RegRally Insights: Legal and Investment Update in Estonia, October 2026

Investing or doing business in Estonia? The country continues to offer international investors what they value most: a stable flat tax regime, a disciplined budget and steady political leadership, now under newly elected President Ülle Madise. Estonian private limited companies (OÜs) can be set up and run online, making Estonia a practical option for international businesses and holding structures. A pending Commercial Code reform would give owners more flexibility. For defense technology suppliers, the 2027 draft budget earmarks EUR 632m for defense capabilities.

At a glance

• Stable taxes, targeted support. The draft 2027 budget keeps corporate and personal income tax at 22%, lowers the overall tax burden to 35.2% of gross domestic product (GDP) and earmarks more than EUR 270m for business growth, research and development (R&D) and exports.
• More flexible company law is on its way. A Commercial Code reform now before Parliament would simplify share transfers and corporate meetings and introduce a new private foundation for holding assets.
• Lower red tape for employers. Parliament cut occupational health and safety paperwork, and unemployment insurance rates are frozen until 2030.
• Four compliance requirements began to apply. Online withdrawal button (September 1), stricter green-claims rules (September 27), Data Act design duty (September 12) and Cyber Resilience Act reporting (September 11).

2027 budget: stable taxes and targeted support

Status: Draft | Date: approved by the Government on September 28, 2026; submitted to Parliament on September 29, 2026 (bill 1037 SE) | Source: Government of Estonia
Link

Under the Government’s draft 2027 budget, retained company profits remain tax-free (credit institutions pay an 18% advance income tax), while distributed profits and personal income would still be taxed at 22%. The tax burden would fall to 35.2% of GDP, from 35.5% in 2026. The deficit would fall to 4% of GDP despite defense spending above 5% of GDP.

Planned 2027 spending relevant to businesses:

• Research and innovation – EUR 135m. Support for company R&D, applied research, innovation cooperation and the adoption of new technologies, including artificial intelligence (AI). Relevant for companies developing products or technology in Estonia.
• Exports, investment, industry and tourism – nearly EUR 116m. Includes export promotion and continued state support for large investment projects. Relevant for exporters and investors planning large production or industrial projects.
• State equity investments – EUR 25m + EUR 12.6m. EUR 25m a year in 2027–2030 for investments in strategically important companies, and EUR 12.6m for the state-backed SmartCap venture capital fund. Relevant for growth companies raising capital.
• Defense – EUR 2.2bn (over 5% of GDP). Includes EUR 632m for defense capabilities (such as air and missile defense, long-range strike and ammunition), of which EUR 100m is for drones. Relevant for defense and dual-use suppliers.
• Energy – EUR 12m + EUR 2.5m. EUR 12m over two years to encourage municipalities to host onshore wind farms, and EUR 2.5m to prepare for nuclear energy. Relevant for wind and nuclear energy developers.
• Digital – EUR 21m + over EUR 30m. EUR 21m for cybersecurity and over EUR 30m for AI adoption, including testing environments and computing capacity. Relevant for cybersecurity and AI providers.
• Rail Baltica – EUR 445m. The main line is now targeted for completion in the EU’s 2028–2034 budget period, together with Latvia and Lithuania. Relevant for construction and engineering contractors.

Two things to keep in mind. First, the budget is a draft until Parliament adopts it, and a budget line is not a grant: each support measure has its own eligibility rules, timetable and caps. Second, the slower Rail Baltica timetable may affect logistics, real estate and development projects that assumed earlier completion of the main line.

On September 29, the Research and Development Council approved the principles for selecting Estonia’s priority growth sectors. It highlighted AI and computing capacity as technologies relevant across sectors. The specific sectors are due to be identified in spring 2027, giving an early indication of where future support is likely to concentrate.

Our view

The 2027 draft budget creates opportunities to take part in state-funded projects and invest in Estonia, especially in R&D, AI, cybersecurity and defense technology. Each support measure has its own conditions, so check them before starting a project.

Additional sources: ERR News · Ministry of Economic Affairs: EUR 270m for business growth · Research and Development Council: priority sectors

---

Commercial Code reform: simpler share deals and a new private foundation

Status: Bill | Date: approved by the Government on September 3, 2026; bill 1008 SE initiated on September 14, 2026; amendment deadline October 15, 2026 | Source: Riigikogu
Link

The most significant company-law reform in years has passed its first reading. Its aim is to give owners more contractual freedom and reduce administrative burden, changes that will directly affect how investors acquire, hold and govern Estonian companies.

