Tallinn Digital Summit 2026 puts the agentic state to the test

Editor’s Note: Estonia hosts the ninth Tallinn Digital Summit on Nov. 5 and 6 around one question: how to thrive in the agentic era. The program pairs Estonian ministers, OECD Secretary-General Mathias Cormann and European Commissioner Ekaterina Zaharieva with AI safety researchers and security leaders. Sessions include a live cyber range demonstration of AI assurance, the promised unveiling of a doctrine for asymmetric cyber defense built on a “Minimum Viable State,” and a debate over whether a vendor-supplied “sovereign” technology stack counts as sovereignty.

For cybersecurity, information governance and eDiscovery professionals, the host country supplies a sharper signal. A timetable published in September calls for a December pilot of Estonian digital identities for AI agents, under which a receiving service could recognize when a machine, not a person, is acting. Officials describe the plan in different terms, and legal critics in Estonian media have questioned it. Either way, the line between machine and human action bears directly on how agent activity is logged and attributed.

ComplexDiscovery will attend and report from Tallinn for the third consecutive year. ComplexDiscovery OÜ is an Estonian private limited company, and two staff members are e-residents. Watch the doctrine, the agent code pilot and the sovereignty debate.

Industry News – Technology Beat

Tallinn Digital Summit 2026 puts the agentic state to the test

ComplexDiscovery Staff

Estonia will convene ministers, EU and OECD leaders, and AI researchers in Tallinn on Nov. 5 and 6 for the ninth Tallinn Digital Summit, built on one question: how to thrive in the agentic era.

The host country is not asking in the abstract. A timetable published in September calls for a December pilot of Estonian digital identities for AI agents, and the country’s digital affairs minister is calling for “an IAEA for artificial intelligence.”

ComplexDiscovery will attend and report from the summit as accredited media for the third consecutive year, following its coverage of the 2024 and 2025 editions. ComplexDiscovery OÜ is a private limited company registered in Estonia, and two ComplexDiscovery staff members are e-residents of Estonia, a group the first stage of that AI-agent identity plan would include. What follows is a guide to the program, the people and the country behind it.

Three pillars and an invitation-only room

The Tallinn-based International Centre for Defence and Security (ICDS) organizes the summit with Estonia’s Ministry of Justice and Digital Affairs, Ministry of Foreign Affairs, Ministry of Economic Affairs and Communications and Government Office. ICDS was founded in 2006 by decision of the Estonian government as a foundation, and it describes itself as an independent, nonprofit think tank. Prime Minister Kristen Michal hosts the event at the National Library of Estonia.

Organizers expect 1,000 delegates from over 70 countries, according to an Oct. 6 announcement, and attendance remains by invitation. For the first time, the summit is also offering a free Future Delegate Pass to selected university students, who must attend both days in person and participate actively.

The 2026 theme carries three headline pillars: competitiveness, security and efficiency. The organizers’ 2026 concept describes the moment as one of “rupture, not transition,” with the war in Ukraine unresolved and technological change moving faster than governments can respond. It groups the discussion into three challenge areas: new democratic formats and partnerships for the agentic era, defense and digital resilience amid geopolitical tensions, and AI applied to governance and competitiveness.

The concept also concedes that, for most organizations and even more governments, AI has yet to deliver substantial financial gains. It calls narrowing the distance between AI’s promised and delivered results a priority.

Who takes the stage

That task falls first to a lineup of officials. Michal opens the first day, followed by keynotes from Ekaterina Zaharieva, the European commissioner for startups, research and innovation, and OECD Secretary-General Mathias Cormann, who is scheduled to present key findings from the OECD’s digital economy and society outlook. Cormann then joins Estonian State Secretary Keit Kasemets for a fireside chat, and Foreign Minister Margus Tsahkna takes part in a late-morning conversation on digital sovereignty and trusted partnerships. Liisa-Ly Pakosta, Estonia’s minister of justice and digital affairs, joins a Digital Nations panel that afternoon and gives the opening address on the second day.

The published speaker list mixes government officials with AI safety researchers, security leaders, investors and journalists. It includes Stuart Russell of the University of California, Berkeley; Jaan Tallinn of the Future of Life Institute; Mozilla President Mark Surman; Susan Nesbitt, listed with Cantellus Group and as an OpenAI red team member; Freddy Dezeure, Microsoft’s deputy chief information security officer for Europe; and Sasha Rubel of Amazon Web Services. Former Estonian President Toomas Hendrik Ilves also appears, as do Vahur Verte, a state prosecutor with Estonia’s Prosecutor’s Office, and Kian Vesteinsson, deputy director for research at Freedom House.

