Nobody tells you that you are in scope. The Latvian cybersecurity regime sorts companies into two categories by a size test, widens on 1 October 2026, and attaches reporting deadlines and fines to the answer — while leaving the work of reaching it to you.
Latvia's cybersecurity regime has a feature that catches companies out more reliably than any of its technical requirements. Nobody tells you that you are in scope.
The National Cybersecurity Law requires a business to assess for itself whether it is an essential or an important service provider and, if it is, to notify the National Cybersecurity Centre within one month. No register places you on it, no letter arrives, and no grace period starts when you find out. The first round was due by 1 April 2025: a company discovering today that it has been in scope is not approaching a deadline, it has missed one.
The size test that sorts everyone
Both categories are in scope; the difference shows in supervision and, sharply, in the fines. Two definitions do most of the sorting.
A large operator meets at least one of: 250+ employees; turnover over EUR 50 million; or a balance sheet total over EUR 43 million.
A medium operator meets all of: up to 249 employees; and turnover or a balance sheet total between EUR 10 million and the large thresholds.
Note the asymmetry. "Large" is satisfied by any single limb, so a labour-intensive business with 300 employees and modest turnover is large. "Medium" needs the headcount limb and a financial one, so a company with 40 employees and EUR 3 million of turnover is neither, and falls outside the size-based routes entirely.
Essential service providers
Some entities are essential by what they are, with no size test: the .lv registry, domain name resolution providers, electronic communications merchants, qualified trust service providers, state bodies and public media.
Others are essential because they are a large operator in a listed field — twenty heads covering energy, transport, credit institutions, central counterparties and trading venues, healthcare, drinking water, and the digital heads: cloud computing, data centres, content delivery networks, ICT management and cybersecurity services.
Three further routes catch businesses that would not expect to be caught: being the sole provider of a service in one of those fields in Latvia, whatever the size; an indirect administration institution operating in one under private law; and any entity whose disruption could significantly affect public safety, national defence or public health, or create systemic risk.
The scope widens on 1 October 2026
That last route is being extended. From 1 October 2026 it expressly includes commercial companies, foundations and associations significant to national security, excluding owners of large forest or agricultural holdings.
This widens the essential category, where the obligations and fines are heaviest. Any business that concluded it sat outside on the earlier wording should look again.
An important service provider is anyone not essential who is a medium operator in one of those fields, or a medium or large operator in a further list: postal services, waste management, chemicals, industrial food production, medical devices.
What the Law requires
The head of the entity is personally responsible for cybersecurity governance, and must designate a cybersecurity manager within three months of notifying status, informing the Centre and the Constitution Protection Bureau within five working days.
That manager's duties are in the Law: organise the security measures, carry out an ICT security check at least once a year and remediate what it finds, attend annual training, and brief staff on current risks. The technical minimum requirements sit in Cabinet Regulation No. 397.
Reporting an incident
This is where the timetable becomes unforgiving. On detecting any cyber incident you must act on it immediately, inform the competent incident prevention institution, and immediately assess whether the incident is significant. That assessment is yours, made under time pressure, and it decides everything that follows.
An incident is significant if it meets any one of several alternative limbs: it endangers public health, safety or national security; it causes property loss of at least EUR 500,000 or 5 per cent of turnover, whichever is lower, counting loss to other people and not only to you; it harms life or health; it affects restricted-access information; or it is cross-border.
Where it is significant, three deadlines run:
| Step | Deadline |
|---|---|
| Early warning | Immediately, no later than 24 hours |
| Initial report | Immediately, no later than 72 hours — 24 for a trust service provider |
| Final report on resolution | Within one month of the initial report |
The reports are not free-form: each has a prescribed form annexed to the regulation, signed electronically. You must also inform your own affected service recipients immediately.
The fines, and what actually triggers them
The headline numbers are large — up to EUR 10 million or 2 per cent of turnover for an essential provider, EUR 7 million or 1.4 per cent for an important one. The qualification matters more than the numbers. Those powers arise only for substantial non-compliance, which the Law defines exhaustively as: not taking appropriate and proportionate measures; repeatedly refusing lawful supervisory requests for information; or failing to notify a significant incident in time, or knowingly reporting it falsely.
So this is not a general sanction for imperfect security. It attaches to an absence of measures, repeated obstruction, and missed or falsified reporting.
What to do now
Run the self-assessment and date it. It is the statutory definition applied to your headcount, turnover and balance sheet against the field you operate in — not a judgement about how important you feel.
Check the 1 October 2026 wording, particularly if the earlier conclusion was that you were outside.
If you are in scope and have not notified, the position is already late. The obligation does not lapse because a deadline passed.
If you are a regulated financial institution, do not answer this question in isolation. Financial entities covered by the EU digital operational resilience regulation (DORA) are subject to it as the more specific regime: the Law applies to them only as far as its own scope provision allows, and its requirements give way where DORA's are equivalent. That also avoids being sanctioned twice, since DORA carries its own penalty regime.
Notice how few financial entities are in the listed fields at all: only credit institutions, central counterparties and trading venues. Payment and electronic money institutions, investment firms, insurers and crypto-asset service providers fall within the Law, if at all, only through the general routes.