News
Attorney: The New Crisis Management Framework Imposes Costly Additional Obligations
Attorney: The New Crisis Management Framework Imposes Costly Additional Obligations
Imagine a situation where an epidemic of an infectious disease (within the remit of the Health Board) occurs simultaneously with large-scale cyberattacks (within the remit of the Information System Authority) and extensive forest fires (within the remit of the Rescue Board). At the same time, the enemy amasses forces across the border, and the state decides to declare a heightened level of defence readiness (under the leadership of the Defence Forces). In today’s rapidly changing world, we must inevitably be prepared to deal with such complex, overlapping crises, writes Mart Kägu, Attorney at RASK.
The draft Civil Crisis and National Defence Act is currently under deliberation in the Parliament of Estonia, seeking to address precisely this challenge. Its purpose is to consolidate previously separate areas of responsibility and command structures into a unified framework, ensuring that every authority has the powers necessary to respond within its remit, and that leadership and coordination responsibilities are clear – particularly in situations where several crises occur concurrently.
The need for clarity is paramount because the authorities involved in managing complex crises often rely on the same resources, operate in the same geographical areas and issue tasks or orders to the same local governments.
The draft Civil Crisis and National Defence Act is currently under deliberation in the Parliament of Estonia, seeking to address precisely this challenge. Its purpose is to consolidate previously separate areas of responsibility and command structures into a unified framework, ensuring that every authority has the powers necessary to respond within its remit, and that leadership and coordination responsibilities are clear – particularly in situations where several crises occur concurrently.
The need for clarity is paramount because the authorities involved in managing complex crises often rely on the same resources, operate in the same geographical areas and issue tasks or orders to the same local governments.
Replacing the Concepts of Emergency Situation and Heightened Defence Readiness
In the future, civil and defence-related crises will be planned for and managed based on uniform principles, with all high-impact crises resolved under the leadership of the Government of the Republic and the Prime Minister as the crisis manager. The Government will determine when a crisis is sufficiently serious to warrant centralised command.
The new legislation brings together into one framework all special regimes listed in the Constitution (state of emergency, state of exception, state of war), including their prevention, preparedness, command structure and the measures required. As a result, the current Emergency Act, National Defence Act and State of Emergency Act will be repealed.
In place of “emergency situation” and “heightened defence readiness,” a new overarching term – crisis situation – will be introduced to cover both civil and defence-related crises. To resolve a crisis situation, the state may, where necessary, declare a higher-level crisis regime such as a state of emergency, state of exception or state of war, enabling the application of additional measures.
The new legislation brings together into one framework all special regimes listed in the Constitution (state of emergency, state of exception, state of war), including their prevention, preparedness, command structure and the measures required. As a result, the current Emergency Act, National Defence Act and State of Emergency Act will be repealed.
In place of “emergency situation” and “heightened defence readiness,” a new overarching term – crisis situation – will be introduced to cover both civil and defence-related crises. To resolve a crisis situation, the state may, where necessary, declare a higher-level crisis regime such as a state of emergency, state of exception or state of war, enabling the application of additional measures.
Permanent Crisis Duties for Businesses
To ensure preparedness, the law will assign permanent crisis duties to certain businesses in advance. These obligations will not apply to all companies, but primarily to those whose size or field of activity is essential for crisis response. The duties will relate directly to the company’s core operations (for example, ensuring the supply of food, electricity or fuel). The obligation to ensure the continuity of a vital service, both during a crisis and beforehand, will itself constitute a permanent crisis duty.
However, it remains unclear how businesses that are not designated as vital service providers will be notified that they have been classified as holders of a permanent crisis duty. Based on the explanatory memorandum, likely candidates include icebreaking service providers, aviation security operators, ground handling service providers at airports, gas network developers and operators, railway undertakings providing public passenger transport, port operators, operators of ferry lines and high-impact food retail companies.
The specific companies will likely be determined by the responsible minister through an administrative act. It is estimated that the total number of such companies will be around 30. It is crucial that this process be clear and free of uncertainty, as the classification determines whether a company must prepare a risk assessment and crisis plan and comply with crisis-related obligations. For vital service providers, the process is clearer: their designation is made by administrative act, and new vital service providers must be identified no later than 28 February 2026.
However, it remains unclear how businesses that are not designated as vital service providers will be notified that they have been classified as holders of a permanent crisis duty. Based on the explanatory memorandum, likely candidates include icebreaking service providers, aviation security operators, ground handling service providers at airports, gas network developers and operators, railway undertakings providing public passenger transport, port operators, operators of ferry lines and high-impact food retail companies.
The specific companies will likely be determined by the responsible minister through an administrative act. It is estimated that the total number of such companies will be around 30. It is crucial that this process be clear and free of uncertainty, as the classification determines whether a company must prepare a risk assessment and crisis plan and comply with crisis-related obligations. For vital service providers, the process is clearer: their designation is made by administrative act, and new vital service providers must be identified no later than 28 February 2026.