The Oct. 6 update named further participants, including Anne Le Hénanff, France’s minister for artificial intelligence and digital affairs; Nest AI founder Peter Sarlin; and Mohamed Al Kuwaiti, head of cybersecurity for the United Arab Emirates government. The organizers note the agenda remains subject to change.

Sessions where the evidence questions live

Beyond the keynotes, several sessions reach past policy talk and into the daily work of security, governance and discovery teams. On the second morning, “The Tallinn Stress Test” promises a live cyber range demonstration of AI assurance. It will probe two things: how AI can test the security of complex systems, and how an AI system behaves once it is wired into identities, data and tools. The session description frames the aim in terms any investigator would recognize: “identify unexpected behaviour, gather evidence and learn from what happens.” CybExer Technologies has three executives on the speaker list.

A late first-day session on national cyber resilience says it will unveil a doctrine for asymmetric cyber defense. It starts from what the session description calls the “Minimum Viable State,” the few functions a government cannot allow to fail, each paired with a practiced fallback, and it sets one goal: “making every incident non-decisive.” The same afternoon brings a session on fighting cybercrime with AI and digital law, and another asking whether handing a “sovereign” government technology stack to a vendor counts as sovereignty at all.

That sovereignty question is an information governance question in plain clothes, because it decides who controls the cloud, the models and the data behind public services. A separate session on internet freedom adds a darker data point: Freedom House’s Freedom on the Net 2025 report, released in November 2025, recorded a 15th straight year of declining internet freedom worldwide. Freedom House plans to release its 2026 edition Oct. 22, and Vesteinsson, one of its authors, is on the summit’s speaker list.

Practitioners evaluating AI agents can borrow the Stress Test’s premise. The session description argues that a model viewed in isolation reveals only part of its behavior, so a procurement or governance review should watch an agent inside the systems, data stores and permissions it will touch, and should keep the test record as evidence.

Officials set the tone before the doors open

The program’s emphasis on accountable agents echoes what Estonian officials have put on the record in recent months. Pakosta argued in an Oct. 6 post published under her name on the summit’s site that AI needs its own IAEA, an international institution to back global standards. Her proposal has three parts: a global computing solidarity mechanism, a mandatory watermarking standard for AI-generated content from the largest developers, and a worldwide early-warning system for unusual AI behavior and security flaws, modeled on aviation safety reporting. “Trust and human rights are not constraints on innovation,” wrote Pakosta, whose ministry is one of the summit’s co-organizers.

Closer to home, her government has already moved from argument to design on agent accountability. The Eesti.ai advisory board agreed in June that Estonia will move forward with digital identities for AI agents, and Michal backed the proposal, according to a June 17 government release. Michal said in the release that it “must be clear who is acting on whose behalf with what rights, and who is ultimately responsible.”

The e-Estonia Briefing Centre, which promotes Estonia’s digital government, described the working design Sept. 23. Under the proposal, an “agent code” would be a separate identity linked to the person who authorizes the agent. It would not confer legal personhood, and responsibility would remain with the authorizing person or organization. Its permissions could be narrowed, monitored and withdrawn, and the first stage would focus on natural persons, including e-residents. Registration, authentication, permissions, audit trails and revocation all remained under development, and the timetable published that day called for draft legislation in September, followed by testing in October and November and a December pilot.

“AI agent codes can give AI agents a trusted and accountable digital identity,” Liina Vahtras said in the e-Estonia article. Vahtras headed the e-Residency program from 2023 and has served as Estonia’s minister of economy and industry since Sept. 16, according to her government biography.

Not every official describes the plan in the same terms. Anni Lehari, who leads Aruait, a separate public-sector AI project at the Information System Authority, said in a Sept. 8 ERR News report that agents will not receive personal identification codes, and, as ERR summarized her remarks, characterized the June announcement as a communications tactic. What matters, she said, is that an agent acting for a person can be linked to that person, which is the link the agent-code design already describes. Outside government, reaction has split. ERR noted that two attorneys and a University of Tartu constitutional law scholar had criticized the idea in Estonian media. Meelis Kull, a University of Tartu professor of artificial intelligence, saw more promise, calling identification codes for agents a sensible step because they could help establish on whose behalf an agent is acting. “Identity itself does not protect against mistakes, however,” Kull said. “That is why authorizations must be revocable and responsibility must remain clear even when something goes wrong.”