The main proposed changes:

• Share transfers in a private limited company (OÜ). Shareholders will be able to agree themselves when ownership passes, instead of it depending on the commercial register entry. This makes it easier to bring in new investors.
• Shareholder list. The company’s management board will keep the list of shareholders, and the register entry will only reflect it (planned from February 1, 2028). To check who owns a company, you will need to look at the company’s own records, not only the public register.
• Simpler corporate rules on quorum, capital contributions, supervisory board meetings and notice of general meetings, making decisions faster.
• Broader shareholder information rights, including about subsidiaries, which strengthens the position of minority shareholders.
• New private foundation for holding and managing assets; founders may give up their founder rights. A new option for holding family wealth and passing it on to the next generation.
• More automation in the commercial register, including company-name checks, making company formation quicker.

Some changes are planned to take effect on April 1, 2027, and the shareholder-list rules on February 1, 2028. Most other changes would take effect under the general procedure. The text may still change in Parliament.

Our view

If you are looking for a way to hold family assets or pass them on to the next generation, the new private foundation may become an option once the law is adopted. The reform would also make Estonian companies easier to run: simpler corporate formalities, more flexible share transfers and more automation in the commercial register would make company formation even quicker.

Additional sources: Government agenda, September 3, 2026

---

Lighter employer obligations and stable payroll costs

Status: Adopted (occupational health and safety amendments); decided (unemployment insurance rates) | Date: Occupational Health and Safety Act amendments adopted on September 30, 2026; unemployment insurance rates decided on September 17, 2026 | Source: Government of Estonia
Link

Parliament adopted an occupational health and safety reform that the Government estimates will save businesses up to EUR 22.6m a year, mostly benefiting micro and small companies:

• Companies with fewer than 10 employees no longer need to file a risk assessment in the Labour Inspectorate portal or commission a full health-situation analysis every three years.
• Single-person companies are largely exempt, and no separate safety instruction is needed for every task or where the manufacturer’s manual already covers safety.
• Health checks for new employees may be completed within six months instead of four; employers get a clearer basis for intoxication testing.

The Labour Inspectorate will also use register and contracting-chain data to detect undeclared work. Separately, unemployment insurance rates stay at 0.8% (employer) and 1.6% (employee) for 2027–2030.

Additional sources: Riigikogu, September 30, 2026 · Government agenda, September 17, 2026

---

Online withdrawal must work as a complete process

Status: In force | Date: September 1, 2026 (Law of Obligations Act and Consumer Protection Act amendments) | Source: Consumer Protection and Technical Regulatory Authority (TTJA)
Link

Online traders must offer a clearly visible electronic withdrawal function for consumer contracts concluded online. The 14-day withdrawal right itself is not new and its statutory exceptions still apply. What changes is how easily consumers can exercise it.

The consumer must be able to:

• 1. Find a clearly labeled button, e.g., “Taganen lepingust” (“I withdraw from the contract”), available throughout the withdrawal period.
• 2. Fill in their name, the order or contract and an email address for confirmation.
• 3. Confirm through a separate button, e.g., “Kinnitan taganemise” (“I confirm the withdrawal”).
• 4. Receive confirmation immediately by email or another durable medium, showing what was submitted and when.

Each withdrawal request must be linked to the correct order and passed to customer service and the refund process. Refunds remain due within 14 days of the withdrawal notice. The same amending act also implements EU rules on distance financial services contracts, including limits on manipulative interface design and the consumer’s right to request contact with a person rather than only a chatbot.

Our view

The withdrawal button already applies in Estonia (from September 1, 2026) and Lithuania (from June 19, 2026), while Latvia is still preparing its rules. Because the requirement comes from an EU directive, businesses selling online across the Baltics can use one withdrawal process for all three markets. Test the full customer journey on mobile and desktop, including guest checkout. Agree with your platform provider who fixes failures and keeps the records. When acquiring an e-commerce business, check how the withdrawal process works in practice as well as reviewing the terms of sale. Specify in the transaction documents who will pay to correct any failures.

Additional sources: TTJA guidance for online traders · Riigikogu: bill 796 SE

---

Green claims: say less, prove more

Status: In force | Date: September 27, 2026 (Consumer Protection Act amendments implementing Directive (EU) 2024/825) | Source: Consumer Protection and Technical Regulatory Authority (TTJA)
Link

Generic claims such as “green” or “eco-friendly” are now permitted only with recognized excellent environmental performance relevant to the claim. A benefit that concerns one part of a product cannot be presented as a feature of the whole product or business.

• Sustainability labels must be based on a qualifying certification scheme or set by a public authority.
• “Climate-neutral” style claims based on emissions offsetting are prohibited. Buying carbon credits does not make such product claims lawful.
• Durability, repairability and software-update statements must not mislead.

