Legal prism — 2026-10-22

The sustainability reporting obligation will remain applicable only to commercial companies and group parent companies with net turnover exceeding EUR 450 million and more than 1,000 employees, applicable from the 2027 financial year.

A reporting undertaking may not request from value chain companies with up to 1,000 employees more information than is provided for in the European Commission's voluntary sustainability reporting standards.

Core issue

The forthcoming regulatory amendment in Latvia means that the sustainability reporting obligation will remain applicable only to very large undertakings — commercial companies and group parent companies with net turnover exceeding EUR 450 million and more than 1,000 employees — while all others will be released from this obligation. This solution is provided for by incorporating the requirements of Directive (EU) 2026/470 of the European Parliament and of the Council, and it will alter the current position established by the Sustainability Information Disclosure Law and the Annual Reports and Consolidated Annual Reports Law. The direct legal question is twofold: first, which categories of companies will be obliged to include a sustainability report in their management report, and, second, what requirements will apply to their value chain suppliers. Currently, Article 56 of the Annual Reports and Consolidated Annual Reports Law (as amended on 26 September 2024) provides that a large undertaking, as well as a small and medium-sized undertaking whose transferable securities are admitted to trading on a regulated market, shall include a sustainability report in a separate section of the management report. The amendments will narrow this scope: the mandatory obligation will no longer apply to small and medium-sized undertakings whose securities are admitted to trading on a regulated market.

Legal assessment

Under the existing framework, the reporting obligation rests on the classification of companies according to threshold values — Article 5 of the Annual Reports and Consolidated Annual Reports Law defines a large undertaking as one exceeding at least two of three values (total balance sheet amount of EUR 25,000,000, net turnover of EUR 50,000,000, average number of employees of 250). These criteria will remain the basis for the application of the new framework, but the sustainability reporting threshold will be raised substantially. For companies that retain the obligation, the procedure will invariably include the following steps:

• preparation of the sustainability report in a separate, clearly identifiable section of the management report in accordance with Article 7 of the Sustainability Information Disclosure Law (for a group parent company, a consolidated sustainability report within the consolidated management report);
• assurance of the report's compliance by a sworn auditor as part of the annual audit (Article 12 of the Sustainability Information Disclosure Law, Article 91(1¹) of the Annual Reports and Consolidated Annual Reports Law);
• liability for preparation and submission in accordance with Article 100 of the Annual Reports and Consolidated Annual Reports Law.

For third-country parent companies, the reporting threshold for subsidiaries will be raised from EUR 150 million to EUR 450 million, thereby aligning the requirements with those applicable to EU undertakings. Additional relief is provided for public-interest entities with more than 500 employees — large undertakings and parent companies of large groups may omit the sustainability report for the 2026 financial year if, at the balance sheet date, their net turnover does not exceed EUR 450 million and their average number of employees does not exceed 1,000.

Consequences

The practical consequences will differ depending on the size and status of the undertaking:

• Very large undertakings (turnover exceeding EUR 450 million, more than 1,000 employees) will retain the full obligation, together with the auditor assurance requirement, starting from the 2027 financial year.
• Small and medium-sized listed companies will be released from the mandatory reporting obligation; however, the requirement under Article 91(1) of the Annual Reports and Consolidated Annual Reports Law to audit their annual reports as listed companies remains in force.
• Small value chain partners will gain protection against excessive data requests — the reporting undertaking's requests will be limited to the voluntary standards.
• Third-country group structures with previously captured EU subsidiaries (turnover between EUR 150 million and EUR 450 million) will no longer be subject to reporting provision at the EU level.
• Public-interest entities with more than 500 employees that do not exceed both new thresholds may avail themselves of the exemption already in respect of the 2026 financial year.

For systems that cannot be updated to a secure PHP version, access from the internet must be restricted, preventing their public availability until the security risks are remedied.

The National Cybersecurity Law grants the competent institution the right to adopt a decision (including an administrative act) to ensure the fulfilment of duties, to impose a fine, and to carry out the compulsory enforcement of a legal duty.