Kull’s caveat is the one investigators will recognize, and it is where the design matters for eDiscovery. An agent acting under its own code, rather than a borrowed human login, would let the receiving service recognize that a machine, not the person, was acting. The e-Estonia article says that distinction can vanish today when an agent works through a person’s login or a service-specific token. Teams buying agentic tools can ask vendors now whether their agents act under a separate identity, and whether those permissions can be scoped, logged and revoked.

From the song festival to X-Road

Estonia’s confidence in building identity infrastructure, now extended to machines, has roots in how the country rebuilt its state. Estonia first declared independence in February 1918, then lost it to Soviet annexation in 1940 after the Molotov-Ribbentrop Pact, according to Visit Estonia. On Sept. 11, 1988, the Tallinn Song Festival Grounds filled with an estimated 300,000 people for songs and independence speeches, a milestone of what became known as the Singing Revolution. On Aug. 23, 1989, nearly 2 million people across Estonia, Latvia and Lithuania joined hands in the Baltic Way, a chain Visit Estonia puts at 670 kilometers. Estonia’s Supreme Council established de facto independence on Aug. 20, 1991, and this year marks the 35th anniversary of that restoration.

The new state started almost from scratch, and the e-Estonia timeline presents that gap as an opportunity. The Tiger Leap program pushed computers and computer skills into schools in 1996. The X-Road data exchange layer followed in 2001, the mandatory ID card with digital signature in 2002, online voting in 2005 and e-Residency in 2014. In 2017 Estonia approved what it calls the world’s first data embassy, which backs up critical databases in a high-security data center in Luxembourg. For records managers, the arrangement offers a public model of continuity planning at national scale, built, in e-Estonia’s words, for “worst-case scenarios like critical system failures or external threats.”

Culture runs through the AI program, too. The kratt is a figure from Estonian mythology, a servant made of hay or old household odds and ends, and the government adopted it as its metaphor for AI. A 2026 article in the journal Imaginations points to a darker trait in the folklore: left idle, the kratt turns on its master. Its authors, Neda Atanasoski of the University of Maryland and Redi Koobak of the University of Strathclyde, argue that the state’s use of the myth naturalizes a link between technological progress and liberal democracy. In their reading, it also obscures how Silicon Valley capitalism shaped Estonia’s post-socialist transformation. The summit keeps the metaphor in view all the same, naming one of its three stages the Kratt Stage.

The metaphor sits alongside newer programs with plainer names. The AI Leap education initiative, which the e-Estonia timeline presents as Tiger Leap’s successor, began in 2025 with about 20,000 upper-secondary students and 3,000 teachers. Michal launched Eesti.ai on Jan. 27, 2026. “With AI, we can do more work with a higher added value with fewer people and essentially double the value of Estonian people’s work by 2035,” Michal said at the launch.

A small state with a large security voice

Those digital ambitions have long come wrapped in security concerns. In April 2007, politically motivated cyberattacks struck Estonia, and the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) says they served as a wake-up call for other nations and the alliance. Estonia had proposed the center in 2004, after joining NATO, and it was established on May 14, 2008. The center’s Tallinn Manual process produced a first edition in 2013 and the expanded Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations in 2017. Its annual Locked Shields exercise has run since 2010, and the center reports 39 member nations in 2026.

The government’s proposed 2026 state budget, submitted to parliament in September 2025, provided for at least 5 percent of gross domestic product for defense under NATO criteria, plus 0.25 percent of GDP to support Ukraine. Estonia took over the chair of the Nordic-Baltic Eight (NB8) on Jan. 1, 2026. “Nordic-Baltic cooperation is a force multiplier for our shared security, economic strength and political influence,” Tsahkna said when the chairmanship was announced in December. The summit organizers say Estonia also chairs the Digital Nations group this year, and Kaja Kallas, a former Estonian prime minister, now serves as the EU’s high representative and vice president.

What ComplexDiscovery will watch

That security posture frames the program’s AI ambitions, and last year’s summit supplied the template this year’s sessions will test. At the 2025 edition, former Estonian government chief information officer Luukas Ilves and Manuel Kilian of the Global Government Technology Centre Berlin released “The Agentic State,” a vision paper proposing a 12-layer framework for agentic AI across government functions. This year’s program includes a session asking what that idea looks like once it reaches a working public service.

ComplexDiscovery will report on whether the cyber resilience doctrine is published in usable form, what the agent code pilot looks like on paper, and how the sovereignty debate settles between national, regional and vendor-supplied stacks.

