Estonia: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114) directly applicable, supplemented by Estonia's national Market in Crypto-Assets Act (Krüptovaraturu seadus / MCAA) in force since 1 July 2024; competent authority is Finantsinspektsioon (Financial Supervision and Resolution Authority, FSA). Tax under the Income Tax Act administered by the Estonian Tax and Customs Board (EMTA); AML under the Money Laundering and Terrorist Financing Prevention Act (MLTFPA) with the Financial Intelligence Unit (FIU) supervising legacy VASPs during transition.

Crypto-asset activities are legal and comprehensively regulated in Estonia under directly applicable MiCA (CASPs since 30 December 2024; ART/EMT issuers since 30 June 2024), supplemented by the national Crypto Markets Act, with Finantsinspektsioon as the sole licensing and supervisory authority. Legacy FIU-issued virtual currency service provider (VASP) licences remain valid only during a transition period that ends 1 July 2026, after which a MiCA CASP authorisation from the FSA is required. Crypto income is taxed as gains from the transfer of property at the standard 22% personal income tax rate, with DAC8/CARF reporting obligations for service providers beginning 1 January 2026.

Framework: EU AI Act (Regulation (EU) 2024/1689), directly applicable; national implementation led by Ministry of Economic Affairs and Communications (MKM); market surveillance authority: Consumer Protection and Technical Regulatory Authority (TTJA)

Estonia is subject to the EU AI Act (Regulation (EU) 2024/1689), which applies directly as comprehensive, risk-based AI legislation across all EU member states, with prohibited practices enforceable from February 2025 and most high-risk system obligations from August 2026. Nationally, Estonia pursues proactive AI adoption through its Data and AI White Paper 2024-2030 and the accompanying 'Kratt' AI and Data Action Plan 2024-2026 (€85 million), coordinated by the Ministry of Economic Affairs and Communications. The Consumer Protection and Technical Regulatory Authority (TTJA) has been designated as the national market surveillance and competent authority under the EU AI Act.

Framework: GDPR (EU 2016/679) directly applicable since 25 May 2018; supplemented by Estonia's Personal Data Protection Act (Isikuandmete kaitse seadus, in force 15 January 2019) and the Personal Data Protection Act Implementation Act (PDPAIA). National supervisory authority: Andmekaitse Inspektsioon (AKI) / Data Protection Inspectorate.

Estonia's data-protection regime is anchored in the directly applicable GDPR, supplemented by the national Personal Data Protection Act (PDPA) adopted 12 December 2018 and in force from 15 January 2019, which implements the Law Enforcement Directive (EU 2016/680) and introduces permitted national derogations. The Andmekaitse Inspektsioon (AKI) serves as the independent supervisory authority under GDPR Article 51, holding a dual mandate over data protection and freedom of information. Enforcement was historically constrained by Estonia's misdemeanor procedural law, though AKI issued its largest-ever fine of €3 million in September 2025 against the Apotheka pharmacy loyalty-programme operator.

Framework: Payment Institutions and E-money Institutions Act (MERAS / Makseasutuste ja e-raha asutuste seadus); EU PSD2 Directive (2015/2366); EU Instant Payments Regulation (2024/886); supervised by Finantsinspektsioon (Estonian Financial Supervision and Resolution Authority)

Estonia operates a fully articulated licensing regime for payment institutions (PIs) and e-money institutions (EMIs) under the MERAS statute, transposing PSD2 into national law, with Finantsinspektsioon as the sole competent authority. Open banking is live under PSD2 APIs from major banks, and Estonia participates in SEPA Instant Credit Transfer (SCT Inst) with the EU Instant Payments Regulation mandating full compliance by October 2025. No standalone BNPL-specific law yet exists; BNPL falls under the general consumer credit and payment services framework.

Framework: Aliens Act (Välismaalaste seadus), amended August 2020 to introduce the teleworking-purpose visa, administered by the Police and Border Guard Board (Politsei- ja Piirivalveamet) and the Ministry of Foreign Affairs (Välisministeerium)

Estonia was one of the world's first countries to introduce a dedicated Digital Nomad Visa (operational from 1 August 2020), enabling non-EU remote workers to reside legally in Estonia for up to 12 months while working exclusively for foreign employers or clients. Alongside the visa, Estonia operates a separate e-Residency digital identity programme (no physical residence rights) and temporary residence permits for business/self-employment for those seeking longer stays.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065) directly applicable; national transposition via Information Society Services Act (as amended, in force 14 July 2024); Digital Services Coordinator: Consumer Protection and Technical Regulatory Authority (TTJA)

Estonia operates under the directly applicable EU Digital Services Act, supplemented by national amendments to the Information Society Services Act that entered into force on 14 July 2024. The Consumer Protection and Technical Regulatory Authority (TTJA) was formally designated as Estonia's Digital Services Coordinator in July 2024, overseeing DSA compliance and user-complaint handling. Estonia consistently ranks among the world's most internet-free countries (91/100, Freedom House 2025, 2nd globally), with virtually no government-imposed content restrictions beyond EU-mandated blocks on Russian state-affiliated media.

Framework: Cybersecurity Act (Küberturvalisuse seadus, 2018, amended January 2026 for NIS2 transposition); supervised by the Information System Authority (RIA) / CERT-EE as national competent authority

Estonia operates under a dedicated Cybersecurity Act originally enacted in 2018, which was substantively amended effective 1 January 2026 to transpose the EU NIS2 Directive (EU 2022/2555), expanding scope from approximately 3,500 to 5,500-7,000 regulated entities across critical sectors. The Information System Authority (RIA), operating the national CERT (CERT-EE), serves as the primary regulator and incident coordinator. Estonia's approach is underpinned by its 2024-2030 National Cybersecurity Strategy 'Cyber-Conscious Estonia', one of the EU's most mature digital governance frameworks.

Framework: Estonian Commercial Code (Äriseadustik, RT I 1995, 26, 355, consolidated 2023); e-Business Register operated by RIK (Centre of Registers and Information Systems); e-Residency programme (Police and Border Guard Board)

Estonia offers one of the world's most streamlined business-formation environments: a private limited company (OÜ) can be incorporated fully online in 1-3 business days with a €0.01 minimum share capital and no foreign-ownership restrictions. The e-Residency digital identity programme allows non-residents to sign all formation documents remotely without visiting Estonia. FDI screening under the Foreign Investment Reliability Assessment Act (FIRAA) applies only to investments in designated strategic sectors.