Estonia is testing advanced AI on health data without letting the data leave

Metrosert, the state-owned national applied research centre, agreed with the French-American company Owkin to evaluate how its K Pro research platform could support work on Estonian health data. The first phase covers selected health-data cohorts, with oncology as the opening focus, drawing on linked clinical records, molecular data, medical imaging and treatment outcomes.

The design constraint is the interesting part. Approved researchers get to use advanced biomedical AI without the protected health information leaving the national environment built to govern it. Mart Toots, who heads the health data unit, framed it as testing advanced models on anonymised health data to see whether research can move faster. Owkin’s chief executive pointed to Estonia’s existing digital foundations as the reason it is possible here.

Why a company outside healthcare should read this

Nearly every AI project we work on hits the same wall, usually in the second meeting. Someone asks where the data goes, and the project stops while a lawyer thinks about it. That question has blocked more useful work in Estonian companies than any technical limit.

What Metrosert and Owkin are testing is the answer at national scale: bring the model to the data instead of sending the data to the model. Keep the sensitive material inside an environment you control, let the analysis run there, and take out results rather than records.

You can run the same pattern at company scale, and most firms have more options than they realise.

• ✳Sort your data by what actually cannot leave, which is usually a smaller set than the first conversation suggests
• ✳For that set, look at processing inside your own tenant or a regional deployment, rather than abandoning the use case
• ✳Check what your existing contracts already permit, because enterprise terms often differ sharply from the consumer version of the same product
• ✳Separate the real constraint from the uncomfortable one, since not wanting a vendor to see your pricing is a different problem from a legal prohibition

The wider point

Estonia is positioning itself as the place where sensitive-data AI gets tested properly, which fits a country whose health and population registers are already linked. For companies here, that means the compliance-friendly pattern will be well documented and locally supported. Worth knowing before you shelve a project on data-residency grounds.