Crisis Duty Requires Companies to Prepare a Crisis Plan
A crisis duty will encompass obligations applicable across all types of crises – both civil and defence-related. These obligations are brought together into a unified regulatory system, and the circle of entities bearing crisis duties will expand. As a result, the regulation of vital services will become one component of the broader crisis-duties framework. A substantive change is that vital service providers’ continuity obligations will now apply not only in peacetime crises but also in defence-related crises, including wartime.
Companies assigned a crisis duty must prepare a crisis plan setting out how various situations will be managed and how the duty will be performed. The plan must be based on the national risk assessment as well as the company’s own risk analysis. In addition, the company must ensure that it has the capabilities, personnel, tools and reserves necessary to perform its crisis duty.
The detailed rules for crisis planning will be established by regulation. It is important that the state also provide substantive guidance so that crisis plans are not merely formally compliant but operationally functional. It cannot be assumed that every company is capable of preparing a robust crisis plan based solely on its existing knowledge. To ensure the performance of crisis duties, companies must identify positions that are critical in both civil and defence-related crises. In other words, employees essential to the continuity of the company’s core operations during a crisis must be identified. Such employees will be exempt from mobilisation because their work is directly linked to fulfilling the crisis duty.
Companies assigned a crisis duty must prepare a crisis plan setting out how various situations will be managed and how the duty will be performed. The plan must be based on the national risk assessment as well as the company’s own risk analysis. In addition, the company must ensure that it has the capabilities, personnel, tools and reserves necessary to perform its crisis duty.
The detailed rules for crisis planning will be established by regulation. It is important that the state also provide substantive guidance so that crisis plans are not merely formally compliant but operationally functional. It cannot be assumed that every company is capable of preparing a robust crisis plan based solely on its existing knowledge. To ensure the performance of crisis duties, companies must identify positions that are critical in both civil and defence-related crises. In other words, employees essential to the continuity of the company’s core operations during a crisis must be identified. Such employees will be exempt from mobilisation because their work is directly linked to fulfilling the crisis duty.
The Company’s Duty to Ensure Continuity and the Consequences
All companies assigned a crisis duty must ensure continuity of operations. Continuity refers to the internal organisation required to ensure that the company is able at all times to perform its obligations, including protection of critical sites in a crisis situation. Whereas the crisis plan addresses how the triggering event will be resolved, continuity measures address how the undertaking will function while resolving that crisis.
Ensuring continuity brings with it a wide array of obligations, raising legitimate concerns about their practical feasibility. In addition to site protection, companies may face the need to comply with cybersecurity requirements, acquire additional storage facilities for compulsory reserves, reduce dependence on contractual partners and ensure the ability to maintain core operations to a prescribed extent (including securing generators or other backup power solutions).
Companies may also have multiple core operations (such as production of dairy, beef and pork), each dependent on other crisis-duty companies such as electricity or fuel suppliers. For retail chains with broad product portfolios, the requirement to maintain 50% of core operations during a crisis could imply that even non-essential products must remain available, as the regulation distinguishes not by product type but by overall volume.
Ensuring continuity brings with it a wide array of obligations, raising legitimate concerns about their practical feasibility. In addition to site protection, companies may face the need to comply with cybersecurity requirements, acquire additional storage facilities for compulsory reserves, reduce dependence on contractual partners and ensure the ability to maintain core operations to a prescribed extent (including securing generators or other backup power solutions).
Companies may also have multiple core operations (such as production of dairy, beef and pork), each dependent on other crisis-duty companies such as electricity or fuel suppliers. For retail chains with broad product portfolios, the requirement to maintain 50% of core operations during a crisis could imply that even non-essential products must remain available, as the regulation distinguishes not by product type but by overall volume.
Costs, Feasibility Concerns and Tight Deadlines
Many companies bearing crisis duties rely heavily on subcontractors they do not control (a contract alone does not guarantee performance). This raises the question of whether it is realistically possible for a company to assign employees to crisis-critical positions. Site-protection requirements may also appear unrealistic at first glance, for instance for telecommunications companies with hundreds of towers nationwide.
All these obligations entail significant costs, and the state has not, at least for now, proposed financial support to mitigate them. Compliance deadlines may also be very short in some cases (less than ten months). In summary, the draft legislation offers obligated companies no “carrot,” but rather relies on the “stick”: penalties for non-compliance are expected to be substantially tightened.
The draft is still under preparation, and hopefully stakeholders’ input will be considered. However, companies bearing crisis duties, especially vital service providers, must prepare for crisis planning obligations covering both civil and military crises, which will inevitably result in additional costs. According to the current plan, the law is expected to be adopted by July 2026.
All these obligations entail significant costs, and the state has not, at least for now, proposed financial support to mitigate them. Compliance deadlines may also be very short in some cases (less than ten months). In summary, the draft legislation offers obligated companies no “carrot,” but rather relies on the “stick”: penalties for non-compliance are expected to be substantially tightened.
The draft is still under preparation, and hopefully stakeholders’ input will be considered. However, companies bearing crisis duties, especially vital service providers, must prepare for crisis planning obligations covering both civil and military crises, which will inevitably result in additional costs. According to the current plan, the law is expected to be adopted by July 2026.