As a working mother of a large family, I've found it much easier to order things online than to spend time shopping in stores. But there has always been one problem. Post offices close before my workday ends. My solution has been to give my children signed authorizations allowing them to collect whatever arrived at the post office on my behalf, indefinitely. The principle is simple: one person can authorize another to act on their behalf within very broad limits.

Today, in addition to people, we also have combinations of ones and zeros, better known as AI agents — or, using a distinctly Estonian term instead of a literal translation, kratts*. From here on, I'll use the Estonian word kratt instead of AI agent. (As a reminder, a kratt is a creature from Estonian mythology, built by a human to do work on their behalf. Estonia's digital development strategy also speaks of an "agentic state.")

Simply put, you can instruct a kratt to do something on your behalf, whether it's a narrowly defined task or one involving broad authority. You can tell a kratt to look around for the best solution and complete a good deal even if its creator would never have thought of that opportunity. I've done something similar with my own children: I've given them money and told them to go to the store and buy whatever they need to make a healthy dinner. While my younger children occasionally came home with some lurid, E-number-filled sugary monstrosity in the shopping cart, my teenagers eventually began making choices that were better than my own. Fortunately, both people and computing machines improve over time.

Kratts can help individuals and businesses complete countless everyday tasks much more quickly, freeing up time for more enjoyable, creative, strategic or meaningful pursuits. The possibilities are enormous. Here in Estonia, we already know that digital tools really can make people's lives easier. For example, switching from handwritten signatures to digital signatures has saved an average of half an hour for every signature. Those time savings come not only from no longer having to put a letter in an envelope, stick on a stamp and take it to the post office or an office clerk, but also from things like no longer needing carbon paper or making trips to buy printer toner. With kratts, the time savings would be measured not in minutes, but in days and months — and in some cases, years.

Technologically, creating kratts is becoming easier as well. All it takes is a computer and some technical know-how, including skills that the nationwide initiative eesti.ai teaches free of charge across Estonia. It is simply not realistic to think anyone will ever be able to oversee every AI agent. That means the time has come to put the legal framework in order.

Put simply, we need rules ensuring that if your kratt orders dinner on your behalf and pays for it from your bank account, the transaction is just as secure and reliable for the food seller. The merchant must be able to receive payment without worrying that someone will later challenge the transaction because it was legally invalid. Of course, the store's order recipient could also be a kratt, meaning AI agents would be conducting transactions with one another. That means each kratt must have legally valid authority to act on behalf of a specific person or business representative. Figuratively speaking, the other party to the transaction should be able to see — much like with a digital signature — an immutable combination of numbers and letters: a code confirming that this particular kratt was authorized to act on behalf of that specific person, at that specific moment, within those specific limits. That code must ultimately make it possible to identify the responsible human being. The human remains responsible. The kratt's code should lead back to the person's actual personal identification code and, if that individual is acting on behalf of a company, confirm that they have the legal authority to represent that company.

The first issue we must solve is that AI can, as we all know, hallucinate. Or perhaps a malicious AI agent created by fraudsters — one more sophisticated than yours — could trick your kratt into spending €38,000 on dinner instead of €38. It therefore makes sense to give the human owner of the kratt both preventive oversight and the ability to review its actions afterward.

At the same time, requiring people to approve every single decision their kratt makes would defeat the entire purpose of the economic and personal efficiency that AI automation can provide. The answer lies in enforceable rules. For example, back in the days of cash, when I sent my child to the store, I gave them only as much money as I thought it made sense to spend. Today, online banking allows account holders to set limits on e-invoices so that charges above a certain amount require their approval.

We can give kratts exactly the same kind of "allowance" or authority — only as much as they need to complete the task they've been assigned. If a kratt needs to interact with a financial service to move money, then that is the logical place to establish restrictions and regulation. For example, the European regulation governing payment services may need updating. Its current version does not yet account for kratts, but the next one clearly should.

Second, we must address the protection of personal and corporate data, as well as people's dignity. If a kratt's authorization extends beyond shopping for dinner and if a single person creates, say, 50,000 kratts, all interacting with thousands or even millions of other kratts — some of which may be working for criminals — things could quickly go wrong. On top of that, every kratt accumulates increasingly sensitive information about you. If every dinner order also includes a package of condoms, the person who created the kratt — perhaps someone who is married — may not want that information becoming public knowledge. Perhaps a newsroom has even deployed kratts specifically to uncover and compile exactly these kinds of data patterns. So we must also resolve questions of data protection, trade secrets and cybersecurity, while holding individual freedom and people's freedom to make mistakes in the highest regard.

Fortunately, in Estonia we are already accustomed to granting legally binding authority digitally. We know how to respond to cyber threats and data protection risks and we are not afraid to take calculated risks. In recent years, we have made significant progress in updating our legal system for the age of AI. For example, the rules governing automated administrative procedures will take effect on January 1, 2027, while reforms to clarify and modernize digital consent and broad, cross-service consent are already underway.

Finally, linking kratts — or AI agents — to specific individuals is the next unavoidable step, as business leaders on Estonia's AI Council have repeatedly emphasized. A practical and logical solution is to expand Estonia's and Europe's digital identity and digital wallet systems so that people can provide their kratts with digitally signed authorizations that the agents could present, for example, when confirming payments. Responsibility would still rest with the individual or company on whose behalf the kratt is acting, provided they have set appropriate limits based on their own tolerance for risk. While speaking recently at the United Nations, I also called on countries around the world to establish a global system for the mutual recognition of both digital identities and digital services, just as humanity has long managed to mutually recognize paper documents.

We are already preparing the next legislative proposals and public discussions on giving these digital authorization codes legal force will begin in August. Everyone is welcome to contribute ideas and take part. If we want to enjoy the benefits of AI without the downsides — and avoid having to rebuild public-sector AI systems later at taxpayers' expense — we will need the expertise of entrepreneurs, lawyers and researchers alike. When I think about the uniquely innovative digital public services Estonia has built so far, I am confident that we can also put kratts on a leash without letting them steal our souls.

*More information on e-Estonia and the digital Kratt is available here.

--

Follow ERR News on Facebook and X and never miss an update!