An AI agent is not the same as a conversation with ChatGPT or another AI chatbot. While AI provides answers to questions in a conversation, an agent is given a task and can find its own way to complete it.

The agent can be compared to a robotic vacuum cleaner, which tidies a room but is not told exactly how to do it. People are increasingly using AI agents to make their lives easier.

"For example, they file tax returns, have analyses carried out on their bank account balances and also analyze their mobile plans. They have an agent look at their phone bill, for example, to see where they could save money," Minister of Economic Affairs and Industry Liina Vahtras said.

There are also cases where agents have been instructed to look for and buy airline tickets. The user has handed over their credit card details, which poses a potential security risk.

One Estonian e-resident has openly shared how he uses Anthropic's AI platform Claude to conduct business with the Tax and Customs Board and manage bank accounts. He only occasionally enters the necessary codes in Smart-ID.

Vahtras said these cases demonstrate the need for national regulation of AI agents.

The idea for creating identifiers for AI agents came from the IT sector, and have informally been referred to as personal identification codes. Vahtras stressed that agents will not actually be given their own identities.

"We are creating an opportunity for people to register an additional code for themselves, which we call an agent code, so that when they use an agent's assistance in private or public information systems, they can distinguish between themselves and the machine acting on their behalf," she explained.

The codes would be entered into a central database where it would be possible to check which agent is acting on whose behalf. While the initial plan was to allow both individuals and companies to register agents, and for one person to register several agents, this has now been abandoned. Initially, only private individuals will be able to register agents, with one agent per person.

The minister said they will see how this works and then discuss how to move forward.

Cybernetica: Adopting such a bill is dangerous

Although the idea of agent codes came from the IT sector, there are also many critics.

Cybernetica, an information technology company that helped build Estonia's e-government infrastructure, submitted 11 pages of feedback on the bill. It said the text is deficient and contradictory and that insufficient work has gone into its preparation.

Adopting the bill in its current form would not achieve its objectives and would, in the company's assessment, be dangerous. It recommended that the bill should not be approved in its current form.

In fact, none of the ministries approved the bill by the deadline. The Government Office was the only institution to do so.

Speaking to ERR, Cybernetica's development manager Arne Ansper highlighted one important aspect: a security risk arises if an agent does not have the same kind of secure authentication available to Estonian residents through ID cards and their PIN codes.

"This issue has not been addressed at present. There has been talk of registering agents, but registration alone gives us nothing if we do not have a strong authentication or signing tool to provide to that agent. The security level must actually be equivalent to what we currently have with ID cards, Mobile-ID or Smart-ID. If it were lower and someone granted all their authorizations to that tool, we would be lowering the overall level of security," he said.

Ansper stressed that the development principles behind Estonia's e-government system and digital identity have served the country very well, enabled efficient governance and must not be undermined.

He also highlighted that the legislative amendment has been completed before a technological solution has been developed. Ansper said legislation should not be developed in isolation from technology.

However, Vahtras said the work is taking place in parallel.

"The very first working group that was established was the legal working group, but the communications and technical solutions working groups also began operating in parallel. We do not yet know exactly what the technical solution will be, and we want to involve more parties. But in order for us to have at least some basis and opportunity to amend the law by the end of the year, given the very tight deadline we were set for working on this project, this was made a priority," she said.

There has also been considerable criticism from legal experts, the Competition Authority and the Data Protection Inspectorate.

Responsibility is unclear

The Estonian Association of Information Technology and Telecommunications (ITL) also said the bill should not proceed in its current form.

However, speaking to ERR, ITL President Ats Albre said the government is moving in the right direction, but feedback needs to be taken into account.

One important issue is responsibility.

"If, for example, as an entrepreneur you ask an AI agent to submit various data of yours that it has access to to Statistics Estonia, it is not yet sufficiently clear who is responsible for what, and we at ITL would like to be certain that ultimately the person themselves remains responsible," Albre said.

He also drew a parallel with a robot vacuum cleaner.

"If you also have a dog and the dog leaves a mess on the floor and the robot spreads it everywhere, then ultimately you are still responsible. It cannot be that the robot is responsible or the dog is responsible," the association president explained.

Albre said not everything needs to be regulated. Some issues are technological and do not require legislation, and many other experts share this view. Albre said members of the association will meet with the minister next week to discuss the feedback and get on the same page on these issues.

Amid the criticism, the question of why this process needs to be rushed has arisen. Some experts have said the whole bill drafting process should start again. But Vahtras does not agree that work should be abandoned.

"From my previous work experience, I have seen that major innovations are often held back precisely by legislative amendments. For the state to innovate, so that we can quickly develop a technical solution on top of this, the law needs to be amended, and that is precisely why we started with it, so that once we have the technical solution, it will not be held back by legislative amendments," she said.

It is hoped the legislative amendments will reach the Riigikogu by early November.

Vahtras said there are plans to revise the bill further. She stressed that registering AI agents is only one option. It entails no obligations and that if the plan fails, it can be abandoned.

"All we are doing is creating an opportunity for people to register this code for themselves. They do not have to do so. It creates no obligation for anyone, not for any service provider or any individual. It simply creates an opportunity. If, for example, after the legislative amendment, our technical working group finds that it cannot be implemented, that it is not possible to give agents their own authentication and signing functions — for example, because it is too complicated or too expensive — then nothing happens as a result of the law having been amended. It causes no harm to anyone. The costs to the state are minimal," the minister said.

--

Follow ERR News on Facebook and Twitter and never miss an update!