digital Services Act, or the giving of incorrect, incomplete or misleading information in a report, with a fine of up to one percent of a natural person's income in the preceding calendar year or of a legal person's worldwide turnover in the preceding financial year.

Section 15-5 punishes obstructing the supervision of compliance with the Digital Services Act, by denying the Authority access to premises or information or by giving incorrect, incomplete or misleading information, with a fine of up to one percent of a natural person's income in the preceding calendar year or of a legal person's worldwide turnover in the preceding financial year.

Section 16(2) makes the Authority the out-of-court body, within its competence, for the misdemeanors (väärteod) in Sections 15, 15-2 to 15-5, 15-8 and 15-9. The act of 4 June 2024 that added these provisions repealed Sections 8 to 10 and Section 11(1) and (3) of the Information Society Services Act.

The same act replaced subsection 6 of Section 57-9 of the Autoriõiguse seadus (Copyright Act) so that, where a platform provider communicates an object of rights to the public without authorization, the liability limit in Article 6(1) of the Digital Services Act does not apply to that activity.

Section 12(2) makes the Consumer Protection and Technical Regulatory Authority (Tarbijakaitse ja Tehnilise Järelevalve Amet, TTJA) the supervisor of compliance with the requirements laid down in Regulation (EU) 2019/1150 on promoting fairness and transparency for business users of online intermediation services. Section 15-2(1) punishes a failure to meet the requirements in Articles 11 and 12 of that Regulation with a fine of up to 300 fine units.

Section 15-2(2) sets the fine for a legal person that commits the same act at up to EUR 400,000. Under Section 16(2), the Authority is the out-of-court body for the misdemeanors (väärteod) in Section 15-2. The provisions were added by an act adopted on 12 June 2021 and published as RT I, 22.06.2021, 13, and took effect on 2 July 2021.

Section 30(2-1) makes the Consumer Protection and Technical Regulatory Authority (Tarbijakaitse ja Tehnilise Järelevalve Amet) the supervisor of compliance with the obligations in Articles 5 to 17 and Article 21 of Regulation (EU) 2024/900 on the transparency and targeting of political advertising. Section 30(2-2) makes the Authority the national contact point within the meaning of Article 22(9), second subparagraph, of the Regulation.

Section 30(2-3) lets the Authority ask the Party Financing Supervision Committee (Erakondade Rahastamise Järelevalve Komisjon) for an opinion on whether a published advertisement is political advertising within the meaning of Article 3 of the Regulation. Section 34-1(1) punishes a failure to meet the obligations in Articles 5 to 17 and Article 21 of the Regulation with a fine of up to six percent of a natural person's income in the preceding calendar year.

Section 34-1(2) sets the fine for a legal person that commits the same act at up to six percent of its worldwide turnover in the preceding financial year. The provisions took effect on 16 March 2026.

Section 1061(1) of the Võlaõigusseadus (Law of Obligations Act) makes the producer liable for a person's death, bodily injury or damage to health that a defective product causes. Section 1061(2) makes the producer liable for the destruction of or damage to a thing only where the thing is of a kind normally used for consumption outside business or professional activity, the injured person used it mainly that way, and the damage exceeds the equivalent of EUR 500.

Section 1061(3) excludes liability for damage to the product itself. Section 1061(4) makes the producer of a defective medicinal product liable under the same division unless a statute provides otherwise. Section 1061(5) leaves claims on any other legal basis, including damages for unlawfully and culpably caused harm, untouched.

Section 1062(1) treats as the producer the maker of the finished product, raw material or component, a person who presents itself as the producer by showing its name, trade mark or other distinguishing mark on the product, and a person who brought the product into Estonia or another Member State of the European Union in its business activity in order to sell, hire out, lease or otherwise distribute it.

Section 1062(2) treats as producer a person who handed the product to the injured person where the producer cannot be identified, unless that person names the producer or its own supplier within a reasonable time after the injured person asks. Section 1063(1) treats as a product any movable thing, even where it is part of another movable or has become part of an immovable, as well as electricity and computer software (arvutitarkvara).

The explanatory memorandum to the Ministry of Justice and Digital Affairs' draft of 21 September 2026 states that the present Act's definition of a product already covers computer software. Section 1063(2) makes a product defective where it is not as safe as a person is entitled to expect, taking all circumstances into account, in particular how the product is presented to the public, the use the injured person could reasonably expect, and when the product was put on the market.

Section 1064(1) frees the producer who proves that it did not put the product on the market, that circumstances indicate the product did not have the damaging defect when it was put on the market, that it neither made the product for sale or other distribution nor made or distributed it in its business or professional activity, that the defect results from the product meeting mandatory requirements in force when it was put on the market, or that the state of science and technology then did not allow the defect to be discovered.

Section 1064(2) frees the producer of a raw material or component who proves that the defect results from the design of the finished product or from the finished-product producer's instruction. Section 1064(3) does not allow the producer's liability to be reduced where the damage resulted both from the defect and from the conduct of a third party. Section 1065 puts on the injured person the burden of proving the damage, the defect and the causal link between them.

