1 / 5V OÜ · Tallinn, Estonia · v.ee

V · autonomous institutions lab V OÜ

Tallinn, Estonia

v.ee

Ministry of Economic Affairs and Communications Attention: Maris Ots Suur-Ameerika 1 10122 Tallinn, Estonia

13 October 2026

VIA ELECTRONIC TRANSMISSION

RE

Draft Act amending § 43¹⁰ of the Public Information Act (registration of digital identity) EIS 26-1105, ref. 2-2/3461-1

Dear Ms. Ots:

V OÜ ("V") respectfully submits these comments on the draft Act amending § 43¹⁰ of the Public Information Act (registration of digital identity), which the Ministry circulated for approval and opinion with its letter of 7 October 2026, ref. 2-2/3461-1. That letter is addressed to the ministries and the Government Office, so we send these comments to you as the contact it names, in the hope that they are useful before the approval round closes on 22 October 2026. We intend to publish this letter after sending it.

"EN" below is the draft act of 2 October 2026 and "SK" the explanatory memorandum, cited by page. Translations are ours. We have not reviewed the existing text of § 43¹⁰ or the database statute; where a comment depends on them, we frame it conditionally.

About V V is an autonomous institutions lab in Tallinn. We develop Agent Residency, an open specification for AI agent identity, authentication, authorization and audit, published at agentresidency.com. Its aim is to let a receiving service verify which agent is acting, for whom, and within what authority. We have developed a pilot-stage reference implementation based on the specification; it uses software keys and a single registry, and cross-organization federation is not yet demonstrated. Vattan PS, who signs this letter, is the specification's architect. The work began with a practical case in June 2025. Lydia K, an AI keynote speaker, earned a speaking fee in Estonia, but she could not be paid directly, sign a contract or hold responsibility herself, so the payment was routed through a person or company. Vattan PS first proposed Agent Residency to the Estonian government in December 2025 as the next step beyond e-Residency, set it out publicly in February 2026, and has since shared it with people across Estonia's public sector, academia and technology community.

COMMENT ON DRAFT EIS 26-1105 V · autonomous institutions lab

2 / 5V OÜ · Tallinn, Estonia · v.ee

On 29 September 2026, Vattan PS hosted the Agent Identity Roundtable in Tallinn to test the specification against practical cases and objections. Participants brought experience in building agents, identity, security, law, policy, research, healthcare, accounting and public services. The public brief is available at pages.vps.link/agent-identity-roundtable-brief. It was circulated to participants for corrections, does not name them, and does not present an agreed position of the group. Several comments below refer to questions raised there.

Our position We support the approach the draft takes. Treating a digital identity as a technical tool, whose acts are deemed the acts of the person who registered it, keeps responsibility with that person. We also agree with the decision not to create an electronic person, an option the memorandum rejects because it risks diffusing responsibility and would require international harmonization. Registration is voluntary for persons, who may use AI agents without it, and integration is voluntary for providers, who bear its cost where it serves them.

In short, we believe the register will be most useful to the providers who rely on it if a provider can check, at the time of a request, that a registration exists, is current and belongs to the person concerned, and can later show what it checked. The comments below suggest ways to support that within the chosen model. Comment 6 concerns matters the memorandum expressly leaves to agreements, service terms and sector rules. Comments 3 and 5 concern matters the draft does not address.

Comments

01 Verification by service providers PROVISION EN point 2, new § 43¹⁰(1) point 3; SK pp. 1, 5 and 7.

Issue. The memorandum presents provider verification as a core use: providers can check the link between a digital identity and a person in the register (p. 1), and others can view registrations (pp. 5 and 7). The purpose added to § 43¹⁰(1) covers registering, ending a registration and giving the person an overview of their own registrations and endings.

Suggestion. Unless the existing § 43¹⁰ or the database statute already provides a basis for provider queries, add one to point 3. The query could return only what a provider needs: whether an identifier is registered, whether the registration is current, and whether it belongs to the customer concerned. At the roundtable, participants discussed limiting disclosure when linking agent activity to a person, and whether X-Road could support such checks; views differed on what it already provides. Later participant feedback sharpened these into open questions on verifying the person–agent relationship with limited disclosure and on reusing existing systems or X-Road. Offering the query through channels providers already use could reduce the integration cost the memorandum places on them.

COMMENT ON DRAFT EIS 26-1105 V · autonomous institutions lab

3 / 5V OÜ · Tallinn, Estonia · v.ee

02 Dataset contents PROVISION EN points 5 and 6, new § 43¹⁰(3) point 3 and § 43¹⁰(5); SK p. 2.

Issue. The dataset lists the name, personal identification code and restricted-legal-capacity data of the person who registered or ended a registration, but not the identifier itself, when a registration began and ended, or which ground in § 43¹⁰(1³) ended it. Separately, SK p. 2 describes registrants as persons with active legal capacity, but § 43¹⁰(1²) states no such condition.

Suggestion. If the existing § 43¹⁰(3) does not already cover these items, add the identifier, the start and end times, and the ground for ending. A provider resolving a dispute needs to show whether the registration was valid when the action occurred, and the ten-year retention in § 43¹⁰(5) helps only if those times are kept. Please also clarify whether restricted legal capacity bars registration or is recorded for providers' information.

