Estonia is preparing legislation to let people register a code for AI agents acting on their behalf, but the proposal has drawn objections from technology, legal and data-protection bodies. The central dispute is whether a register can identify who is responsible without giving agents secure authentication to act safely.
Watch Desk analysis
What happened
The proposal would initially let private individuals register one agent each. The agent would not receive a separate identity: a code would help public and private services identify whose behalf it was acting on, with the information held in a central database. Estonia’s economic affairs minister, Liina Vahtras, said registration would be optional and create no obligations for individuals or service providers.
ERR reports that Cybernetica, which helped build Estonia’s e-government infrastructure, urged the government not to adopt the bill in its current form. It said the text was deficient and contradictory, and warned that registration without secure authentication or signing tools could weaken security if users gave agents broad permissions. The Estonian Association of Information Technology and Telecommunications also called for changes, including clearer responsibility when an agent acts for someone. ERR says no ministry approved the bill by the deadline; the government hopes to send it to parliament by early November and plans further revisions.
Why it matters
An agent that can handle tax returns, bank information or purchases is doing more than producing an answer in a chat window. The practical questions are who authorised its actions, how a service verifies them, and who answers when something goes wrong. Estonia’s plan puts those questions into legislation before the technical design is settled, which is precisely what critics say is the wrong order.
Our read
The useful idea here is traceability: services should be able to tell when software is acting for a person. But a registry is not the same thing as secure proof of authorisation. If the law gets ahead of the authentication system, the code risks becoming a label on an important problem rather than a solution to it.
What to watch
- Whether Estonia revises the bill before sending it to parliament.
- What authentication and signing method would let agents act securely.
- How the final rules assign responsibility when an agent makes a mistake.
Discussion spark: Should governments create legal frameworks for AI agents before the technical safeguards are ready, or wait until secure authentication and responsibility rules are settled?
Sources and evidence
- Source update (26 October 2026, 07:16 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.