Law and regulation
- Regulation (EU) 2016/679 (GDPR), consolidated: Articles 5, 22 and 35 in particular.
- Regulation (EU) 2024/1689 (AI Act), consolidated text as of 27 July 2026.
- Regulation (EU) 2026/1744, the AI Act high-risk timetable: Annex III obligations from 2 December 2027, Annex I from 2 August 2028.
- Regulation (EU) 910/2014 (eIDAS), consolidated: Article 25 on the legal effect of electronic signatures.
- Estonian Administrative Procedure Act (Haldusmenetluse seadus), English consolidation.
- Haldusmenetluse seaduse ja avaliku teabe seaduse muutmise seadus, RT I, 09.07.2026, 12: adds HMS § 7¹, automated administrative procedure; in force 1 January 2027, applies to procedures started on or after 1 July 2027.
- European Commission, the AI Act regulatory framework and implementation timeline.
Estonian and international policy
- Estonia’s Digital Agenda 2030 (Digiühiskonna arengukava), English.
- Kratid: Estonia’s AI vision, the Data and AI White Paper 2024–2030 and the AI action plan 2024–2026.
- Government Office, the Eesti.ai initiative.
- Information System Authority (RIA), Bürokratt.
- X-Road architecture.
- OECD, Governing with Artificial Intelligence: how AI is accelerating the digital government journey (2025).
Standards and specifications
- RFC 9901, Selective Disclosure for JWTs (SD-JWT).
- draft-ietf-oauth-sd-jwt-vc-19, SD-JWT Verifiable Credentials: an Internet-Draft; pin a version.
- OpenID for Verifiable Presentations 1.0.
- OpenID Federation 1.0.
- SPIFFE concepts and SPIRE concepts.
- RFC 7800, Proof-of-Possession Key Semantics for JWTs.
- RFC 9449, OAuth 2.0 Demonstrating Proof of Possession (DPoP).
- RFC 9700, Best Current Practice for OAuth 2.0 Security.
- RFC 9396, OAuth 2.0 Rich Authorization Requests.
- RFC 8693, OAuth 2.0 Token Exchange.
- RFC 8785, JSON Canonicalization Scheme.
- draft-ietf-oauth-status-list-21, Token Status List: an Internet-Draft; freshness and fail-closed rules are deployment choices.
- OpenID Shared Signals Framework 1.0 and OpenID CAEP 1.0.
- OpenFGA, token claims as contextual tuples.
The author’s writing
Reproduced on this site with the author’s permission. The copy here may run slightly ahead of the blog; the canonical URL of the essay is the blog post.
- Technology does not create public value: a technical blueprint for agentic government, 5 September 2026; canonical at alvarlaigna.com.
- Agentic Government Reference Architecture, a versioned draft derived from the essay.
- Figure 1, the personal-state authorization flow, the author’s own drawing.
- Kuidas ehitada AI-valmisolekut avalikus sektoris?, 30 July 2026: the organisational-readiness criteria summarised in the architecture’s adoption path.
- The missing link in the agentic state, 21 August 2026: the question that started this.
- The other writing is listed on the about page.