Editor’s Note: Estonia’s Ministry of Economic Affairs and Communications circulated a two-page bill in October that would let Estonian citizens, residents and e-residents register a “digital identity,” a permanent code that software could use when acting for them, in a state database controlled by the Information System Authority. Minister Liina Vahtras calls it a voluntary agent code that creates no obligation for anyone. The Data Protection Inspectorate replied Oct. 22 that registering the link between a code and a person would not prove an agent was authorized to perform a specific act or that the act matched the person’s will. Cybernetica, a company that markets authentication services, warned in an 11-page filing that the draft could be read to let software act on the identifier alone. By the Oct. 22 deadline only the Government Office had explicitly approved and no ministry had responded, a silence Estonia’s government rules ordinarily treat as approval.

For cybersecurity, privacy, compliance and eDiscovery professionals, the dispute shows that proof of an agent’s conduct could depend on service, platform and deployer logs rather than a registry entry. If the bill heads to parliament in early November, watch whether planned revisions settle what a registration would prove about an agent’s authority.


Content Assessment: Estonia's AI agent register would link a code to a person, and state watchdogs ask what that proves

Information - 93%
Insight - 93%
Relevance - 91%
Objectivity - 90%
Authority - 92%

92%

Excellent

A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Estonia's AI agent register would link a code to a person, and state watchdogs ask what that proves."


Industry News – Artificial Intelligence Beat

Estonia’s AI agent register would link a code to a person, and state watchdogs ask what that proves

ComplexDiscovery Staff

Estonia’s economy ministry wants a register of codes for AI agents acting for a person, but the country’s data protection regulator says registration alone would not prove an agent was authorized to perform a specific act.

The Data Protection Inspectorate filed that objection Oct. 22, six days after an 11-page submission from Cybernetica, an information technology company that Estonian public broadcaster ERR says “helped build Estonia’s e-government infrastructure.” Cybernetica told the ministry that passing the bill as drafted would be dangerous. It urged ministries not to approve the draft as written.



What the draft would actually record

Both objections target a bill that runs two pages. Liina Vahtras, the minister of economic affairs and industry at the Ministry of Economic Affairs and Communications, circulated the Oct. 2 draft for approval in early October. It amends the section of the Public Information Act that governs the state database for data consents and mandate management, with the Information System Authority as its controller. The amendment adds a third function to that database: letting a natural person register a “digital identity,” end the registration and see a record of both.

The draft defines that digital identity as a permanent and unique identifier that a software solution can use to plan or carry out actions for the person who registered it. Estonian citizens and the categories of residents listed in the Population Register Act may register, and so may anyone holding a valid Estonian e-resident digital ID card. The database would hold the registrant’s name, personal identification code and any data on restricted legal capacity, and it would keep those records for 10 years after a registration ends.

Most of the policy sits in the explanatory memorandum rather than the text. The memorandum says actions taken through a digital identity are treated as the person’s own and that the person remains responsible for them. It describes the registration as having an informative meaning while still allowing the link to a person to be established, and it says no data is collected about the software acting under the identity. It also states that the registration is neither a means of electronic identification nor an electronic signature.

Vahtras describes the result more plainly. “We are creating an opportunity for people to register an additional code for themselves, which we call an agent code,” she told ERR News. The code, she said, would let people using an agent tell their own actions apart from those of the software working for them. ERR reported that an earlier plan to let companies register agents, and to let one person register several, was dropped, leaving one agent per private individual at first. The draft text itself uses the singular and sets no numeric cap on registrations, a gap raised by the Insolvency Service, an independent state supervisory body housed in the Estonian Competition Authority.

The e-resident clause extends the register beyond Estonia’s residents. The Insolvency Service’s letter puts the number of e-residents at over 144,000 from 187 countries, citing the program’s own figures, though it does not say how many of them hold the valid digital ID card the bill requires. According to the memorandum, the draft grew out of legal and technical working groups formed by the e-Residency program’s team, and Vahtras led that program before her move to the ministry was announced in September.

An approval round answered mostly by silence

Her ministry then put the draft on a short clock. Vahtras signed the cover letter Oct. 7, asking for responses within 10 working days because of urgency, and the approval round opened Oct. 8 in the government’s draft legislation information system, known as EIS, with a deadline of 11:59 p.m. Oct. 22. Ten ministries and the Government Office were listed as required approvers. By that deadline, only the Government Office had approved the draft, and no ministry had responded. ERR’s Oct. 26 report said “none of the ministries approved the bill by the deadline” and that the Government Office “was the only institution to do so.”

