Amendments to the National Cybersecurity Law in Latvia have come into force, clarifying the scope of entities covered, reducing bureaucracy, and establishing new security requirements for personnel. The changes address practical ambiguities, optimize the list of supervised institutions, and introduce tools for internal risk management and personnel security evaluation. Private legal persons delegated state tasks in social or cultural fields are excluded from full law requirements. The National Cybersecurity Center now decides on exclusion of state or local government institutions if their operational disruptions do not pose systemic risks to national defense or society. A direct link with the National Security Law defines important commercial companies, associations, and foundations as essential service providers, excluding those whose status is only due to agricultural or forestry land holdings. The amendments take effect on October 1, 2026, with a reasonable transition period for registration. New provisions require entities to assess security risks when hiring employees with privileged access to critical systems and IT resources, allowing employers to obtain criminal records from the Punishment Register. The previous public list of cybersecurity auditors has been abolished, allowing entities to freely choose any auditor meeting Cabinet requirements, promoting service availability and competition. The law sets a precise deadline of three months to appoint a cybersecurity manager after an organization gains status under the law, aligning with the deadline for self-assessment report submission.

Amendments to the National Cybersecurity Law in Latvia have come into force, clarifying the scope of entities covered, reducing bureaucracy, and establishing new security requirements for personnel. The changes address practical ambiguities, optimize the list of supervised institutions, and introduce tools for internal risk management and personnel security evaluation. Private legal persons delegated state tasks in social or cultural fields are excluded from full law requirements. The National Cybersecurity Center now decides on exclusion of state or local government institutions if their operational disruptions do not pose systemic risks to national defense or society. A direct link with the National Security Law defines important commercial companies, associations, and foundations as essential service providers, excluding those whose status is only due to agricultural or forestry land holdings. The amendments take effect on October 1, 2026, with a reasonable transition period for registration. New provisions require entities to assess security risks when hiring employees with privileged access to critical systems and IT resources, allowing employers to obtain criminal records from the Punishment Register. The previous public list of cybersecurity auditors has been abolished, allowing entities to freely choose any auditor meeting Cabinet requirements, promoting service availability and competition. The law sets a precise deadline of three months to appoint a cybersecurity manager after an organization gains status under the law, aligning with the deadline for self-assessment report submission.