If the amendments made on the basis of the results of the public display and public discussion alter the principal solutions of the special national plan, the approval procedure with government agencies is repeated and a new public display and public discussion are organised (Planning Act § 52(3)).
Upon the establishment of a special national plan, the validity of a previously established plan covering the planning area ceases, and the amendments are entered into the plans within 60 days (Planning Act § 53(2)).
The special national plan established for the Piirsalu area provides the Ministry of Defence, and subsequently the developer, with a legal basis for designing an explosives plant, while the Aidu area remains under proceedings and its fate depends on a new public consultation. The Government of the Republic partially established the SNP by Order No 169 of 09.10.2026, but the proposal to expand the Aidu area compels the proceedings to be repeated. The purpose of the special national plan is the construction of a structure with significant spatial impact, against the location or operation of which there is a substantial national interest, including in the field of national defence (Planning Act § 27(1)). Strategic environmental assessment is mandatory in the preparation of a special national plan (Planning Act § 27(6)); it has been carried out here, and pursuant to it the activity is possible subject to conditions and the application of avoidance, mitigation and compensation measures. As regards Piirsalu, what is at risk is not the validity of the plan, but the subsequent implementation stage — the issuing of design conditions and the preparation of the building design. As regards Aidu, what is at risk is the extent of the planning area and the duration of the proceedings, because the 50-hectare expansion alters the principal solution.
Pursuant to Planning Act § 53(1), a special national plan is established by the Government of the Republic by an order, which has occurred as regards Piirsalu. Since the planning solution for the Piirsalu area is detailed (approx. 74 hectares, an explosives plant with its infrastructure), the plan serves as the basis for preparing a building design in accordance with Planning Act § 27(10). The Ministry of Defence is the organiser under § 27(7) of the Act, as the Government of the Republic may, in matters of national defence, designate the government agency of the relevant field as organiser. In the case of the Aidu area, Planning Act § 52(3) applies, under which, if amendments made as a result of the public display alter the principal solutions of the plan or require a substantial amendment of the SEA report, the approval procedure with government agencies is repeated and a new public display and public discussion are organised. In terms of participation, local government units, persons whose rights the plan may affect, and environmental organisations must be involved (§ 27 cooperation and participation requirements). The organisation of development and management, including the handling of explosive materials, has been assigned to the Centre of Defence Investments (RKIK Statutes item 13²). The reuse of the buildings of the former missile base located in the Piirsalu area is a discretionary consideration, not a legally predetermined requirement, in implementing the plan.
As regards Piirsalu, the next step is the issuing of design conditions, because a special national plan established on the basis of a preliminary selection of location serves as the basis for issuing design conditions (Building Code § 26¹(1)); here the solution is detailed, so the preparation of a building design and building permit proceedings will follow. It does not directly affect the real estate owners of the Kõuemaru and Tuulemaru properties, as the land belongs to the state. As regards Aidu, a new public display and public discussion must be awaited, together with an additional impact assessment, as a result of which it will become clear whether the area is finally included in the SNP. The termination proceedings of Eesti Energia's superficies servitude with the Ministry of Climate are a precondition for bringing the Aidu area into use. In practice, this is significant for defence industry investors, the municipality of Lääne-Nigula, and landowners around Toila, for whom the new display provides the right to submit opinions and objections.
Under Section 38(4) of the Food Act, the minister responsible for the field establishes by regulation the requirements for the provision of food-related information by food groups or processing methods.
Altering the labelling without altering the actual properties of the food is treated as food adulteration, except for clarifying the labelling and correcting misleading labelling (Food Act § 40(1)).
The ministerially signed draft regulation means that Estonian food producers would be able to use the Nutri-Score label voluntarily, and until the regulation enters into force, the use of this label is not nationally regulated. The direct legal question is under what conditions the minister can, at all, establish requirements for the provision of food-related information by food groups, and what restrictions already apply to labelling. The basis is Section 38(4) of the Food Act, under which requirements for the provision of food-related information by food groups or processing methods are established by regulation of the minister responsible for the field. The general requirements for the content and provision of information also derive from Section 38(1)–(3) of the Food Act: the information must be true, must comply with the requirements of legislation, and must not mislead the handler or the consumer. In addition, the Act refers to Regulation (EU) No 1169/2011 of the European Parliament and of the Council at the European Union level, which defines what is considered food information to consumers. Voluntariness does not mean freedom from regulation: even an approved label falls within the labelling regime, which the law makes strict with respect to misleading information.
Upon entry into force of the draft regulation, producers would have a choice — whether or not to use Nutri-Score — but a handler who begins to use it assumes all obligations applicable to labelling:
In practice, the parties divide into two: some producers can use the voluntary label to increase the visibility of their products, while other producers bear the risk that the labelling will show a competitor's output in an unfavourable light — it is precisely this that the minister considers a matter of fair competition. The opposition of representatives of the food industry indicates that the regulatory choice is being contested at the political level. The concrete risk for a producer remains the same: if the label does not correspond to the actual composition or properties of the food, it constitutes misleading information and possibly also food adulteration within the meaning of Section 40(1) and Section 35 of the Food Act.