Section 1066(1) sets a limitation period of three years from the day the injured person learned, or should reasonably have learned, of the damage, the defect and the identity of the producer. Section 1066(2) ends the claims ten years after the day following the day the product that caused the damage was put on the market, unless an action has been brought by then. Section 1067 makes void any agreement that limits or excludes the producer's liability under the division. The Act came into force on 1 July 2002.

Section 2(1) applies the Act to e-readers, payment terminals, ticketing machines, check-in machines, cash and payment machines, interactive self-service terminals providing information (other than terminals installed as integrated parts of vehicles, aircraft, ships and rolling stock), consumer terminal equipment with interactive computing capability used to access an audiovisual media service or to provide an electronic communications service, and consumer general-purpose computer hardware systems with their operating systems.

Section 2(6) applies the requirements to the products listed in section 2(1) points 3 to 6 when they are used to provide the services listed in section 2(3). Section 2(13) applies the Product Conformity Act to the obligations of the manufacturer, authorized representative, importer and distributor of a product within the Act, to the conformity assessment of the product, to market surveillance and to liability, with the exceptions that follow from the LPS.

Section 2(3) of the Product Conformity Act applies the division of its chapter 2 on the further duties of businesses in the harmonized field, which holds the duties of manufacturers, authorized representatives, importers and distributors, and its chapter 3 on conformity assessment, only where the requirements set for a product derive from European Union harmonization legislation.

Section 5(2) of the Product Conformity Act bars placing on the market or putting into service a product that does not meet a requirement a legal act sets for it. Section 14(4) of the Product Conformity Act requires the manufacturer to keep procedures in place for series production to remain in conformity. Section 14(5) of that Act requires the manufacturer to ensure that its product bears a type, batch or serial number or another marking that allows it to be identified.

Section 14(6) of that Act requires the manufacturer to mark its name or trade mark and contact address on the product or, where that is not possible, on the packaging or in an accompanying document. Section 14(7) of that Act requires a product made available to consumers to come with instructions and safety information in Estonian at least.

Section 14(8) of that Act requires a manufacturer that believes a product it placed on the market does not meet the requirements of European Union harmonization legislation to take without delay the measures needed to bring it into conformity, recall it from end users or withdraw it from the market. Section 4(1) requires a product, when it is placed on the market, to meet the accessibility requirements, subject to section 4(5) and section 5.

Section 4(2) requires a product to be designed and manufactured in a way that gives people with disabilities its maximum usability. Section 6(1) requires the manufacturer, before placing a product on the market, to draw up technical documentation and to carry out or have carried out the conformity assessment, and, where the product conforms, to draw up the EU declaration of conformity and to affix the conformity marking.

Section 6(2) requires the manufacturer to keep the technical documentation and the declaration of conformity for five years after the product is placed on the market. Section 6(3) requires the manufacturer to ensure that the instructions, information and labeling that accompany the product are clear, understandable and comprehensible.

Section 6(4) requires a manufacturer that learns that a product it placed on the market does not meet one or more applicable requirements to notify TTJA of the non-conformity, with details of it and of the corrective measures applied. Section 6(5) requires the manufacturer to keep records of products placed on the market that do not meet the applicable requirements and of the complaints about them.

Section 7 lets an authorized representative whom the manufacturer has appointed perform the obligations in section 14 on the manufacturer's behalf and responsibility. Section 7 also requires the authorized representative to keep the technical documentation and the declaration of conformity available to TTJA for five years after the product is placed on the market.

Section 12(1) provides that a product's conformity with the accessibility requirements is shown on placing it on the market by the internal production control conformity assessment procedure. Section 12(2) requires the manufacturer to take the measures needed for the production process and its control to keep the product in line with the technical documentation and the applicable accessibility requirements.

Section 13(2) requires the technical documentation of a manufacturer that relies on fundamental alteration or disproportionate burden to allow it to show that one or more applicable requirements would cause that alteration or burden.

Section 13(3) requires the technical documentation to contain, to the relevant extent, a general description of the product, the list of harmonized standards and technical specifications applied in whole or in part or a description of the solutions used, and references to the parts applied.

Section 14(1) and (2) require the manufacturer to draw up a written declaration of conformity confirming that the applicable requirements are met, following the model structure in Annex III to Decision No 768/2008/EC, and to update it continuously. Section 14(3) requires the declaration of conformity to state which accessibility requirement the exception for fundamental alteration or disproportionate burden has been applied to.

Section 14(4) requires the conformity marking to be affixed visibly, legibly and indelibly to each conforming product or its data plate, and, where that is not possible or practical, to the packaging and the accompanying documents. Section 15 presumes that a product or service which follows a harmonized standard, or a part of it, covering the accessibility requirements meets the requirements that the standard or part covers, and gives the same presumption for a technical specification.

Section 22(1) applies the requirements of the Act to products placed on the market and services provided from 28 June 2025. Section 59 of the Product Conformity Act sets the fine for infringing the conditions for placing a product on the market and making it available at up to 300 fine units for a natural person and up to EUR 32,000 for a legal person.

Section 61 of the Product Conformity Act sets the fine for misuse of the conformity marking at up to 200 fine units for a natural person and up to EUR 32,000 for a legal person. Section 47(1) of the Penal Code sets the fine unit at EUR 8. Section 19 of the LPS sets the ceiling of the penalty payment for a precept that is not complied with at EUR 10,000.