That describes the explicit responses, not the procedural result. Under the government’s rules of procedure, a consulted body that neither approves a draft nor gives a reasoned refusal by the deadline is deemed to have approved it. Each silent ministry would ordinarily be treated as having approved, absent an extension or another applicable exception, and EIS records none of them as having refused. Two have since answered on the record: the Ministry of Culture approved with comments Oct. 27, and the Ministry of Finance did the same Oct. 28. As of Oct. 28, the other eight ministries had no recorded response.

ERR also reported that the goal is for the amendments to reach the Riigikogu, Estonia’s parliament, by early November. Vahtras said the legal work was prioritized because the project had been given a very tight deadline and the aim is to have the statute changed before the year is out. She also said the ministry intends to rework the bill.

Why Cybernetica wants authentication before registration

Cybernetica made its case for reworking the bill at length. Its filing, dated Oct. 16 and signed by Arne Ansper as a management board member and chief technology officer, opens with vocabulary. It argues that “digital identity” already refers to ID cards, Mobile-ID and Smart-ID in Estonia’s e-state, and that the memorandum uses the same term for both a program and the identifier attached to it.

The substantive objections follow from there. The filing says the overall solution the law is meant to support has not been described and no authentication protocol has been chosen, and that depending on the protocol a central register may not be needed at all. It warns that the draft definition could be read to let software act for a person by presenting the identifier alone. It compares that reading to the U.S. practice of treating knowledge of a Social Security number as enough to act for someone, which it calls a well-known security problem.

Ansper made the same point to ERR. “There has been talk of registering agents, but registration alone gives us nothing if we do not have a strong authentication or signing tool to provide to that agent,” he said. The security level, he added, must be equivalent to what ID cards, Mobile-ID and Smart-ID provide today.

The filing also recalls the Smart-ID fraud wave of nearly a year and a half earlier, when attackers manipulated people into creating accounts tied to devices the attackers held. A more complex mechanism, it warns, could be abused the same way. It says a central check service would become one more place that collects information on which systems people use. It faults the memorandum for passing quickly over eIDAS, the EU regulation on electronic identification and trust services, and for ignoring its 2024 revision, known as eIDAS 2.0. Cybernetica is not a disinterested party in how agent authentication gets built. Its website markets authentication and digital-signing services and says its SplitKey technology has been used with the Smart-ID service since 2017. The commercial register lists Ansper as one of the company’s two beneficial owners, through indirect ownership. Its filing also argues, however, that the register as drafted may not be needed at all.

State watchdogs ask what an entry would prove

The Data Protection Inspectorate came at the bill from a different side, asking what a registration would prove. Its letter, signed by Director General Pille Lehis, notes that the memorandum calls the registration informative while also treating the identity’s actions as the person’s own. Registering the link between an identity and a person, the inspectorate wrote, does not prove that the identity was authorized to perform a specific act or that the act matched the person’s will.

The inspectorate wants the law itself to say whether a register entry proves only that link or carries other legal effects. It urged the ministry to avoid wording under which every act of a digital identity counts as the person’s own without further conditions. It sought a reasoned basis for the 10-year retention period. It also questioned how an old registration could later prove that a specific act was performed, or tie that act to a person, when the database stores no data about individual acts. On access, it asked who could query the register, whether queries would be authenticated and logged, and how automated mass queries would be limited.

A second state body went further. The Insolvency Service wrote Oct. 16 that it does not support the bill because its risks and effects on Estonia have not been assessed. The letter, signed by its head, Signe Viimsalu, notes that attribution and liability appear only in the memorandum and not in the draft text, and that the draft sets no cap on registrations per person, no supervision and no sanctions. It asked how consumer dispute panels, bailiffs, notaries, police, bankruptcy trustees, creditors and the service itself would establish who actually decided or represented a company when the memorandum says no data on the software is collected. It added that an e-resident can register from abroad without the Estonian contact person the law requires of companies with a foreign address.

