Estonia's government wants to be the first country with an official identifier for AI agents. Its draft bill is now being criticised by the engineers who built the state's digital infrastructure. The Ministry of Economic Affairs hopes to send the amendments to the Riigikogu by early November. ERR News reported on 26 October 2026 that Cybernetica, the Data Protection Inspectorate, the Competition Authority and the ITL industry association all object to the draft.
What the bill would do
The bill would let individuals register an optional "agent code" in a central database showing which agent acts for whom, so that systems can tell whether a person or their agent is acting. According to ERR, an earlier version let companies register agents and let one person register several. That was dropped. Now only private individuals may register, with one agent each. Agents do not get identities of their own.
The idea traces to 17 June 2026. On that date the Government Office announced that the Eesti.ai advisory board, set up on Prime Minister Kristen Michal's initiative, had agreed to pursue "AI ID codes." The stated goal was limited, controllable powers for agents. Permissions might be as narrow as view-only access, preparing a document, drawing up a payment, or staying within a financial limit. Michal said it must be clear "who is acting on whose behalf with what rights, and who is ultimately responsible."
The case for the registry
The strongest argument for the bill is practical. People already use agents to file tax returns, compare bank balances and mobile plans, and buy airline tickets, as Economic Affairs Minister Liina Vahtras told ERR. Today an agent usually works by borrowing the user's own credentials. That gives it full access to a person's rights and data, and a service cannot tell human from machine. A scoped, auditable identifier is a sensible response, and Estonia's digital state was built on exactly that kind of trust infrastructure. Vahtras also says registration creates no obligations for anyone, that nothing happens if the technical solution proves unworkable, and that costs to the state are minimal. An optional, low-cost experiment is the proportionate end of the regulatory spectrum, and the ministry deserves credit for narrowing the scope.
Why the critics have a point
The objections are about sequence and substance, not hostility to innovation. Cybernetica, which helped build Estonia's e-government infrastructure, submitted 11 pages of feedback. It calls the bill deficient and contradictory, says it would not meet its goals, and recommends against approving it in its current form. Development manager Arne Ansper argues that agents need authentication comparable to ID cards, Mobile-ID or Smart-ID, and that legislating before the technology exists is a mistake.
That is a serious engineering claim. A registry entry that says "this code belongs to this person" proves nothing about who is presenting the code. Without strong authentication, a registered code could become a bearer token that anyone can copy. The database would then hold a list of people and the identifiers of the agents acting for them. A central register of that kind is a target, and it is the sort of dataset the Data Protection Inspectorate exists to question.
ITL president Ats Albre raised the second gap, which is responsibility. He says it is unclear who answers for what an agent does, and that the person must remain liable. If liability already sits with the user, the code adds little legal clarity. If the code is meant to shift or share liability, the draft has to say so. Neither the June announcement nor the reporting resolves this. Decrypt noted that Michal gave no start date and no detail on liability for costly agent errors.
Process is part of the problem
According to ERR, none of the ministries approved the bill by the consultation deadline. Only the Government Office did. Vahtras aims to amend the law by the end of the year and rejects restarting the drafting, arguing that legislation holds back innovation. Some experts want a restart.
The tension is real, but a short timeline is a weak reason to skip the hard questions. A law passed first and fixed later is also a cost to innovators. Developers building agents for Estonian services would have to guess how a not-yet-specified authentication layer will work, and what a registered code legally means.
A narrower path
The broader European context argues for patience. Under Regulation (EU) 2024/1183, member states must provide EU Digital Identity Wallets to citizens by the end of 2026. Estonia will soon have a new federated identity layer. Any agent identifier that does not plug into it, or into the existing eID methods, risks building a parallel system.
A more proportionate design would be:
- Start with a delegation mechanism built on existing strong authentication, where a person grants a named agent scoped, revocable permissions that a service can verify.
- Say plainly that the user stays liable unless a later law says otherwise, as ITL asks.
- Pilot with willing public and private services before writing registry rules into statute.
- Publish the data-protection design for the central register before the Riigikogu votes.
Estonia is right that agents need an accountable way to act. A voluntary registry is a light-touch idea. But the criticism is that the draft names the problem without supplying the authentication or the liability rule that would solve it. The Riigikogu should treat the objections from the engineers who built the system as a reason to fix the draft, not to drop the idea.