Section 1 provides that the Act sets the accessibility requirements for the products and services within its scope, the duties of businesses to secure accessibility, conformity assessment and the presumption of conformity, and state supervision and liability.

Section 2(3) applies the Act to the following services, or parts of them, provided to consumers: e-commerce services, electronic communications services including emergency communications but excluding machine-to-machine services, e-books and the dedicated software needed to use them, financial services, the website, mobile-device-based service, electronic ticket, electronic ticketing, transport information, real-time travel information, interactive information screen and self-service terminal parts of air, bus, rail and waterborne passenger transport services, and services that give access to an audiovisual media service.

Section 2(4) provides that a service for the purposes of the Act is a service within the meaning of Article 4(1) of Directive 2006/123/EC. Section 2(5) point 1 provides that an e-commerce service is a service provided at a distance through websites and mobile-device-based services by electronic means at a consumer's individual request in order to conclude a consumer contract.

Section 2(7) lists the financial services as payment services and the issue of e-money under the Payment Institutions and E-money Institutions Act, consumer credit and consumer credit related to residential immovable property, the basic payment services linked to a payment account under the Law of Obligations Act, and the investment services, activities and ancillary investment services listed in the Securities Market Act.

Section 2(8) applies the requirements for e-commerce services also to the e-commerce of the products and other services the Act covers.

Section 2(9) provides that the service accessibility requirements do not apply to online maps and mapping services if the essential navigation information is provided in accessible digital form, to the content of a website or mobile application of a third party that the business does not fund or develop and cannot influence, to self-service terminals integrated in a vehicle, to occasional transport within section 5 of the Public Transport Act, and to municipal, city and county lines, to which only the requirements for interactive self-service terminals apply.

Section 2(10) provides that the service accessibility requirements also do not apply to waterborne passenger transport on excursions and pleasure trips other than cruises, on original historic passenger ships designed before 1965 for up to 36 passengers and their replicas, on sailing ships, on ships for up to 12 passengers, on ships with a crew of up to three, and on any ship where the passenger journey is under 500 metres in one direction.

Section 2(11) provides that the requirements of the Act do not apply to the activity of a microenterprise service provider. Section 3(4) defines a microenterprise by its number of employees and by its annual turnover and annual balance sheet total. Section 3(2) defines a service provider as a natural or legal person who provides a service on the Union market or makes offers to provide a service to consumers in the Union.

Section 4(1) requires a service, when it is provided, to meet the accessibility requirements, subject to section 4(5) and section 5. Section 4(3) requires a service to be provided with functions, practices, policies, procedures and changes in how it operates that meet the needs of people with disabilities and give them maximum usability of the service.

Section 4(3) also requires the elements of a service to be interoperable with assistive technologies and the general terms of the service, or an equivalent document, to describe the accessibility requirements that apply to it and to give information on its design and operation. Section 11(1) requires a service provider to ensure that the service meets the applicable accessibility requirements.

Section 11(2) requires a service provider to prepare information explaining how the service meets the applicable requirements, to make it publicly available in written and oral form that is accessible, and to keep it for as long as the service is provided. Section 11(3) requires a service provider to take due account of changes in the conditions of providing the service, in the applicable requirements and in the harmonized standards or technical specifications by which conformity is determined.

Section 11(4) requires a service provider whose service does not meet the requirement to apply corrective measures and to notify TTJA without delay, with details of the non-conformity and the corrective measures. Section 11(5) requires a service provider to cooperate fully with TTJA on request when applying corrective measures. Section 22(1) applies the requirements of the Act to products placed on the market and services provided from 28 June 2025.

Section 22(2) lets a service contract concluded before 28 June 2025, whose terms do not take the applicable requirements into account, continue unchanged until it expires and at the latest until 28 June 2030. Section 22(3) lets a service provider keep using a self-service terminal that it used to provide the service before 28 June 2025 until the end of its economically useful life, and at the latest until 20 years after it was put into use.

Section 22(4) lets a service provider continue to provide a service until 28 June 2030 using a product it also used for that service before 28 June 2025. Section 22(5) provides that the service requirements do not apply to pre-recorded time-based media and office-software file formats published on a website or mobile application before 28 June 2025, or to content that is not updated or changed after that day.

Section 20 of the LPS sets the fine for providing a service that does not meet the accessibility requirements at 100 fine units at most for a natural person and EUR 20,000 at most for a legal person. Section 21 of the LPS makes TTJA the extra-judicial proceeding authority for the offences in the chapter on liability. Section 19 of the LPS sets the ceiling of the penalty payment for a precept that is not complied with at EUR 10,000. Section 47(1) of the Penal Code sets the fine unit at EUR 8.

Section 9 requires a distributor that learns that a product it placed on the market does not meet one or more applicable requirements to notify TTJA of the non-conformity, with details of it and of the corrective measures applied. Section 10 requires a manufacturer, authorized representative, importer or distributor, on TTJA's request, to identify every business that supplied it with the product and every business it supplied with the product, for five years after the supply.