Industry has pushed back as well. The Estonian Association of Information Technology and Telecommunications, known as ITL, asked the ministry not to advance the bill as drafted, ERR reported. Its president, Ats Albre, told ERR the government’s course is right but the association’s feedback has to be heard, and he named responsibility as one important issue. He offered the example of an entrepreneur who asks an agent to file data with Statistics Estonia. In that case, Albre said, it is “not yet sufficiently clear who is responsible for what,” and ITL wants “to be certain that ultimately the person themselves remains responsible.” He told ERR that association members would meet the minister the week of Nov. 2.

The ministry’s case for moving first

Vahtras answered that criticism by saying the legal and technical work are running in parallel. A legal working group was set up first, she told ERR, and communications and technical groups began work alongside it. “We do not yet know exactly what the technical solution will be,” she said. She argued that legislative change often slows major innovation, and that amending the statute first means a technical solution, once built, will not have to wait on the statute book.

She also framed the risk as contained. “It creates no obligation for anyone, not for any service provider or any individual,” she said. If the technical working group finds that agents cannot be given their own authentication and signing functions, she said, “then nothing happens as a result of the law having been amended.”

Where attribution evidence would actually live

Whether or not anything happens under the law, the dispute raises a question for legal and compliance teams that does not depend on the bill’s fate. The memorandum weighed four models, including a new legal category of electronic persons and limited legal capacity for the identity, and chose to treat the digital identity as a technical tool whose acts are attributed to its user. It describes that choice as consistent with existing law and with the Model Law on Automated Contracting from the United Nations Commission on International Trade Law. On paper, then, the memorandum answers who is responsible: the user. The two state bodies and the industry association are asking whether the law itself says so, and how anyone would prove it.

The draft lists what the database would hold: the registrant’s name, personal identification code and legal capacity data. Nothing on that list records which software used the identifier, what it was told to do or how it authenticated, and the memorandum confirms that no data on the software is collected. Evidence of what an agent did could include records held by the services it touched, such as session logs, authentication records and whatever flags they build to separate a person from an agent. Agent platforms and the organizations that deploy agents may hold relevant records too. Cybernetica’s filing points to the Tax and Customs Board, whose system it says already lets users create sub-users and delegate rights to them, as the kind of mechanism needed nationwide.

Practitioners advising clients that deploy agents can act on that now. Identify and preserve available delegation settings, authentication events and action logs associated with an agent’s activity. Then confirm whether the services an agent used record its sessions separately from human ones, because those records, where they exist and are intact, could help establish what an agent did in a way a registry line cannot.

The bill’s timetable runs alongside an international showcase for the same theme. The Tallinn Digital Summit, held under the banner “How to Thrive in the Agentic Era?”, opens Nov. 5 at the National Library of Estonia. Estonia is also hearing a separate push from Justice and Digital Affairs Minister Liisa-Ly Pakosta, who on Oct. 21 outlined proposals for international AI rules, including treating the most harmful impacts of AI as crimes against humanity.

If the bill heads to the Riigikogu in early November, the question to watch is whether the ministry’s planned revisions answer the inspectorate’s objection. When a registration cannot show that an agent was authorized to perform a specific act, or that the act matched the person’s will, what record will a court accept when a person says the agent acted on its own?



News Sources



Assisted by GAI and LLM Technologies

Additional reading

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

 

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know, and we will make our response to you a priority.

ComplexDiscovery OÜ is an independent digital publication and research organization based in Tallinn, Estonia. ComplexDiscovery covers cybersecurity, data privacy, regulatory compliance, and eDiscovery, with reporting that connects legal and business technology developments—including high-growth startup trends—to international business, policy, and global security dynamics. Focusing on technology and risk issues shaped by cross-border regulation and geopolitical complexity, ComplexDiscovery delivers editorial coverage, original analysis, and curated briefings for a global audience of legal, compliance, security, and technology professionals. Learn more at ComplexDiscovery.com.

 

Generative Artificial Intelligence and Large Language Model Use

ComplexDiscovery OÜ recognizes the value of GAI and LLM tools in streamlining content creation processes and enhancing the overall quality of its research, writing, and editing efforts. To this end, ComplexDiscovery OÜ regularly employs GAI tools, including ChatGPT, Claude, Gemini, Grammarly, Midjourney, and Perplexity, to assist, augment, and accelerate the development and publication of both new and revised content in posts and pages published (initiated in late 2022).