Retailers and online sellers are covered too, including product texts supplied by others, with no general grace period for materials already in circulation.

Our view

Review the environmental claims on your packaging, website and advertising against the requirements above. Remove claims that do not meet those requirements. Do not use “climate-neutral” product claims based on emissions offsetting. Use specific statements backed by evidence and keep that evidence on file. If you sell other brands’ products, check the environmental claims in the product descriptions you receive, as you are responsible for them too.

Additional sources: Directive (EU) 2024/825

---

Data Act: users of new connected devices must be able to access their data

Status: In force | Date: products placed on the market after September 12, 2026 (Regulation (EU) 2023/2854, Articles 3 and 50) | Source: EUR-Lex
Link

Connected devices and their related services placed on the market after September 12, 2026 must be designed to give users access to the data they generate, including relevant metadata. Access must be easy, secure, free of charge and in a reusable format, with direct access where technically possible. Examples of connected devices include industrial machines, vehicles and smart home appliances. The Data Act’s other access and sharing rights have applied since September 2025. The design obligation is an additional requirement.

In practice, a company using, for example, an industrial machine can get the data the machine generates and use it itself or share it with another service provider, instead of depending on the manufacturer. Personal data and trade secrets remain protected, the data cannot be used to develop a competing product, and smaller companies may be exempt.

Our view

If you make connected devices, check that new models give users access to their data from the start and that your business model does not depend on keeping that data to yourself. If you buy such equipment, ask the supplier before signing how you will get the data and in what format.

Additional sources: Commission explainer

---

Cyber Resilience Act: 24-hour reporting for digital products

Status: In force | Date: September 11, 2026 (Regulation (EU) 2024/2847, Article 14) | Source: European Commission
Link

The Cyber Resilience Act (CRA) is an EU regulation on the cybersecurity of products with software or an internet connection, from smart devices to standalone software. Their manufacturers must now report actively exploited vulnerabilities and severe incidents affecting product security. The duty also covers products already on the market, but only cases meeting the legal criteria, not every suspected flaw.

Report	Deadline
Early warning	Within 24 hours of becoming aware
Detailed notification	Within 72 hours of becoming aware
Final report: vulnerability	Within 14 days after a corrective or mitigating measure is available
Final report: incident	Within one month after the 72-hour notification

Reports are filed through the Single Reporting Platform of the EU Agency for Cybersecurity (ENISA). The CRA’s main product requirements apply only from December 11, 2027, so September marks the start of reporting, not of every CRA obligation.

Our view

If you make software or connected devices sold in the EU, decide in advance who determines whether an incident must be reported. Make sure someone can make that decision outside working hours. Test whether your team can meet the 24-hour deadline. Ask your suppliers to inform you promptly about security issues in the components they provide.

Additional sources: Regulation (EU) 2024/2847

---

What we recommend

• If you are looking for an EU base for your business, consider an Estonian private limited company (OÜ): it can be set up and managed online, and profits are taxed only when distributed, at 22%.
• If you invest in R&D, AI, cybersecurity, defense technology or tourism, note that the 2027 draft budget plans additional state support in these areas, and check which measures apply before you start the project.
• If you plan to hold family assets or pass a business on to the next generation, consider the new Estonian private foundation once the Commercial Code reform is adopted.
• If you sell online to consumers, make sure customers can withdraw from a purchase with the online withdrawal button and that each request reaches your refund process.
• If you make software or connected devices, check which CRA reporting duties and Data Act design requirements apply to your products. Test whether your team can submit a required CRA early warning within 24 hours.
• If you market consumer products, remove environmental claims you cannot prove.
• If you employ staff in Estonia, update your occupational health and safety documents once the simplified rules take effect.

---

Key dates ahead

• November 20: EU application date of the new Consumer Credit Directive, including “buy now, pay later”; the Estonian bill (947 SE) is still in Parliament.
• November–December: parliamentary readings of the 2027 budget.
• December 11, 2027: full application of the Cyber Resilience Act; use the coming year to close product-security gaps.

---

How ProventusLaw can help

ProventusLaw helps international businesses set up in Estonia, comply with new rules and complete deals. We advise on setting up companies, holding and investment structures, and buying and selling businesses. We also advise on state support and its conditions, foreign investment screening, commercial contracts, construction, tax, remote gambling licensing and technology regulation. ProventusLaw operates across Lithuania, Latvia and Estonia and is part of the ECOVIS International network present in more than 90 countries, so clients working in several countries have one point of contact.

Want to know what these changes mean for your business? Get in touch with our team.