Section 14(3) requires the declaration of conformity to state which accessibility requirement the exception for fundamental alteration or disproportionate burden has been applied to. Section 2(13) of the LPS applies the Product Conformity Act to the obligations of the manufacturer, authorized representative, importer and distributor of a product within the Act, to the conformity assessment of the product, to market surveillance and to liability, with the exceptions that follow from the LPS.

Section 2(3) of the Product Conformity Act applies the division of its chapter 2 on the further duties of businesses in the harmonized field, which holds the duties of manufacturers, authorized representatives, importers and distributors, and its chapter 3 on conformity assessment, only where the requirements set for a product derive from European Union harmonization legislation.

Section 5(2) of the Product Conformity Act bars placing on the market or putting into service a product that does not meet a requirement a legal act sets for it. Section 17(1) of the Product Conformity Act requires a distributor making a product available on the market to act with due care in relation to the applicable requirements.

Section 17(2) of that Act requires a distributor, before making a product available, to check that it bears the conformity marking, that it is accompanied by the required documents and by instructions and safety information, and that the manufacturer and the importer have met the identification and contact-address requirements of section 14(5) and (6).

Section 17(3) of that Act requires a distributor that believes a product does not meet the requirements applicable to it to make the product available only after it has been brought into conformity. Section 17(4) of that Act requires a distributor to ensure that storage or transport conditions do not jeopardize the product's conformity while it is under its responsibility.

Section 17(5) of that Act requires a distributor that believes a product it made available does not meet the requirements of European Union harmonization legislation to ensure that corrective measures are taken and, where necessary, that the product is withdrawn from the market or recalled from end users. Section 3(1) of the LPS defines a business for the purposes of the Act as a manufacturer, authorized representative, importer, distributor or service provider.

Section 59 of the Product Conformity Act sets the fine for infringing the conditions for placing a product on the market and making it available at up to 300 fine units for a natural person and up to EUR 32,000 for a legal person. Section 61 of the Product Conformity Act sets the fine for misuse of the conformity marking at up to 200 fine units for a natural person and up to EUR 32,000 for a legal person. Section 47(1) of the Penal Code sets the fine unit at EUR 8. Section 19 of the LPS sets the ceiling of the penalty payment for a precept that is not complied with at EUR 10,000.

Section 8(1) requires an importer to ensure that a copy of the declaration of conformity and the technical documentation are available to TTJA for the period set in section 6(2). Section 8(2) applies to an importer the requirements in section 6(3) to (5) on clear instructions, notification of non-conformity and records of non-conforming products and complaints.

Section 10 requires a manufacturer, authorized representative, importer or distributor, on TTJA's request, to identify every business that supplied it with the product and every business it supplied with the product, for five years after the supply. Section 14(3) requires the declaration of conformity to state which accessibility requirement the exception for fundamental alteration or disproportionate burden has been applied to.

Section 13(2) requires the technical documentation of a manufacturer that relies on fundamental alteration or disproportionate burden to allow it to show that one or more applicable requirements would cause that alteration or burden.

Section 2(13) of the LPS applies the Product Conformity Act to the obligations of the manufacturer, authorized representative, importer and distributor of a product within the Act, to the conformity assessment of the product, to market surveillance and to liability, with the exceptions that follow from the LPS.

Section 2(3) of the Product Conformity Act applies the division of its chapter 2 on the further duties of businesses in the harmonized field, which holds the duties of manufacturers, authorized representatives, importers and distributors, and its chapter 3 on conformity assessment, only where the requirements set for a product derive from European Union harmonization legislation.

Section 5(2) of the Product Conformity Act bars placing on the market or putting into service a product that does not meet a requirement a legal act sets for it. Section 16(1) of the Product Conformity Act requires an importer to place on the market only a product that meets the requirements.

Section 16(2) of that Act requires an importer, before placing a product on the market, to ensure that the manufacturer has carried out the conformity assessment and drawn up the technical documentation, that the product bears the conformity marking and is accompanied by the required documents, and that the manufacturer has met the identification and contact-address requirements of section 14(5) and (6).

Section 16(3) of that Act requires an importer to ensure that storage or transport conditions do not jeopardize the product's conformity while it is under its responsibility. Section 16(6) of that Act also applies to an importer the requirements of section 14(6) to (8) on marking its name and contact address, instructions and safety information, and corrective measures.

Section 3(1) of the LPS defines a business for the purposes of the Act as a manufacturer, authorized representative, importer, distributor or service provider. Section 59 of the Product Conformity Act sets the fine for infringing the conditions for placing a product on the market and making it available at up to 300 fine units for a natural person and up to EUR 32,000 for a legal person.

Section 61 of the Product Conformity Act sets the fine for misuse of the conformity marking at up to 200 fine units for a natural person and up to EUR 32,000 for a legal person. Section 47(1) of the Penal Code sets the fine unit at EUR 8. Section 19 of the LPS sets the ceiling of the penalty payment for a precept that is not complied with at EUR 10,000.

Section 4(5) applies the accessibility requirements to a product or service only to the extent that complying does not require a significant change that fundamentally alters its basic nature and does not impose a disproportionate burden on the business. Section 3(1) defines a business for the purposes of the Act as a manufacturer, authorized representative, importer, distributor or service provider.

