What sources does Taxxa search?

Taxxa searches a continuously updated collection of more than one million pages from tax authorities, government publications, legislation and case law across the European jurisdictions it covers. Every response cites the underlying material, so a professional can inspect the rule, its jurisdiction and whether it is current before relying on the result.

Can Taxxa work with a team’s own documents?

Yes. Research can combine the public knowledge base with a team’s own PDF, DOCX, CSV and TXT files in one workspace. That makes it possible to compare a client document with the relevant guidance, trace a conclusion to its source and prepare a draft without losing the evidence that supports it.

Who is Taxxa built for?

Accountants, auditors, tax advisors, payroll specialists, bookkeepers and advisory teams working across European jurisdictions. Shared workspaces keep research available to colleagues, and citations make review easier.

Where is customer data stored, and is it used to train models?

Customer data stays in the European Union and is never used to train language models.

Does Taxxa replace professional judgement?

No. Taxxa is a research and drafting workspace. It helps professionals reach an informed starting point faster; the professional still reviews the evidence and makes the final decision. It does not file returns, post bookkeeping entries or give legal advice.

EstoniaRiigi Teataja

Estonia adds near-miss incidents, 3-year audits to cyber law

Estonia adds a near-miss cyber incident category across notification, register and cooperation duties and gives RIA need-based plus three-yearly audits of critical entities.

By Taxxa AI OyPublished 16 October 2026

IT, Cybersecurity & Data

Estonia's Cybersecurity Act has a new vocabulary for incidents that almost happened, and new audit powers over the entities that can least afford an outage.

The consolidated act published at https://www.riigiteataja.ee/akt/106102026002 redefines "küberintsident" (cyber incident)Riigiteataja. Where the old definition covered any event in a network and information system that threatens or harms its securityRiigiteataja, the new one covers an event that harms the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of services offered through or accessible via the network and information systemRiigiteataja. Alongside it comes a new defined term, "napilt toimumata jäänud küberintsident" (near-miss incident)Riigiteataja: an event that could have caused such harm but was prevented or did not materialiseRiigiteataja.

The near-miss category is threaded through the act's cooperation and record-keeping machinery. Providers and other persons may now voluntarily notify the Information System Authority of near-miss incidents alongside incidents, vulnerabilities and threatsRiigiteataja, under the new § 8¹ on voluntary notification; the authority handles those reports under the procedures of §§ 8 and 12. The authority's quarterly aggregate report to the European Union Agency for Cybersecurity now covers near-miss incidents too. The incident register kept by the Information System Authority records near-miss incidents with the same purpose, reporter details and retention logic as other incidentsRiigiteataja, and the authority exchanges information on them with the bodies organising vital services, the Rescue Board and the Government Office, as well as with the other authorities named in the act. Service providers and other persons may voluntarily exchange near-miss information with each other under the same conditions as other cybersecurity information.

Supervision of critical (ülioluline) entities gains two audit instruments.Riigiteataja The Information System Authority may commission need-based security audits (vajaduspõhine turvaaudit) of a critical entityRiigiteataja, triggered among other things by a significant-impact incident or a breach of requirements laid down in the act, instruments under it, or implementing acts under Article 21(5) or Article 23(11) of Directive (EU) 2022/2555. It also gains the power to carry out regular security audits of a critical entity once every three years, unless the entity is already obliged to audit regularly under the cybersecurity requirements imposed pursuant to § 7(5).Riigiteataja The previous framing of ad-hoc supervision (pisteline järelevalve) of critical entities becomes ad-hoc control (pisteline kontroll), with the audit triggers moved into the new need-based audit point. The definition of "sihipärane turvaaudit" (targeted security audit) is renamed to "turvaaudit" (security audit) with its substance kept, while the definition of "turvalisuse kontroll" is deleted and its paragraph number left empty.

Two cross-references fall away with the deletion of § 7(7), the paragraph that pointed designated service providers to the implementing act under Article 21(5) of Directive (EU) 2022/2555. The penalty provisions for essential and important entities, fining breaches of § 7(1), (2), (3), (5) or (7) at up to 10 million and 7 million euro respectively, now cite § 7(1), (2), (3) or (5), so a breach of the deleted paragraph no longer sits in the fining range.

For compliance teams at Estonian in-scope providers, the practical consequences are threefold: recalibrate incident triage to the harm-based incident definition and start logging prevented events as near-misses that can be reported voluntarily; expect the register and information-exchange consequences that follow a notification to apply to those near-misses; and, for critical entities, plan for possible three-yearly audits alongside the possibility of a need-based audit after a significant-impact incident or a requirements breach.

Legal basis: Küberturvalisuse seadus, §§ 2–3 (definitions), § 7(7) deletion, §§ 8–8¹ notification duties, § 13 register, and supervision and penalty provisions, as consolidated at https://www.riigiteataja.ee/akt/106102026002; Directive (EU) 2022/2555, Articles 21(5) and 23(11).

Recalibrate incident triage to the harm-based incident definition and start logging prevented events as near-misses that can be reported voluntarily; critical entities should plan for possible three-yearly security audits and the possibility of a need-based audit.

Sources

Küberturvalisuse seadus