What happened
Estonia has drafted legislative amendments to allow individuals to register specific codes for AI agents, distinguishing their actions from those performed by software. The proposal, reported by ERR News, has faced significant opposition from Cybernetica, the Estonian Association of Information Technology and Telecommunications, and other legal and technical experts. Critics argue the bill is insufficiently developed, contains contradictions, and fails to mandate security protections comparable to Estonia's existing digital identity systems. The Ministry of Economy and Industry stated that the bill is still under review by working groups and may be revised before submission to the parliament in early November.
Estonia has prepared legislative amendments that would allow individuals to register special codes for AI agents. According to ERR News, the proposal aims to distinguish between actions taken by a person and those performed by an on their behalf in private or public information systems. The Ministry of Economy and Industry, led by Liina Vahtras, clarified that the state does not plan to grant AI agents a separate digital identity. Instead, the system would involve a centralized database where a person registers an 'agent code' to verify which agent is acting on their behalf.
The initial scope of the bill was narrowed; authorities abandoned the idea of allowing companies to register agents or permitting one person to have multiple agents. In the first stage, an individual would be allowed to register only one agent. The bill is planned to be submitted to the Riigikogu, Estonia's parliament, in early November. However, the legislative process has faced hurdles, as no ministry had approved the bill by the deadline, with only the State Chancellery giving its approval.
The proposal has drawn sharp criticism from technology companies and legal experts. Cybernetica, a company involved in creating Estonia's e-government infrastructure, submitted 11 pages of comments arguing that the document contains contradictions and may be dangerous. Arne Ansper, a development manager at Cybernetica, stated that simple registration is insufficient and that agents require reliable authentication and signing mechanisms with protection levels comparable to Estonia's ID cards, Mobile-ID, or Smart-ID. He warned that granting agents broad powers with lower security standards would weaken overall digital security.
The Estonian Association of Information Technology and Telecommunications also called for the bill not to be advanced in its current form. President Ats Albre highlighted uncertainty regarding liability when an agent submits user data to state authorities, asserting that ultimate responsibility should remain with the person. Vahtras acknowledged the concerns, noting that legal, communications, and technical working groups are operating in parallel and that the initiative may still be revised.
Why it matters
This legislative effort represents a concrete attempt to integrate autonomous AI agents into a national digital identity framework, a critical step for countries relying on e-governance. The criticism highlights a significant gap in current regulatory approaches: the tension between enabling agent autonomy and ensuring robust authentication and liability. If enacted without the recommended security upgrades, the system could weaken the overall digital security posture of the state. The debate also clarifies that the state does not intend to grant AI agents independent legal personhood, keeping ultimate responsibility with the human user, which is a crucial precedent for global AI policy discussions.
This development is significant because it addresses the regulatory vacuum surrounding autonomous AI agents in a jurisdiction heavily dependent on digital governance. Estonia's e-government system is a global model, and its approach to integrating AI agents will likely influence other nations. The core issue is not just registration, but the security architecture required to trust agent actions. Critics argue that without authentication mechanisms equivalent to human digital IDs, the system creates a security loophole.
The distinction between a chatbot and an is central to this policy. As noted in the report, agents independently seek ways to complete tasks, such as handling tax returns or analyzing bank accounts. This autonomy increases the risk if security is not robust. The debate over liability is also crucial; by keeping responsibility with the human user, the state avoids creating new legal entities but places a heavy burden on users to monitor their agents' actions.
The involvement of Cybernetica, a key player in Estonia's digital infrastructure, lends to the technical criticisms. Their insistence on high-level authentication suggests that the current bill may be technically inadequate for a secure digital society. This could lead to a delay or significant revision of the bill, setting a precedent for how other countries might approach regulation.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').An agent must create a draft calendar event for Tuesday at 2 p.m. Which evidence would establish the requested result?
What to watch next
Monitor the final text of the bill submitted to the Riigikogu in early November to see if the security and liability concerns raised by Cybernetica and the IT association are addressed. Watch for reactions from other EU member states regarding the potential use of agent codes in cross-border digital services. Additionally, observe whether the Ministry of Economy and Industry revises the proposal to include mandatory authentication standards similar to Mobile-ID or Smart-ID before the legislative process advances.
The primary next step is the submission of the bill to the Riigikogu in early November. The final text will reveal whether the government has incorporated the security recommendations from Cybernetica and the IT association. Specifically, look for clauses mandating strong authentication and signing mechanisms for agent codes.
Monitor the reactions from the European Union and other international bodies. If Estonia proceeds with a flawed security framework, it could face criticism or need to align with broader EU AI regulations. Conversely, if they implement robust standards, it could become a model for global governance.
Watch for any public statements from the Ministry of Economy and Industry regarding the outcome of the working groups. If the bill is significantly revised, it may delay the legislative timeline. Additionally, observe whether other countries or tech companies respond to Estonia's approach, potentially leading to a broader discussion on identity and liability.