Estonia's AI agent register is heading to parliament. Cybernetica, ITL and two regulators want it rewritten

The Ministry of Economic Affairs and Industry has been drafting a law change since the summer that would let people register an AI agent and give it an agent code. The code goes into a central database where anyone can check on whose behalf a given agent acts. ERR reported on Monday that the ministry aims to send the amendments to the Riigikogu by early November.

The plan has shrunk on the way. It started with private people and companies alike, each able to register several agents. The current draft allows only private individuals, one agent each. Registration is voluntary, and the agent does not get an identity of its own. The code only links the agent to the person behind it.

Who objected, and why

The consultation round went badly. According to ERR, no ministry approved the draft by the deadline; only the Government Office did. Cybernetica sent 11 pages of comments, calling the text deficient and contradictory and adoption in its current form dangerous. Its central point: an agent acting for a person needs authentication as strong as an ID card or Smart-ID, and the draft does not say how that happens.

The Estonian Association of Information Technology and Telecommunications (ITL) asked the ministry not to proceed with this version and pointed to liability: it should be clear that the person, not the agent, answers for what the agent does. The Competition Authority could not support the draft because nobody assessed its economic risks. The Data Protection Inspectorate noted that there is no data protection impact assessment.

Minister Liina Vahtras defends the approach. In the ministry's view the law has to change before a technical solution can be built, registration creates no obligation for anyone, and the cost to the state is minimal. The minister also said the draft will still be revised.

Why a company should care about a register it cannot join

Companies are out of scope for now, so there is nothing to register. The two objections still apply to any business that lets an agent log in somewhere, send an email or prepare a payment. In June the government described the goal as agents with limited, auditable rights, such as viewing data or preparing a document instead of full access to a person's services. Whether or not the law passes, that is a sensible standard for your own agents.

What to do on Monday

• ✳List the agents and automations that act under a real person's account or credentials. Shared passwords and personal tokens in scripts are the first thing to fix
• ✳For each agent, write down which person answers for its actions. If nobody can name that person, the agent should not be running
• ✳Limit each agent to the rights it needs: read but not write, draft but not send, prepare a payment but leave approval to a human
• ✳If your business deals with agents acting for customers, decide how you will check who sent them. The state register will not answer that for companies any time soon
• ✳If you have a view on the draft, send it through ITL or your sector association before the Riigikogu committee stage

The state may need another round to get its agent rules right. Your own rules for agents do not have to wait for it.