Section 5(1) requires a business that suspects that bringing a product or service into line with one or more requirements may fundamentally alter it or impose a disproportionate burden to assess that burden. Section 5(2) requires a business, other than a microenterprise dealing with products, to document the assessment and keep the results for five years from the last time the product was made available on the market or the service was last provided.

Section 5(3) requires a service provider that relies on disproportionate burden to assess it again when the service is changed, when TTJA requests it and when five years have passed since the assessment. Section 5(4) provides that a business funded for the purpose of improving accessibility from resources other than its own is not entitled to rely on disproportionate burden.

Section 5(5) requires a business, other than a microenterprise dealing with products, that finds after the assessment that one or more requirements cannot be applied to it to notify TTJA and to give it the documented result of the assessment on request. Section 5(5) also requires a microenterprise dealing with products to give TTJA, on request, the facts relevant to the assessment.

Section 18(2) gives TTJA the right to check whether a business that relies on fundamental alteration or disproportionate burden has made the assessment, to review its results and the correct use of the assessment criteria, and to check conformity with the applicable requirements. Section 5(6) has the minister responsible set by regulation the criteria for assessing a business's disproportionate burden and the procedure for notifying that requirements are not applied. Section 19 of the LPS sets the ceiling of the penalty payment for a precept that is not complied with at EUR 10,000.

Section 16 makes TTJA the authority that supervises compliance with the requirements of the Act and of the legal acts made under it. Section 17 lets TTJA apply the special supervision measures of sections 30, 31, 32 and 49 to 52 of the Law Enforcement Act. Section 18(1) gives TTJA the right to require a business to apply without delay the measures needed to bring a product or service into line with all applicable requirements.

Section 18(1) also gives TTJA the right, where the business has not applied those measures, to prohibit or restrict making the product or service available on the domestic market and to require its immediate removal from the market. Section 19 sets the ceiling of the penalty payment for a precept that is not complied with at EUR 10,000.

Section 20 sets the fine for providing a service that does not meet the accessibility requirements at 100 fine units at most for a natural person and EUR 20,000 at most for a legal person. Section 21 makes TTJA the extra-judicial proceeding authority for the offences in the chapter on liability. Section 47(1) of the Penal Code sets the fine unit at EUR 8.

Section 50(5) of the Product Conformity Act makes TTJA the authority that supervises compliance with the requirements set for the products it lists. Section 50(5) point 12^3 of the Product Conformity Act lists among the products whose compliance TTJA supervises those for which supervision of compliance with accessibility requirements is placed within its competence by an Act or a legal act made under it.

Section 59 of the Product Conformity Act sets the fine for infringing the conditions for placing a product on the market and making it available at up to 300 fine units for a natural person and up to EUR 32,000 for a legal person. Section 61 of the Product Conformity Act sets the fine for misuse of the conformity marking at up to 200 fine units for a natural person and up to EUR 32,000 for a legal person.

Section 58(5) of the Product Conformity Act sets the ceiling of the penalty payment for a precept that is not complied with at EUR 10,000. Section 2(13) of the LPS applies the Product Conformity Act to the obligations of the manufacturer, authorized representative, importer and distributor of a product within the Act, to the conformity assessment of the product, to market surveillance and to liability, with the exceptions that follow from the LPS.

Section 5(2) of the Product Conformity Act bars placing on the market or putting into service a product that does not meet a requirement a legal act sets for it. Section 62 of the Product Conformity Act names TTJA, within its competence, among the extra-judicial proceeding authorities for the misdemeanors in that Act.

Regulation No. 4 of the Culture Minister is made under section 23(1^1) of the Media Services Act. Section 1(1) sets accessibility requirements for the audiovisual media services of Eesti Rahvusringhääling, for the on-demand audiovisual media services offered by electronic communications undertakings that provide audiovisual media services, and for the two most-watched programs of private television service providers.

Section 1(2) has TTJA name the two private programs for the next calendar year and publish them on its website by 1 December, on the basis of the programs' average viewing over ten months of the current calendar year. Section 1(3) applies the requirements, for the electronic communications undertakings and the two private programs, to Estonian-language programs whose first showing is after 1 January 2027.

Section 1(4) provides that the requirements do not apply to programs and program catalogues aimed at a specific narrower target group whose main content has features such as little or no verbal content, an exclusively musical or visual content or another specific thematic focus that makes applying the requirements unjustified. Section 2 requires news programs, current affairs programs and election programs to be subtitled for at least 70 percent of their weekly volume.

Section 3 requires Eesti Rahvusringhääling to provide sign-language interpretation for twelve listed national events and addresses, to broadcast at least one "Aktuaalne kaamera" news program a day with sign language, and to tell viewers accessibly in the program guide and the catch-up environment that sign language is available.

Section 4 requires Eesti Rahvusringhääling to provide audio description for the Estonian Republic anniversary concert-performance and the Estonian general dance festival and youth dance festival. Section 5 requires audio description, where a program has it, to be available together with the program on every platform that carries it, and viewers to be told accessibly in the program guide and the catch-up environment that it exists.

Section 6 requires every subtitled program of Eesti Rahvusringhääling to have audio subtitles. Section 7 requires a service aimed specifically at the hard of hearing and the visually impaired to ensure that the accessibility elements are delivered completely and in sufficient quality, with sound and video synchronized, and that the user can adjust display and use.