Core issue

The persons in this story — the owners of 165 state and municipal websites on the unified TVP platform and private-sector maintainers — are awaiting the moment when the access restriction is a lawful protective measure rather than a voluntary service suspension, and how quickly availability is restored depends directly on the installation of security updates. The factual trigger: due to PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, severity 9.2 under CVSS v4.0), the State Chancellery suspended access to TVP, and "Cert.lv" is coordinating the restoration. The legal question is twofold: first, whether and on what legal basis the cyber incident response institution and other authorities may restrict the availability of resources, and, second, what obligations in this situation rest on the resource owners themselves. The foundation of the solution is the National Cybersecurity Law: its Article 10 sets out the tasks of the cyber incident response institution, Article 11 — the right to request information and conduct inspections, while the provision of the first part of the Law, which mentions decision-making, the imposition of fines, and the compulsory enforcement of a legal duty, indicates that the authority also has a coercive instrument if obligations are not fulfilled. For private-sector maintainers, the sources expressly set out the duty to immediately check systems and install available security updates, and for systems that cannot be updated to a secure PHP version — to restrict access from the internet until the risk is remedied.

Legal assessment

The allocation of competence in this situation is as follows:

• Article 9(2)(2) of the National Cybersecurity Law: the Institute of Mathematics and Computer Science of the University of Latvia (the role performed by "Cert.lv") acts with respect to state and municipal institutions as well as private-law legal persons.
• Article 10: the institution performs analysis of vulnerabilities significant at the national level, responds to cyber incidents, coordinates their remediation, warns subjects, and informs the public about current cyber threats.
• Article 11: the institution may request and receive from subjects and private legal persons information on the security requirements implemented, vulnerabilities identified, as well as technical information concerning an ongoing cyber incident.
• The right of inspection is limited: it may be carried out in the infrastructure of providers of essential and important services, but in IT critical infrastructure — only upon a request by the Constitution Protection Bureau.
• A complication is that PHP developers have not provided fixes for all versions: in unsupported versions, the developers' recommendations only partially limit possible attacks and do not replace updates, so the resource owner's duty may take the form of restricting access or providing information in a limited format.
• Where restoration of access depends on third parties — developers or hosting providers — the owner must contact its IT maintainers to verify the PHP version in use and the implementation of the necessary update. As regards coercive options: the National Cybersecurity Law grants the competent institution the right to adopt a decision (including an administrative act) to ensure the fulfilment of duties or to prevent a threat to national security, as well as to impose a fine and carry out the compulsory enforcement of a legal duty. Likewise, the Law provides that where a cyber threat or incident prima facie bears the features of a criminal offence, the institution must immediately notify the competent authority. Coordinated centralised protection against denial-of-service attacks is ensured by the National Cybersecurity Centre in accordance with the Regulations on Centralised Protection against Denial-of-Service Cyberattacks, issued on the basis of Article 31 of the Law.

Consequences

The practical consequences at present are availability restrictions, not sanctions:

• The TVP platform has already been updated with the necessary security updates, and the availability of the 165 state and municipal websites from Latvia has been restored, but some resources retain preventive restrictions from abroad.
• Varis Teivāns, deputy to the head of "Cert.lv", indicated that certain resources may remain unavailable until 26 October 2026.
• Private-sector companies that fail to install the updates face not an immediate penalty but a gradual coercive escalation: information requests under Article 11, a decision or administrative act compelling fulfilment of the duty, a fine, and compulsory enforcement of the legal duty.
• If successful attacks bearing the features of a criminal offence were discovered during the incident response, the institution would refer them to the competent authority for procedural action.
• The unavailability of "Likumi.lv" and the official publication "Latvijas Vēstnesis" means that access to the official publication of legislation was disrupted during the incident. Monitoring point: "Cert.lv", in cooperation with the responsible authorities, continues to monitor the situation and coordinate protective measures; in practice, it can be expected that in the coming days the institution will report on the restoration of access for the remaining resources and on whether any system shows successful exploitation attempts.

Section 146 of the Commercial Law imposes on the founders the obligation to sign for and pay up the entire share capital before submitting the registration application, and its paragraph 2 requires that the paid-up share capital of a small-capital SIA be paid up only in cash.