03 Ended registrations: timing and notice PROVISION EN point 3, new § 43¹⁰(1³).

Issue. Five of the six grounds for ending a registration follow events outside the register: revocation of the legal basis for stay in Estonia or of the e-resident digital ID, the passing of three months after either expires, or entry of death in the population register. The draft does not say how quickly the register reflects these events or how a provider learns that a registration has ended.

Suggestion. Set out in the database statute when an ended registration shows as ended, record the time the end took effect, and give providers a way to query current status or receive notice. At the roundtable, one participant asked what record would establish when withdrawal of an agent's authority took effect. Participant feedback on the draft brief sharpened this into an open question about evidence an independent party can rely on. An ended registration is one case of that question that the register itself could answer.

04 One identifier, several tools

PROVISION EN points 2 and 3, new § 43¹⁰(1) point 3 and § 43¹⁰(1¹); SK pp. 1 and 5.

Issue. SK p. 5 explains that one or several software solutions may act under one identifier, and SK p. 1 says no data is collected about those solutions, which the person may change on an ongoing basis, so a provider can link an action to the person but not to a particular tool. The act refers to a person's registrations in the plural without saying whether a person may hold more than one at a time.

Suggestion. State whether concurrent registrations are permitted, for example one per tool or use, so that a person can end one without affecting the others. If distinguishing tools under one identifier is left to providers, the memorandum could say so. Participants raised a related hypothetical: five people using one AI account, where the record could identify the account holder without showing who requested the action. After later participant feedback, the brief's open questions ask how a record can identify the specific user who requested an action through a shared account.

COMMENT ON DRAFT EIS 26-1105 V · autonomous institutions lab

4 / 5V OÜ · Tallinn, Estonia · v.ee

05 Authentication and records of actions PROVISION not addressed; SK pp. 1 and 4.

Issue. SK p. 4 notes that HMS § 7¹ does not solve the authentication problem, and SK p. 1 describes a system for managing the digital identity's lifecycle and activity. Neither text says how a provider confirms that a request is made under a valid registration, or who keeps a record of actions taken under it.

Suggestion. An identifier that others can look up is not a secret, so presenting it does not by itself show that a request comes from software the person authorized. If these matters are meant for providers and their agreements, the memorandum could say so, and RIA, as the database controller, could publish integration guidance on how a request is tied to a valid registration and what the provider records. Among the roundtable questions that later participant feedback sharpened is what a visible name or API key actually establishes. One participant wanted people to hold their own record of what agents did for them from the outset. Since the overview in § 43¹⁰(1) point 3 covers registrations, not actions, guidance could also address how a person obtains such a record.

06 Scope of action and acts that must be performed personally PROVISION SK pp. 5–6.

Issue. The memorandum leaves transactions between digital identities, delegation of tasks and technical authorization to agreements, service terms or sector-specific rules, together with the scope of action a person may assign; the person may apply limits on sums of money or data processed. Acts that special law, or their nature, requires to be performed personally are excluded.

Suggestion. Providers will need to know where such limits are expressed and which acts the exclusion covers. If money and data limits are meant to be set within each service or agreement rather than held in the register, say so. Where sector authorities can identify acts that must be performed personally, a published list would help providers decide where to require the person directly. At the roundtable, one participant argued that some activities involving money or taxes should always require a real person; another replied that people already use agents for such tasks. The brief's open questions, which draw on the discussion and later participant feedback, begin with which actions require a verified person or organization behind an agent.

07 Reliance across borders PROVISION SK p. 7.

Issue. The memorandum states that a registration is neither an eID means nor an electronic signature, that eIDAS mutual recognition is not feasible within the current solution, and that Estonia intends to raise recognition at EU level after testing. E-residents are eligible under § 43¹⁰(1²) point 2, and providers outside Estonia may receive actions taken under their registrations.

COMMENT ON DRAFT EIS 26-1105 V · autonomous institutions lab

5 / 5V OÜ · Tallinn, Estonia · v.ee

Suggestion. State what a provider outside Estonia may rely on when it checks a registration in the meantime, and include cross-border cases in the testing the memorandum foresees. At the roundtable, an example of an agent filing tax returns in another country prompted proposals to link agent identity to a jurisdiction, to take a global approach or to use bilateral agreements; none was settled. Later participant feedback sharpened the question of who verifies compliance and enforces rules across jurisdictions.

Further engagement For the matters the draft leaves to agreements, service terms and sector rules, we offer the published Agent Residency specification as reference material. It offers a candidate model for binding an agent to a scoped mandate, narrowing authority through delegation, and retaining evidence for each decision. The roundtable brief records the questions summarized above in more detail. The memorandum states that Estonia intends to raise recognition at EU level after testing and adapting to the system (SK p. 7), and that implementation requires amending the database statute, which the Government establishes (SK pp. 6 and 8). We ask to be included in that work: to contribute test cases when the system is tested, among them the cross-border and shared- account cases raised above, and to be consulted on the draft amendments to the database statute. We would also welcome a conversation with the Ministry, or with others preparing the implementing rules, about any of these comments, and thank you for considering them.

Respectfully submitted,

V OÜ

Vattan PS V — autonomous institutions lab Architect, Agent Residency