What Estonia is actually building
On 23 September 2026, e-Estonia described a separate digital identity, an "agent code", linked to the person who authorises an AI agent. One person could use the code with several agents. A service would see that a machine, not the person, is acting. Permissions could be limited, monitored and revoked. The article says plainly that the code "would not make an AI a citizen, a company or a legal person."
The timetable is short. Legal analysis and draft legislation were due in September. Technical development and testing run through October and November, and a pilot with selected use cases and partners is planned for December 2026. Early examples include summarising health test results, analysing bank statements and preparing invoice payments. The first stage covers natural persons, including e-residents. Legal persons and cross-border recognition still need analysis. e-Estonia itself concedes the proposal "is not a finished product."
The idea began as politics. On 17 June 2026, the Eesti.ai advisory board agreed to build "AI ID codes", and Prime Minister Kristen Michal backed the proposal. The government's stated aim was agents with limited, controllable powers, such as view-only access, preparing a document, or staying under a financial cap, instead of users handing assistants full access to their rights and data.
The strongest case for the scheme
The case for a dedicated agent credential is practical. Today a person who wants an assistant to read their bank statements or prepare an invoice has two bad options. They can share their own credentials, which gives the assistant everything they can do. Or they can refuse and get no automation. A separate, revocable credential that shows a machine is acting and carries only the delegated rights is a better security design. e-Estonia points to LHV's beta as a parallel, with read-only access, customer consent, revocation and a 30-day expiry.
Justice and Digital Affairs Minister Liisa Pakosta made the accountability case in July: "The human remains responsible," and the code "must ultimately make it possible to identify the responsible human being." She also argued that overseeing every agent is unrealistic, so authority should be limited to what a task needs. That is proportionate, task-scoped regulation, and it is the right instinct.
The criticism is partly about branding
The loudest objection concerns the word "identity." Anni Lehari, who leads the Information System Authority's Aruait project, told ERR that agents will not actually receive personal identification codes. She called the first announcement a communications move, saying what matters is that an agent can be linked to the person it acts for. The personal code, she said, is "a very strong instrument of trust underpinning the digital state."
Critics reported by ERR are sharper. Attorney Peeter P. Mõtsküla wrote that AI agents "need collars, not passports." Paloma Krõõt Tupay, a University of Tartu associate professor of constitutional law, and attorney Paul Keres told Postimees that the idea is a pointless distraction. A University of Tartu AI professor, Meelis Kull, found the codes sensible for showing whose behalf an agent acts on, but warned that "identity itself does not protect against mistakes."
On the narrow point, the critics have a case. A credential tells a counterparty who authorised an agent. It does not tell them whether the agent behaved competently or whether the human should bear the loss when it did not. Two contradictory messages, "first digital IDs for AI" and "no ID codes for AI," within three months also cost the project credibility it needs for a pilot.
Where the real risk sits
The design, though, is closer to a delegation framework than a passport. The Aruait project, a Reason Reserve initiative at the Information System Authority with a €1 million budget running from May 2026 to April 2028, frames the work as verifying whom an agent represents, defining responsibilities and making actions traceable. It also notes that permission to retrieve information does not automatically cover performing an action. That distinction is what matters, and it should be written into law, not left to implementers.
Three questions will decide whether this helps or hinders.
- Liability allocation. "The human remains responsible" is a clean principle. It becomes harsh if a consumer is liable for an agent's action that exceeded or misread the delegated scope because a vendor's model erred. Rules need to address vendor and provider responsibility, or the scheme will push all risk onto the least-resourced party.
- Scope of delegation. Read-only access is easy to bound. Preparing a payment, or acting within a spending cap, is not. The sensible default is that anything with legal or financial effect requires a human signature, which Aruait's fourth work area also lists as something to test.
- Openness. Aruait's stated aim includes avoiding dependence on foreign proprietary solutions. Credentials and verification should rest on open standards so that small developers and cross-border e-residents can build agents without negotiating access to a closed system.
A pro-innovation reading
Estonia has an advantage most governments lack: a mature identity and data-exchange stack, and a public used to digital services. A pilot in December, with limited use cases and revocable permissions, is the right way to learn. It is far better than a broad statute written before anyone has seen how agents behave in real transactions.
What Estonia should avoid is letting the credential become a licensing gate. If every agent must be registered or approved by the state before it can act for a user, the scheme turns a user-protective delegation tool into a permission regime that favours incumbents. The better model is user-controlled delegation: anyone can build an agent, and the credential merely records the scope the user chose.
The critics are right that rhetoric matters. The government should drop the "ID for AI" framing, call the product what it is, a delegation credential for people and organisations, and publish the liability rules alongside the pilot. If it does, the lawyers' objection loses most of its force, and other countries get a usable template.