Where the monetary contribution does not exceed €50,000, the founders themselves confirm in the registration application that the account has been opened and payment made; where this amount is exceeded, an additional document confirming payment is required.

Legal assessment

The parties' obligations are distributed as follows:

• The founders open an account in the name of the company being founded (Section 147), pay in the full share capital before submitting the application (Section 146), and confirm this in the application where the amount is up to €50,000 (Section 190, paragraph 4).
• A bank or payment service provider opens the account following its own customer due diligence; Sections 97(4)–(6) of the Payment Services and Electronic Money Law apply to a consumer's basic payment account and therefore do not apply directly to an incorporation account, with the decision resting with the service provider under its own terms.
• Incorporation expenses are borne proportionally to the amount of capital signed for by each founder, unless the agreement provides otherwise (Section 147, paragraph 2).
• Where part of the capital is contributed as an in-kind contribution, it is valued in accordance with the rules of Section 154 (Section 148) — but in the case of a small-capital SIA paid up in cash, this route is unavailable due to Section 146, paragraph 2. The international context is reflected in Article 31 of Directive 2011/16/EU (DAC): an incorporation account qualifies for the reporting exemption only if the funds are blocked until confirmation of establishment, the account is converted into the name of the entity upon incorporation or closed, repayment in the event of failure is made only to the depositors, and the account has not been opened more than 12 months earlier. In practical terms, this means that a temporary account is not intended for long-term holding — the incorporation must be completed within this time horizon. The remaining sources — temporary accounts with the Bank of Latvia for asset management companies and temporary institutions, temporary accounts for privatisation certificates, and Section 59 of the Law on the Management of Capital Shares and Capital Companies of Public Persons — concern other subjects and are NOT applicable in this situation. Case law on the opening of incorporation accounts cannot be found in the sources provided.

[PASEKMĒS] Where the procedure is observed, the registration application to the Enterprise Register is complete: the confirmation of the account and payment (up to €50,000) is included in the application, and upon entry in the Commercial Register the account is converted into an everyday settlement account — this must be coordinated with the bank by submitting the registration details and completing the contractual arrangements. Where the procedure is breached, the risks are concrete:

• No account has been opened in the name of the company being founded, or payment has not been made before submission — the application does not comply with Sections 146 and 147, and registration is not possible.
• Commissions deducted from the account reduce the amount below the declared share capital — the confirmation becomes inaccurate, and the deficiency must be rectified before submission.
• The account is older than 12 months — compliance with the DAC Article 31 exemption for reporting purposes is lost. After registration, the management board's duty is to submit to the Commercial Register authority, no later than five days after the expiry of the payment deadline, the current register of members showing the payment status (Section 71 of the Commercial Law).

Legal assessment

The choice of the method of promulgation is not discretionary: the first channel is always the official publication, and Article 8 is activated only in an exceptional case. The position that an un-promulgated new obligation cannot be demanded to be performed follows from the very logic of the law — until promulgation, the entry-into-force period of the act has not begun to run, since Article 4(3) starts counting the period from the day following the promulgation event. Reference points of the alternative approach:

• The President of the State or the Speaker of the Saeima promulgates the law by reading it out on a public electronic MASS MEDIUM (Article 8(1)).
• If the public medium is also unavailable, the promulgating authority chooses any other electronic mass medium (Article 8(1)).
• A law so promulgated must subsequently be published without delay in the official publication, indicating the manner and time of promulgation (Article 8(1)).
• Article 8(2) also applies to acts of the President of the State, decisions of the Saeima, and acts of the Cabinet of Ministers and the Prime Minister.
• Libraries and public internet access points provide free access to the official publication and to the consolidated acts (Article 17(3)). The weak point is that the law does not provide for a clear course of action where promulgation has taken place but the website's operation is restored only after a delay of several days, and the new regulation is needed for urgent action. In the field of sanctions, application is unambiguous: an un-promulgated regulation providing for a more severe penalty cannot be applied to an act already committed, engaging the prohibition in Article 11(4) against giving retroactive force to a regulatory act.