May the state, in funding special care services, proceed on the basis of budgetary possibilities, or does the law impose on it an obligation to ensure a service for a person with an identified need for assistance even where this requires a larger sum to be provided for in the budget?
Legal basis: There is no direct extract of a provision in the underlying material, so I rely on the principle articulated in the Supreme Court judgment of April 2026 cited in the news report: once a person's right to special care has been established, a lack of funds or of service places does not justify leaving that person without assistance, and the state has no right to plan fewer resources for special care than are actually needed to fulfil its statutory obligations. The rule to be derived from this is as follows: the obligation to provide the service is primary, and budget planning must be subordinated to it accordingly, not the other way round. In the specific case, where a person had waited more than four years for round-the-clock special care, the Supreme Court considered a deadline of up to three months acceptable, which gives the securing of the service a measurable temporal standard.
Practical significance: In practice, this significantly alters the legal framework of the budget dispute: the right of the person in need of assistance does not arise from a political agreement or from coalition or opposition bargaining, but already exists; consequently, the argument "we will give as much as is left over" is legally indefensible in light of the Supreme Court's principle, whereas a claim based on an identified need is strong and backed by judicial protection. A person whose need for assistance has been established must be provided with the service within up to three months, so waiting in a queue (2,049 people at the beginning of October) is a fact suitable for litigation, not merely a social-policy problem. It is worth watching whether, in allocating the additional 37 million euros, it is clarified what share will reach special care, because if the underfunding continues, delegating the care burden to relatives becomes a question of a state act or omission that can be challenged in court in exactly the same way as in the case of the person who had waited in the queue for more than four years.
A serious breach is deemed to be a service provider's failure to comply with the obligation provided for in § 8(1), and, in the case of a cyber incident with significant impact, the failure to use security measures to resolve the incident.
The support measure for raising the level of cybersecurity may not exceed EUR 40,000 over any period of three budgetary years.
The attack on the cooling systems of retail stores that took place during the night of 12 October in France demonstrates that, in Estonia, the entities in the most legally significant position in such a situation are those companies falling within the scope of application of the Cybersecurity Act, because the Act applies from 1 January 2026 and imposes on them specific obligations concerning security measures and notification of cyber incidents. The case described in the news — in which the attackers exploited unpatched software and internet-connected devices with default passwords — corresponds to a situation where a service provider has failed to implement the security measures required by law. Section 7 of the Cybersecurity Act establishes requirements for operating network and information systems, on the basis of which cybersecurity requirements for network and information systems have also been established, including the requirement regarding the currency of the software running the systems and the requirement for managing access rights and identifying users. The use of default passwords and unpatched software would therefore presumably constitute a breach of these general requirements. The scope of application covers entities essential and important for the functioning of society, as well as providers of domain name registration services (§ 1(1)). Since the attack affected approximately 700 supermarkets and the damage ran into the tens of millions of euros, an analogous incident in Estonia would likely qualify as a large-scale cyber incident, whose prevention and resolution requirements are likewise provided for in the Act.
The obligation to notify cyber incidents arises from § 8 of the Act, and failure to comply with it is designated as a serious breach. The handling and prevention of cyber incidents is coordinated by the Information System Authority (§ 12(1)), which also processes anonymously submitted reports of security vulnerabilities. The toolkit of the supervisory authority includes a warning, an injunction to cease an activity or practice, an injunction to implement the recommendations of a security audit within a reasonable period of time, and an injunction to notify entities that may be affected by a significant cyber threat. In assessing the proportionality of the implementation of security measures, account is taken of the service provider's size, the likelihood of cyber incidents occurring, and their societal and economic impact. Where a service provider authorises the management of a system by another person, it nonetheless remains responsible itself for ensuring that the other person implements the security measures. For the home user, the Act creates no direct obligations — the scope of application is directed at service providers, so the protection of a smart home device owner depends primarily on the quality of the manufacturer's service rather than on an obligation arising from the Act. The network rules for the operation of the electricity system provide that a remote reading device must include measures to prevent and detect manipulation of data, based on the requirements established under the Cybersecurity Act. A financial mechanism has also been created for enterprises: a service provider that has fulfilled the obligation specified in § 4¹ of the Cybersecurity Act may apply for a support measure for raising the level of cybersecurity, and the support may not exceed EUR 40,000 over three budgetary years.