Section 8 provides that where Eesti Rahvusringhääling broadcasts an event and meets the accessibility requirements, another media service provider that carries the same event need not meet them. Section 9 requires subtitles, sign-language interpretation or audio description to be added when Estonian films and series made with Estonian state funding that have them are shown or transmitted, and, where possible, for other Estonian-language films and series.

Section 10 provides that the share of programs with selectable subtitles rises to 95 percent by 2030 in the programs covered, and that the share of programs, films and series with audio description in the programs of Eesti Rahvusringhääling rises by at least 3 percent by 2028 and at least 5 percent by 2030 compared with 2025. The Regulation was made on 26 February 2026, published on 27 February 2026 and took effect on 2 March 2026.

Section 54(1) of the Media Services Act makes TTJA the authority that supervises compliance with that Act and the legal acts made under it, apart from sections 15 and 19^2. Section 56 of the Media Services Act sets the ceiling of the penalty payment for a precept that is not complied with at EUR 15,000 and, where a precept is repeatedly not complied with, at EUR 30,000.

Section 23(1) requires an audiovisual media service provider to make its service progressively accessible to people with disabilities by proportionate measures, using subtitles, sign-language interpretation, audio description, separate audio channels, teletext and other additional services.

Section 23(1^1) has the minister responsible set by regulation more detailed accessibility requirements for audiovisual media services and the deadlines for meeting them, including the minimum volume of Estonian-language programs with subtitles, sign-language interpretation, audio description and audio subtitles in a program or program catalog and requirements on selectable subtitles and audio subtitles.

Section 23(2) requires an audiovisual media service provider to draw up an accessibility action plan describing the activities planned for the current calendar year and the following three years to improve access to its service for people with disabilities, and to plan the resources for them. Section 23(3) requires the provider to submit the plan, and data on its implementation in the previous calendar year, to TTJA each year by 15 February.

Section 23(4) makes TTJA the single online contact point for information and complaints on these accessibility questions within the meaning of Article 7(4) of Directive 2010/13/EU. Section 23(5) provides that the duties in section 23(2) and (3) do not apply to the holder of a temporary television license. Section 39(6) point 1^1 requires an application for a television license to be accompanied by the accessibility action plan referred to in section 23(2).

Section 39(6^1) provides that this does not apply to an applicant for a temporary television license. Section 47(2^1) requires an on-demand audiovisual media service provider to attach the accessibility action plan referred to in section 23(2) to its notice of economic activity. Section 18(2) requires a television service provider to transmit emergency alerts in a way that is accessible to people with disabilities.

Section 2(4) applies the Media Services Act to Eesti Rahvusringhääling, the public broadcaster, as far as the Eesti Rahvusringhäälingu seadus does not provide otherwise. Section 65^2 required each audiovisual media service provider to submit data on meeting section 23(1) to TTJA by 15 February 2023, and applies the annual plan reporting duty in section 23(3) from 2024.

Section 54(1) makes TTJA the authority that supervises compliance with the Media Services Act and the legal acts made under it, apart from sections 15 and 19^2. Section 56 sets the ceiling of the penalty payment for a precept that is not complied with at EUR 15,000 and, where a precept is repeatedly not complied with, at EUR 30,000.

Section 56^1 requires TTJA to resolve a complaint about a breach of the Act within 30 days of receiving it, and lets it extend that period by up to 60 days where it needs to clarify the facts. Section 57 sets the fine for breaching the rules on the protection of minors in sections 19 and 19^1 at up to 300 fine units for a natural person and up to EUR 32,000 for a legal person.

Section 58 sets the fine for breaching the rules on commercial communications in section 26(2) and sections 28 to 31^1 at up to 300 fine units for a natural person and up to EUR 32,000 for a legal person. Section 25 of the Accessibility of Products and Services Act provides that point 45 of section 1 of the Act amending the Media Services Act takes effect on 28 June 2025.

The consolidated text notes that section 23(1^1) takes effect on 28 June 2025 and that its entry into force was changed by the Act published as RT I, 15.06.2022, 1. Section 47(1) of the Penal Code sets the fine unit at EUR 8.

Regulation No. 45 of the Social Affairs Minister is made under section 4(4) of the LPS. Section 1 applies the Regulation to the products and services within the LPS and to the information given about them, and to a service also when it is provided through a website or mobile application.

Section 6 requires information on how a product works and on its accessibility elements to be given in or on the product where possible, and requires the instructions for use to cover the accessibility functions and how to activate them.

Section 6(4) requires information on the use of the product, including labeling, instructions and warnings, to be perceivable through more than one sense, presented in an understandable and perceivable way, and set in contrasting type that takes expected user needs into account.

Section 6(5) requires instructions for using, installing, maintaining, storing and disposing of a product that are found on a website or otherwise to be available in a text format that can be used to create alternative assistive formats, and to present non-text content in an alternative way.

Section 6(6) requires the instructions on the product's accessibility functions, labeling, use and warnings to describe its user interface and functionality against the requirements of section 7 and to describe the software and hardware that interface with assistive devices, with a list of the assistive devices tested with the product.