If an AI agent acts under its own identity code, who in your organization will own the record that proves what it did, and on whose authority?

News Sources

• Tallinn Digital Summit 2026 (International Centre for Defence and Security)
• about | Discover Digital Leadership Opportunities: Tallinn Digital Summit 2026 (International Centre for Defence and Security, 2026 concept page)
• about | Discover Digital Leadership Opportunities: Tallinn Digital Summit 2026 (International Centre for Defence and Security, summit history page)
• agenda | Discover the Event Schedule: Tallinn Digital Summit 2026 (International Centre for Defence and Security)
• speakers | Explore Speakers Now: Tallinn Digital Summit 2026 (International Centre for Defence and Security)
• One Month to Go: Tallinn Digital Summit 2026 (International Centre for Defence and Security)
• For the first time, Tallinn Digital Summit opens its doors to students: Tallinn Digital Summit 2026 (International Centre for Defence and Security)
• AI needs its own IAEA: Tallinn Digital Summit 2026 (International Centre for Defence and Security)
• Kratt Manifest: Tallinn Digital Summit 2026 (International Centre for Defence and Security)
• Government launched the Eesti.ai initiative together with leading entrepreneurs | Eesti Vabariigi Valitsus (Government of Estonia)
• Prime Minister Michal: Estonia to become first country to create digital identities for AI agents | Eesti Vabariigi Valitsus (Government of Estonia)
• Liina Vahtras | Eesti Vabariigi Valitsus (Government of Estonia)
• Government approved the 2026 state budget | Eesti Vabariigi Valitsus (Government of Estonia)
• Estonia to chair the Nordic-Baltic (NB8) cooperation format as of 1 January 2026 | Välisministeerium (Estonian Ministry of Foreign Affairs)
• About us (NATO Cooperative Cyber Defence Centre of Excellence)
• About: International Centre for Defence and Security (International Centre for Defence and Security)
• EU HR/VP Kaja Kallas at the European Arctic Summit 2026 | EEAS (European External Action Service)
• NEW REPORT: Persistent Authoritarian Repression and Backsliding in Democracies Drive 15th Consecutive Year of Decline in Global Internet Freedom | Freedom House (Freedom House)
• AI agents will not get Estonian ID codes and responsibility will stay with humans | News | ERR (ERR News)
• Last USSR census 30 years ago counted largest-ever number of residents | News | ERR (ERR News)
• Mohamed Al Kuwaiti: Agenda Contributor | World Economic Forum (World Economic Forum)
• Automated Myth and the Postsocialist Digital State: The Imperial Trick of the Kratt AI Initiative in Estonia | Imaginations: Journal of Cross-Cultural Image Studies (Imaginations: Journal of Cross-Cultural Image Studies)
• REPORT LAUNCH: Freedom on the Net 2026 | Freedom House (Freedom House)
• 30 years since the most important Singing Revolution concert (Estonian World)
• Story: e-Estonia (e-Estonia Briefing Centre)
• From e-Residency to agent codes: Estonia´s next digital identity experiment (e-Estonia Briefing Centre)
• AI and the Kratt* momentum: e-Estonia (e-Estonia Briefing Centre)
• How Estonia regained its independence (Visit Estonia)
• Tallinn Digital Summit 2024: Charting a Secure Digital Future Amid Geopolitical Shifts (ComplexDiscovery)
• The Agentic State: A Global Framework for Secure and Accountable AI-Powered Government (ComplexDiscovery)

Assisted by GAI and LLM Technologies

Additional reading

• Nine months across Europe’s tech-sovereignty arc, from Tallinn to London
• The flame and the frontier: how Estonia carries a 1919 victory into a tense 2026
• Estonia aims to be first to give AI agents official digital IDs
• Parliament hits pause on high-risk AI rules and bans nudifier apps
• Europe’s AI labeling rules arrive with a voluntary code and a hard deadline
• AI is becoming an advisor, and it is rewriting how buyers find you
• What marketing confidence actually looks like
• When credibility comes first, capability sells itself: The case for news-led marketing
• The one question that reveals whether your marketing plan is actually a plan
• How Prompt Marketing Is Redefining Thought Leadership In The AI Era
• Raising The Age Ceiling: How AI Is Extending Executive Leadership
• Staying Curious: One Practical Defense Against Creative Burnout
• From Longbows To AI: Lessons In Embracing Technology
• 20 Ways Creative Professionals Battle Burnout And Find Fresh Ideas
• 14 Points For Brands To Consider Before Making Sociopolitical Statements

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.