For an Estonian enterprise in which a similar vulnerability is identified — for example, internet-connected devices with default passwords, such as the fuel pumps at the filling station described in the news — the realistic consequences are as follows:
In practice, this is most significant for retailers, logistics companies and energy suppliers whose physical systems can be controlled via the internet, since it is precisely through their systems that a cyber incident can affect the physical environment. Service providers may voluntarily exchange information with one another about cyber threats, security vulnerabilities and the detection of attacks, which makes it possible to prevent similar attacks before they reach Estonia.
Under subsection 2² of § 2 of KOKS, the local government unit has the task of ensuring crisis preparedness in accordance with the Emergency Situation and National Defence Act and the legislation adopted on its basis, which entered into force on 01.10.2026.
Under subsection 4 of § 82 of KRIS, a provider of a vital service is obliged to implement measures ensuring continuity of operation, including reducing dependence on key suppliers and contractual partners through the duplication of resources and alternative solutions.
Tartu's decision to take over nearly one-third of street maintenance for the city to organise itself legally signifies a partial transition from a contractual procurement relationship to a subordination relationship with an institution under the city's control, which alters the legal basis both for commissioning the service and for deploying crisis resources. The new fact of significance to the reader is that, as of 1 July 2026, subsection 2² of § 2 of the Local Government Organisation Act (KOKS) enters into force, under which a local government unit has the task of ensuring crisis preparedness in accordance with the Emergency Situation and National Defence Act (KRIS) and the legislation adopted on its basis — this provides a crisis-preparedness-based legal justification for establishing the city's own maintenance unit, which the news report hints at but does not name. The precise legal question is on what basis a local government unit may assign the provision of a service to its own subordinate institution instead of conducting a procurement, and what obligations accompany such a transfer. Subsection 3 of § 2 of KOKS grants the local government unit the right to decide and organise matters of local life that are not by law assigned to the decision-making of any other body, and the local government unit itself determines the general content of the task and the competence for its performance. Point 12 of subsection 1 of § 9 of KRIS establishes, as a task of the local government unit, the organisation of the continuity of operation of a vital service to the extent prescribed in § 82. An important distinguishing factor is that street maintenance is not designated as a vital service in the sources presented: descriptions of vital services are established in the sources in the fields of food supply (Regulation No. 59 of the Minister of Regional Affairs and Agriculture of 21.09.2026, entered into force on 01.10.2026), port operators (Regulation No. 58 of the Minister of Infrastructure of 03.09.2025), and healthcare services. Accordingly, general local government and crisis-preparedness norms apply to the organisation of street maintenance, not the special requirements imposed on a provider of a vital service.
If Tartu establishes a subordinate institution of the city government, a relationship of subordination arises between the city government and the institution rather than a contractual relationship; consequently, the city government may redirect the institution's workforce in the manner described in the news report without conducting a procurement, amending a contract, or concluding a separate pricing agreement. This distinction is legally decisive precisely in emergency situations, because under a contractual procurement relationship the contractor bears a contractual obligation to provide the service, and unilateral amendments to the contract require agreement or a ground provided for in the contract. Under KRIS, the crisis-preparedness obligations of a local government unit are concrete, and their fulfilment does not depend on the manner in which the service is provided:
The situation named in the news report — bases on one side of the Emajõgi River and obstacles to the use of bridges — conceptually corresponds to the logic of reducing dependence and duplicating resources under subsection 4 of § 82 of KRIS: a base established on the opposite bank is precisely such an alternative and duplicating solution as the law requires of a provider of a vital service. Since, according to the sources, Tartu's maintenance unit is not a provider of a vital service, these requirements apply to it only as a model and within the framework of the general crisis-preparedness task (subsection 2² of § 2 of KOKS). The sources contain no case law, and therefore no specific court case concerning similar disputes can be cited. The sources also do not cover the legal assessment of the procurement requirements (maintenance base, competent team), as the Public Procurement Act is not among the sources.
In practice, the new arrangement means three things for Tartu: a change in the city's expenditure structure, greater managerial flexibility through the relationship of subordination, and an investment of approximately 5 million euros in maintenance equipment and a base, the justification of which is assessed over the entire service life of the assets. The existing service providers remain contractual partners, since the majority of streets will continue to be maintained by private undertakings. From the perspective of crisis law, the nearest point of monitoring is the already-launched reform: the regulation of the vital service in the field of food supply entered into force on 01.10.2026, and if any Tartu service provider or partner is designated as a provider of a vital service in that field, the designation order will be transmitted to it electronically within five working days of the date of issuance of the order, and maximum deadlines for fulfilling continuity-of-operation requirements may be imposed on it in the manner prescribed in point 6 of subsection 9 of § 83 of KRIS. The sources do not reveal a specific deadline or document for deciding on the establishment of the street maintenance unit; attention must be paid to the decision of the Tartu City Council and to the confirmation, a few years later, of the approximately one-million-euro annual saving projected in the city's preliminary estimate, as planned in the news report.