---
title: "Agentic Government Sources and References"
description: "Law, standards, Estonian policy documents and the author’s own writing behind the Agentic Government architecture. Third-party material is linked, never reproduced."
keywords: "agentic government sources, AI Act, eIDAS, GDPR, administrative procedure, digital government policy, agentic government, agentic state, agentic gov, govtech, gov tech, AI agents in government, public services"
canonical: https://agenticgov.eu/sources
url: https://agenticgov.eu/sources
---

# Sources.

Everything the argument rests on. The author’s own texts are reproduced on this site; law, standards and policy documents are linked to their original publishers.

## Law and regulation

- [Regulation (EU) 2016/679 (GDPR), consolidated](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng): Articles 5, 22 and 35 in particular.
- [Regulation (EU) 2024/1689 (AI Act), consolidated text as of 27 July 2026](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727).
- [Regulation (EU) 2026/1744, the AI Act high-risk timetable](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744): Annex III obligations from 2 December 2027, Annex I from 2 August 2028.
- [Regulation (EU) 910/2014 (eIDAS), consolidated](https://eur-lex.europa.eu/eli/reg/2014/910/2024-10-18/eng): Article 25 on the legal effect of electronic signatures.
- [Estonian Administrative Procedure Act (Haldusmenetluse seadus), English consolidation](https://www.riigiteataja.ee/en/eli/505122023003/consolide).
- [Haldusmenetluse seaduse ja avaliku teabe seaduse muutmise seadus, RT I, 09.07.2026, 12](https://www.riigiteataja.ee/et/akt/109072026012): adds HMS § 7¹, automated administrative procedure; in force 1 January 2027, applies to procedures started on or after 1 July 2027.
- [European Commission, the AI Act regulatory framework and implementation timeline](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai).

## Estonian and international policy

- [Estonia’s Digital Agenda 2030 (Digiühiskonna arengukava), English](https://www.mkm.ee/sites/default/files/documents/2022-04/Digi%C3%BChiskonna%20arengukava_ENG.pdf).
- [Kratid: Estonia’s AI vision, the Data and AI White Paper 2024–2030 and the AI action plan 2024–2026](https://www.kratid.ee/kratt-visioon).
- [Government Office, the Eesti.ai initiative](https://www.riigikantselei.ee/en/eestiai-initiative).
- [Information System Authority (RIA), Bürokratt](https://www.ria.ee/en/state-information-system/artificial-intelligence/burokratt).
- [X-Road architecture](https://docs.x-road.global/Architecture/arc-g_x-road_arhitecture.html).
- [OECD, Governing with Artificial Intelligence: how AI is accelerating the digital government journey (2025)](https://www.oecd.org/en/publications/2025/06/governing-with-artificial-intelligence_398fa287/full-report/how-artificial-intelligence-is-accelerating-the-digital-government-journey_d9552dc7.html).

## Standards and specifications

- [RFC 9901, Selective Disclosure for JWTs (SD-JWT)](https://www.rfc-editor.org/rfc/rfc9901.html).
- [draft-ietf-oauth-sd-jwt-vc-19, SD-JWT Verifiable Credentials](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-sd-jwt-vc-19): an Internet-Draft; pin a version.
- [OpenID for Verifiable Presentations 1.0](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html).
- [OpenID Federation 1.0](https://openid.net/specs/openid-federation-1_0.html).
- [SPIFFE concepts](https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/) and [SPIRE concepts](https://spiffe.io/docs/latest/spire-about/spire-concepts/).
- [RFC 7800, Proof-of-Possession Key Semantics for JWTs](https://www.rfc-editor.org/rfc/rfc7800.html).
- [RFC 9449, OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://www.rfc-editor.org/rfc/rfc9449.html).
- [RFC 9700, Best Current Practice for OAuth 2.0 Security](https://www.rfc-editor.org/rfc/rfc9700.html).
- [RFC 9396, OAuth 2.0 Rich Authorization Requests](https://www.rfc-editor.org/rfc/rfc9396.html).
- [RFC 8693, OAuth 2.0 Token Exchange](https://www.rfc-editor.org/rfc/rfc8693.html).
- [RFC 8785, JSON Canonicalization Scheme](https://www.rfc-editor.org/rfc/rfc8785.html).
- [draft-ietf-oauth-status-list-21, Token Status List](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-status-list-21): an Internet-Draft; freshness and fail-closed rules are deployment choices.
- [OpenID Shared Signals Framework 1.0](https://openid.net/specs/openid-sharedsignals-framework-1_0-final.html) and [OpenID CAEP 1.0](https://openid.net/specs/openid-caep-1_0-final.html).
- [OpenFGA, token claims as contextual tuples](https://openfga.dev/docs/modeling/token-claims-contextual-tuples).

## The author’s writing

Reproduced on this site with the author’s permission. The copy here may run slightly ahead of the blog; the canonical URL of the essay is the blog post.

- [Technology does not create public value: a technical blueprint for agentic government](https://agenticgov.eu/essay), 5 September 2026; canonical at [alvarlaigna.com](https://alvarlaigna.com/posts/technology-does-not-create-public-value).
- [Agentic Government Reference Architecture](https://agenticgov.eu/architecture), a versioned draft derived from the essay.
- Figure 1, the personal-state authorization flow, the author’s own drawing.
- [Kuidas ehitada AI-valmisolekut avalikus sektoris?](https://alvarlaigna.com/posts/kuidas-ehitada-ai-valmisolekut-avalikus-sektoris), 30 July 2026: the organisational-readiness criteria summarised in the architecture’s adoption path.
- [The missing link in the agentic state](https://alvarlaigna.com/posts/the-missing-link-in-the-agentic-state-ai-identity-crisis-in-public-services), 21 August 2026: the question that started this.
- The other writing is listed on the [about page](https://agenticgov.eu/about).