News

The defence sector is highly regulated all over the world and Estonia is no exception. If your product is a system for military use or even a dual-use system, additional time and resources will need to be invested into setting the business up. Below we’ll share some insights on legal aspects to consider.

1. Establishing Your Company

Initial Setup

In Estonia, most startups begin as a limited liability company (Osaühing or OÜ). Funding is typically arranged through agreements with investors or VCs. You can:

• Issue shareholdings in exchange for raised capital (equity investments).
• Use instruments like SAFEs or convertible debt that convert into shareholdings later.

Corporate Structure

There’s no universal template; the structure often depends on your agreements with investors. Estonia offers same-day company registration for simple setups, but more complex arrangements—involving founding documents and financing agreements—require more time to prepare.

Timelines

Most seed rounds can be completed in months, accommodating fast-paced startup needs. However, the defence technology sector’s regulatory requirements may add time constraints. If your product is a system for military use or even a dual-use system, additional time and resources will need to be invested into getting all relevant permits of production and sale.

2. Navigating the Regulatory Landscape

Regulatory Overview

Defence tech is heavily regulated. This essentially means that even if you are developing only a piece of software relevant for the functioning of a weapon or an essential component of a defence system, you may need to apply for a permit to operate your company.

Defining the Product 

Regulatory scrutiny increases with:

• Items classified as weapons, weapon systems, or essential components.
• Solutions that have a primarily civilian use, but could be used for military purposes, i.e. dual-use items. Such items are classified as strategic goods and their export is usually subject to state authorization.

Ukrainian Founders

Starting January 2025, Estonia allows Ukrainian nationals to own majority shares in regulated defence tech companies. Fully Ukrainian-owned defence tech businesses can thus be established in Estonia, if all other requirements are met.

3. Protecting Your Intellectual Property (IP)

Securing IP Rights 

Clearly define your company’s intellectual property and establish robust IP transfer and licensing agreements to ensure:

• Your company has unrestricted rights to sell its product.
• You pass buyer-side due diligence on your IP without any issues.

Avoiding Pitfalls

Failure to secure full IP rights can jeopardize your control over your product.

4. Handling Personal Data

Data Identification

From the outset, determine if your product collects personal data. Personal data includes information that can identify someone, even if anonymized or collected from public sources.

Legal Basis for Data Processing

In most defence-related use cases the need to get explicit consent for data processing would defeat the purpose of the product. For these use cases, legitimate interests (e.g., property protection, identifying third parties to take legal action) or public interest (with proper authorization) can serve as legal grounds if carefully assessed and established. These considerations are especially relevant for products that have both civilian and military uses or if a product’s effects extend into the civilian sphere (such as psyops and cyber warfare).

Minimizing Data Collection 

If personal data is non-essential, design it out or limit its use to avoid compliance risks.