[SEKAS] Practically, nothing changes for users and appliers of regulation already in force — Pastars noted that no one "knows the Criminal Law" merely because likumi.lv is unavailable. For active legal subjects, the most significant developments:

• A new act with a specified entry-into-force date that has already been submitted for promulgation will enter into force later — until promulgation, the period does not run.
• For Cabinet of Ministers regulations, the entry-into-force date will shift to the day after actual publication on the website (Article 7(1)).
• A person who, owing to the unavailability, was denied the opportunity to acquaint themselves with an act will have interpretations assessed in their favour.
• For institutions with urgent powers, the new regulation remains inapplicable until promulgation.
• For private-sector undertakings, the suspension of access is not a lawful justification for failing to perform obligations already promulgated — ignorance of a promulgated act is precluded by Article 2(2).

[CITĀTA]

• Cabinet of Ministers regulations enter into force on the day following their promulgation (Article 7 of the law); consequently, the unavailability of the website directly shifts the entry-into-force date.
• In exceptional cases, a law may be promulgated by reading it out on a public electronic mass medium or on another medium of the promulgating authority's choice, and a law so promulgated must be published without delay in the official publication (Article 8).

According to the part of the sanction visible in the source, for acts resulting in the death of two or more persons, imprisonment for a term of up to eight years and deprivation of the right to engage in an occupation for up to ten years are provided.

For multiple offences the court determines sentences separately and aggregates them, as provided by Section 50 of the Criminal Law.

Core issue

The court sentenced the PMLP employee, who left the safe keys accessible to minor children, to two years' imprisonment and 220 hours of community service — a sentence lower than that requested by the prosecution (three years and eight months), and it remains to be assessed whether it will stand. Since the deaths of the two children occurred through negligence, the degree of gravity of the offence is determined by Section 11 of the Criminal Law: a negligent offence with a sanction of imprisonment of up to eight years falls within the category of less serious crimes.

Legal assessment

The defendant's duty derived from the Law on the Circulation of Weapons and norms of Cabinet of Ministers regulations: the permit holder must ensure that other persons cannot gain access to the safe containing the weapon and ammunition. The court's finding — that the keys were left in an unidentified location in the apartment — means a breach of security requirements which became the direct cause of the deaths of both children. The types of punishment are determined by Section 36 of the Criminal Law: the principal punishment here is imprisonment, while the list of supplementary punishments includes confiscation of property, probation supervision, community service, a fine, and restriction of rights. The court chose a combination — two years' imprisonment plus 220 hours of community service — which, within the sanction, is below what the prosecution sought, and its justification will be visible in the reasoning of the judgment, including in the context of the approach of Section 49 of the Criminal Law on the possibility of imposing a lighter type of punishment or a sentence below the minimum threshold. Procedurally, the case was investigated by the Internal Security Bureau, and the part concerning the killings was terminated because both minors who could have been held liable are deceased — under the Criminal Procedure Law this is a circumstance barring criminal proceedings, so only the count concerning violations of weapon-storage rules went to trial. The sources contain no case law involving specifically similar cases, so the justification of the quantum of the sentence can only be assessed within the boundaries of the statutory sanctions rather than by reference to precedent.

Consequences

Practical consequences for the defendant:

• two years' imprisonment as the principal punishment, to be served in accordance with the procedure prescribed by law;
• 220 hours of community service as a supplementary punishment;
• a possible further consequence — deprivation of the right to engage in an occupation or hold an office (the sanction provides for up to seven or ten years depending on the qualification), which the court could have imposed on the PMLP employee;
• he will not be able to retain the permits for the storage of the weapon and ammunition in the future, as a person with a criminal record does not satisfy the permit requirements under the Law on the Circulation of Weapons.

The prosecution must decide whether to file an appeal: the prosecutor will review the full reasoning of the judgment and, if she considers that the two-year sentence is not proportionate to the grave consequences (the deaths of two children), she will request a more severe sentence, citing the upper limit of the sanction of up to eight years. The judgment enters into force only after the appellate instance's decision, so the final sentence may still change in either direction.