Section 7 requires a product and its user interface to contain features, elements and functions that let a person with a disability perceive, use, understand and control the product.

Section 7(2) requires a product to have operating modes usable with limited reach and strength, not to trigger photosensitive seizures, to offer an alternative to biometric identification, to be functionally consistent and allow enough flexible time for interaction, to allow connection to assistive technologies, and to protect user privacy when accessibility elements are used.

Section 10 requires the service provider to ensure the accessibility of the product used to provide the service, and requires a website and a mobile-device-based service to be made accessible in a consistent and appropriate manner by making it perceivable, usable, understandable and robust.

Section 11 requires a self-service terminal to include speech synthesis technology, to allow the use of personal headphones, to warn the user through more than one sense when response time is limited, to allow the time allowed for use to be extended, to have sufficient contrast and tactilely distinguishable keys and controls where they exist, to be compatible with assistive technologies when it uses audio signals, and to allow a user with a disability access without activating an accessibility element.

Section 12 requires an e-reader to have a function for audio presentation of text. Section 13 requires consumer terminal equipment used for electronic communications services to allow real-time text and to support high-level audio devices where it can send text, to allow total conversation where it can also send video, to be compatible with hearing technologies over a wireless connection, and not to disturb the operation of assistive technology.

Section 14 requires terminal equipment used to access audiovisual media services to make available to a user with a disability the accessibility elements that the service provider transmits, for access, selection, control, personalization and transfer to assistive devices.

Section 16 requires an electronic communications service to allow real-time text in addition to voice and text, to allow synchronized total conversation where video is used, and to ensure an emergency connection that allows an emergency message to be answered in the same format in which it was received.

Section 17 requires a service giving access to audiovisual media services to offer perceivable, usable, understandable and robust electronic program guides, to deliver the accessibility elements of the media service completely and in sufficient quality with synchronized sound and video, and to let the user adjust display and use.

Section 17(3) lists the accessibility elements of an audiovisual media service as subtitles for the deaf and hard of hearing, audio description, spoken subtitles and sign-language interpretation.

Section 18 requires a long-distance air, bus, rail and waterborne passenger transport service to meet the information requirements of section 9 and the service requirements of section 10, and requires information to be given on the accessibility of the vehicle, the surrounding infrastructure and the built environment and on assistance for users with disabilities, on the smart ticketing system, on real-time travel information and on the availability of additional services.

Section 20(1) requires the authentication methods, electronic signatures, payment instructions, execution of payment transactions and security measures used to provide a financial service, including blocking a payment instrument, to be perceivable, usable, understandable and robust.

Section 20(2) requires information given in providing a financial service to be understandable and its complexity not to exceed level B2 of the Council of Europe's Common European Framework of Reference for Languages.

Section 21 requires the text and sound of an e-book that contains both to be presented synchronously, the digital file to let assistive technology work properly, and a user with a disability to be able to access, navigate and perceive the structure of the e-book content and to use it flexibly.

Section 22 requires the information given in an e-commerce service to include information on the accessibility of the product or service sold when the responsible business has first made it available to the seller, and requires the authentication, electronic signature and payment methods and the security functions to be perceivable, usable, understandable and robust.

Section 24(2) provides that the functional performance criteria are used as an alternative to a technical requirement, and only where they lead to equivalent or better access for a user with a disability. Section 30 applies the Regulation to products placed on the market and services provided from 28 June 2025, taking account of the exceptions in section 22 of the LPS. Section 19 of the LPS sets the ceiling of the penalty payment for a precept that is not complied with at EUR 10,000.

Section 20 of the LPS sets the fine for providing a service that does not meet the accessibility requirements at 100 fine units at most for a natural person and EUR 20,000 at most for a legal person.

Section 2(13) of the LPS applies the Product Conformity Act to the obligations of the manufacturer, authorized representative, importer and distributor of a product within the Act, to the conformity assessment of the product, to market surveillance and to liability, with the exceptions that follow from the LPS.

Section 59 of the Product Conformity Act sets the fine for infringing the conditions for placing a product on the market and making it available at up to 300 fine units for a natural person and up to EUR 32,000 for a legal person. Section 61 of the Product Conformity Act sets the fine for misuse of the conformity marking at up to 200 fine units for a natural person and up to EUR 32,000 for a legal person. Section 47(1) of the Penal Code sets the fine unit at EUR 8.

Regulation No. 46 of the Social Affairs Minister is made under section 5(6) of the LPS. Section 2 defines total cost as the sum of the business's operating and capital costs of producing, distributing or importing the product or providing the service.

Section 3 requires a business assessing a disproportionate burden to assess the ratio of the net cost of complying to its total cost of producing, distributing or importing the product or providing the service, the ratio of its estimated costs and revenues to the expected benefit for people with disabilities, and the ratio of the net cost of complying to its net turnover.

Section 4 sets out the one-off organizational costs and the current production and development costs that make up the net cost of complying. Section 5 requires the business to compare its estimated cost and revenue, including on production processes and investments, with the expected benefit for people with disabilities, taking account of how many times and how often the product or service is used.

Section 6 requires the business to assess the ratio of the net cost of complying with the accessibility requirements that apply to the specific product or service to the net turnover of the product or service it offers.

