Estonia used the run-up to the Tallinn Digital Summit, held 5-6 November 2026 at the National Library of Estonia, to put two very different ideas about AI governance on the table. One is a global institution. The other is a small piece of plumbing. The plumbing is the better idea.
A caveat on sourcing: post-event coverage from 8-9 November does not confirm the pilot's launch. What follows rests on a pre-summit preview published 12 October 2026 and on official pages, so whether the proposals were delivered as previewed is unconfirmed.
What was proposed
According to the ComplexDiscovery preview, which paraphrases a 6 October post by Justice and Digital Affairs Minister Liisa-Ly Pakosta, Estonia wants an international institution for AI in the mould of the IAEA. It has three parts: a global computing solidarity mechanism, a mandatory watermarking standard for AI-generated content from the largest developers, and a worldwide early-warning system for unusual AI behaviour and security flaws, modelled on aviation safety reporting. Pakosta is quoted as writing that "trust and human rights are not constraints on innovation."
The same preview describes a separate, domestic track: a December pilot of state-linked digital identities for AI agents. It cites a September timetable and an e-Estonia description of an "agent code" tied to the person who authorises the agent, which would not confer legal personhood.
The strongest case for the global body
The argument for an IAEA-style institution deserves a fair hearing. Frontier AI is built by a handful of firms, its failures cross borders, and no single regulator can see them all. Aviation is the model the preview invokes: shared incident reporting made flying safer because airlines and states pooled information. A computing solidarity mechanism also answers a real worry for small states, that access to compute will decide who benefits. If the risks are global, the thinking goes, the response should be too.
Why the global body is the weaker bet
The analogy strains in three places. First, the IAEA works because nuclear material is scarce, physically trackable and controlled by states. Model weights and software are none of these. Second, mandatory watermarking of AI-generated content is a technical promise that is easy to state and hard to keep. Marks can be stripped or never applied by open-weight models, so a mandate would burden compliant developers while leaving bad actors untouched. It also risks becoming a de facto speech-labelling regime, which is a concern for anyone who values open expression. Third, a body with inspection ambitions and no agreed membership is years from existing. Voluntary incident reporting is the one component that could plausibly start sooner and cost little.
Proportionate regulation starts with a defined harm and a tool that fits. The summit proposals, at least as previewed, start with an institution and look for the harms afterwards.
Why the agent-ID pilot is different
The domestic pilot fits the problem more closely. The question it addresses is concrete: when software acts for a person, who is responsible, and what is it allowed to do? The Government Office announced on 17 June 2026 that the Eesti.ai advisory board had agreed to create digital identities for AI agents so they can act for people, companies or organisations "within clearly defined limits and in a manner that is both verifiable and auditable." That release names the X-Road among the foundations of Estonian digital trust. ERR's report on the plan covers the same announcement.
The infrastructure it would sit on is proven. e-Estonia describes X-Road as open-source data-exchange software serving about 78,000 organisations as indirect users, with more than 3,800 e-services and about 2.2 billion transactions a year. Outgoing data is signed and encrypted, and incoming data is authenticated and logged. Those logs matter: an agent acting through X-Road leaves an audit trail linked to a named human, which is the accountability property that regulators say they want from agentic systems.
The design choice that matters most is the refusal of legal personhood. Keeping responsibility with the human principal avoids a legal fiction in which an agent can be blamed in place of its operator. It extends existing identity and delegation law rather than inventing a new regime.
What to watch
The pilot is not risk-free, and the opposing view has substance. A state-issued agent identity could become a de facto licence: if public services and banks accept only registered agents, unregistered or foreign tools could be shut out, which would cut against open competition. Logging every agent action also creates a rich record of citizens' delegated activity, so retention limits and access controls will matter as much as the identity scheme itself.
Three tests would show whether the pilot is proportionate:
- Voluntary registration. Agents without a state ID should still be able to operate in private markets.
- Narrow scopes. Delegations should be limited by task and time, with easy revocation by the person who granted them.
- Published results. Estonia should report what the December pilot found, including failures, so other states can judge whether to copy it.
Bottom line
Pakosta's instinct that trust and innovation are compatible is right. The way to show it is to ship small, auditable systems on infrastructure with a long record, then let evidence decide what international machinery is worth building. Estonia's agent ID does that. A global AI agency with mandatory watermarking, on the evidence of the preview, does not yet. Policymakers elsewhere should copy the pilot and treat the institutional proposals as a discussion to be earned by results.