Estonian government backs AI agent code bill: no automatic access to services

What happened?

On 12 November 2026, Estonia’s Ministry of Economic Affairs and Communications announced that the government had approved a bill to introduce an AI agent code, called agendikood in Estonian. The bill now moves to the Riigikogu, Estonia’s parliament. Government approval is a further legislative stage; it does not mean the bill has become law.

According to the ministry, use of the codes can begin after the legislation has been passed and the necessary technical solution has been completed.

What does this mean for your business?

The proposed agent code would be a unique identifier linked to a specific person. It would allow a service provider to check on whose behalf a software agent is acting. The ministry expressly states that the code would not give the agent independent rights or automatic access to a person’s data or services.

Businesses would decide whether to support the use of agent codes. An agent could use the code to perform actions in a public digital service where the relevant authority permits such actions. The proposal therefore does not require an online shop or another business to open its service to all AI agents.

Following consultation, the original digital identity approach was dropped and the scope of the code and the role of Riigi Infosüsteemi Amet (RIA), Estonia’s information system authority, were clarified. According to the ministry, RIA will develop criteria for the safe use of software solutions in state information systems and recommendations for applying those criteria.

Who is affected?

AI agent developers, online shops and other digital service providers operating in Estonia, including English-speaking businesses planning to let software carry out actions on a user’s behalf.

What should you do?

Magilex recommends keeping user identification, the user’s authorisation and the actions permitted by the service provider separate in your design. Do not treat the proposed agent code as a universal access permission.

If you plan to support agents in your service, define permitted actions, transactions requiring confirmation and how access can be terminated. These are preparatory recommendations, rather than obligations already in force under this bill. Follow the parliamentary text and RIA’s technical work before relying on a launch date or final implementation requirements.

Key dates

12 November 2026 — the ministry announced government approval and the bill’s next step towards parliament.

Government approval is distinct from parliamentary adoption and entry into force. The ministry links the introduction of agent codes to adoption of the legislation and completion of the technical solution. Its announcement does not set a confirmed launch date.