Section 7 sets out the data that a business gives TTJA when it notifies that requirements are not applied: its name and e-mail address and, for a product business, its role; the name, classification and target group of the product or service; the requirements that are not applied and the reason; and a confirmation that it has not been funded for improving accessibility from resources other than its own.

Section 8 applies the Regulation to products placed on the market and services provided from 28 June 2025. Section 19 of the LPS sets the ceiling of the penalty payment for a precept that is not complied with at EUR 10,000.

Section 88(8) requires the technical specification of a procurement whose users are natural persons to take into account the possible needs of people with disabilities or to be drawn up so that everyone can use the object of the contract, except in duly justified cases. Section 88(8) also requires the contracting authority, where mandatory accessibility requirements are set by a European Union act, to add a reference to that act to the technical specification.

Section 85(8) point 1 lists quality, including accessibility, together with technical value, aesthetic, functional, environmental, social and innovative characteristics and the conditions of marketing. Section 88(8) as first enacted in 2017 required the possible needs of people with disabilities to be taken into account in the technical specification where technically possible and appropriate.

Section 14(1) point 1 sets the simple-procurement threshold for a goods or services contract at EUR 50,000. Section 15(1) has a public-sector contracting authority apply the rules of chapter 3, division 1 of the Act to a contract whose estimated value equals or exceeds the simple-procurement threshold but is below the international threshold.

Section 15(2) has a public-sector contracting authority apply the procedure in chapter 2 of the Act, where sections 85 and 88 sit, to a contract whose estimated value equals or exceeds the international threshold. Section 14(3) makes the international threshold the amount the European Commission periodically sets under the public procurement directives and publishes in the Official Journal of the European Union.

Section 125(5) has a contracting authority conducting a simple procurement apply section 85, among other sections, unless the procurement documents provide otherwise. Section 15(9) has a network-sector contracting entity apply the procedure in chapter 5 of the Act to a contract whose estimated value equals or exceeds the international threshold where the contract's main purpose relates to its network-sector activity or cannot be determined.

Section 145 applies chapter 2 to a procurement in the network sector unless chapter 5 provides otherwise. Article 24(1) of Directive (EU) 2019/882 makes the Annex I requirements mandatory accessibility requirements within the meaning of Article 42(1) of Directive 2014/24/EU and Article 60(1) of Directive 2014/25/EU.

Section 1(3) of Regulation No. 45 applies its requirements to a public procurement whose object falls within the scope of the Accessibility of Products and Services Act and whose intended user is a natural person. Section 1(3) requires the requirements to be taken into account in drawing up the technical specification of the procurement documents.

Section 15(1) requires the availability of information on how a product that is the object of a procurement works and on its accessibility elements to meet the requirements of section 6(4) and (6) of the Regulation. Section 15(2) requires the accessibility of the user interface features, elements and functions and the design of the product's functionality to meet the requirements of section 7.

Section 23 requires the accessibility of the properties, elements and functions of a service that is the object of a procurement to meet the relevant requirements in the service-related sections of the Regulation. Article 24(1) of Directive (EU) 2019/882 makes the Annex I requirements mandatory accessibility requirements within the meaning of Article 42(1) of Directive 2014/24/EU and Article 60(1) of Directive 2014/25/EU.

A video-sharing platform operator must provide in its terms of service that the platform may not carry a programme, user-generated video or commercial communication that incites hatred, violence or discrimination on a protected ground endangering life, health or property, incites an offense, or depicts child pornography. Content that may impair a minor's physical, mental or moral development must carry a clear warning and an on-screen symbol throughout.

The operator must provide an easy way for users to flag such content, must remove or block access to prohibited content once aware of it, and for harmful-but-not-prohibited content must either add the warning and symbol or ensure the content is accessible only through personal identification codes or another appropriate technical solution that makes it inaccessible to a minor in the ordinary case. A user may complain to the Tarbijakaitse ja Tehnilise Järelevalve Amet (TTJA) about how these duties are applied.

A press publication's publisher holds the exclusive right to permit or prohibit an information society service provider's direct or indirect, temporary or permanent, partial or complete online reproduction of the press publication, and its making available to the public in a manner that lets people access it at a place and time individually chosen by them, per Section 73-2(1).

The right does not reach private, non-commercial use by an individual user, hyperlinking, or the use of single words or very short extracts from a press publication, per Section 73-2(3). The publisher's rights subsist for two years from the publication's publication date, per Section 74(1-1). Authors of works within the press publication are entitled to an appropriate share of the revenue the publisher receives from information society service providers for its use, per Section 73-2(5).

Without the author's consent and without paying remuneration, a research organization or cultural-heritage institution may reproduce, for scientific-research text-and-data-mining purposes, a work to which it has lawful access, per Section 19-1(1). A contractual term restricting this free use is void, per Section 19-1(4).

Separately, without prejudice to Section 19-1, reproduction of a lawfully accessible work for text-and-data-mining purposes is permitted without the author's consent or payment, but the author may expressly exclude this general free use in an appropriate manner, including by machine-readable means for content made publicly available online, per Section 19-2(1) and (2). Copies made under either section may be retained only as long as necessary for the text-and-data-mining purpose.