Estonia wants to issue codes to AI agents, experts push back

Estonia is preparing a law that would let a person register an "agent code". It is a separate identifier that lets public and private services see that an action is taken not by the person but by an AI agent on their behalf. Back in the summer, as ERR reported, the government said Estonia would become the first country to issue such codes.

What is proposed

The bill was prepared by the Ministry of Economic Affairs and Industry, led by Liina Vahtras. According to ERR, registration is voluntary and creates no obligations for people or services. The agent gets no legal identity of its own, and the agent-to-person link is kept in a central database. The plan started broader, covering companies and several agents per person. Now it covers only private individuals, with one agent each. The government wants to send the amendments to parliament in early November and pass them by the end of the year.

Why it is criticised

Cybernetica, the company behind the foundation of e-Estonia, submitted 11 pages of feedback. In its view the text is contradictory, and adopting it as is would be dangerous. As development manager Arne Ansper told ERR, if agents are not authenticated as strongly as with an ID card or Smart-ID, security will get worse. The law is also being written before the technical solution exists. The IT industry association ITL says the direction is right but opposes the current text: it is unclear who is responsible for an agent's actions. Legal experts, the Data Protection Inspectorate and the Competition Authority are also critical. No ministry approved the bill.

The minister replies that legislation often holds innovation back, so it should change in advance. If the technical solution does not work, registration can be dropped.

The idea itself makes sense: agents already order, pay and sign on our behalf, and services need to know who they are dealing with. The question is the order of steps. Estonia's strength is that its digital signature is trustworthy. If an agent code turns out weaker than Smart-ID, it becomes a new hole rather than protection. Rushing the law ahead of the technology is riskier here than a short delay.

Source: ERR News.