The EU AI Act in Estonia

Per Estonia - National AI Education Initiative

• Ministry of Education and Research — Policy owner and strategic oversight for AI Leap.
• Haridus- ja Noorteamet (Education and Youth Board) — Operational support, school onboarding and implementation facilitation.
• Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — Data protection oversight and GDPR enforcement.
• Information System Authority (Riigi Infosüsteemi Amet, RIA) — Cybersecurity and technical assessment of information systems.
• AI Leap Foundation (TI-Hüpe Sihtasutus) — Programme coordination, procurement and delivery partner (public-private foundation).

Per Estonia - AI and Data Action Plan

• Ministry of Economic Affairs and Communications (MKM) — Lead coordinating ministry for the action plan, policy stewardship and funding coordination
• Riigi Infosüsteemi Amet (RIA) - Estonian Information System Authority — Technical implementation support, cybersecurity and public sector digital infrastructure
• Riigikantselei (Government Office) — Cross‑government coordination and strategic alignment
• Data Protection Inspectorate (Andmekaitse Inspektsioon) — Supervision for data protection compliance and advice on DPIAs
• Kratid / AI Taskforce portal — National AI taskforce hub for vision, stakeholder engagement and dissemination

Per Estonia - Data and AI Strategy

• Ministry of Economic Affairs and Communications (Majandus- ja Kommunikatsiooniministeerium) — Lead coordinator and publisher of the White Paper; oversees implementation planning and action plans.
• Riigi Infosüsteemi Amet (RIA) / State Information System Authority — Technical implementation, cybersecurity, shared services and system architecture support.
• Data Protection Inspectorate (Andmekaitse Inspektsioon) — Supervisory authority for personal data protection and GDPR compliance.
• Ministry of Justice (Justiitsministeerium) — Legal policy alignment, review of regulatory impacts and law drafting support.
• Ministry of Education and Research (Haridus‑ ja Teadusministeerium) — Skills, education and research coordination for AI and data literacy.

Per Estonia - AI Expert Group Report (2019)

• State Chancellery (Riigikantselei) — Coordination and strategic oversight of the Expert Group recommendations and national AI policy coordination.
• Ministry of Economic Affairs and Communications (Majandus- ja Kommunikatsiooniministeerium) — Economic and technical lead on AI adoption, testbed (Kratt) programme coordination and public-private engagement.

Per Estonia - National AI Strategy (2019–2021)

• Ministry of Economic Affairs and Communications (MKM) — Overall coordinator and lead agency for the Kratt programme, responsible for policy, funding coordination and publication of the action plan.
• State Chancellery (Riigikantselei) — Cross‑government coordination, expert input and administrative law guidance; co‑lead of the expert group that informed the plan.
• Kratid — National AI Portal (operational hub) — Implementation hub and public repository for guidance, training, project registries and reuseable materials.

Per Estonia - Automated Administrative Acts (2018)

• Keskkonnaamet (Environmental Board) — Primary implementing agency; authorised issuer of environmental charges and automated administrative acts
• Ministry of the Environment (or responsible minister) — Responsible for issuing the delegated regulation listing automated administrative acts and establishing implementation rules
• Riigi Teataja (Official Gazette) — Official publisher of consolidated legal texts and ministerial regulations

Per Estonia - Automated Tax Administration (§46²)

• Estonian Tax and Customs Board (Maksu- ja Tolliamet / EMTA) — Operational implementer and issuer of automated administrative acts for state taxes; maintains administrative records and service procedures.
• Ministry of Finance (Rahandusministeerium) — Sectoral policy responsibility; issues the ministerial regulation listing which acts/documents may be automated.
• Information System Authority (RIA) — Competent authority for trust services and supervision of electronic identification and trust services infrastructure under the Electronic Identification and Trust Services Act.

Per Estonia - National AI Education Initiative

• Contractual remedies (including financial penalties and termination) for supplier breaches.
• Withdrawal of platform access to schools or cohorts for failure to comply with programme obligations.
• Administrative fines and corrective orders under EU GDPR enforced by the Estonian Data Protection Inspectorate for privacy breaches.
• National cybersecurity enforcement actions for failure to meet required security standards.
• Administrative measures by school authorities for staff-level breaches of internal AI use policies.

Per Estonia - AI and Data Action Plan

• The action plan itself does not impose new penalties; compliance and sanctions remain under existing legal frameworks such as the EU GDPR and sectoral regulation.
• Procurement and funding agreements may include contractual remedies, clawbacks or withdrawal of funding for non‑compliance with plan conditions.
• Regulatory enforcement (fines, corrective orders) for data protection or safety breaches will be pursued by relevant agencies under applicable law.

Per Estonia - Data and AI Strategy

• The White Paper itself does not stipulate new penalties; enforcement is expected via existing instruments (e.g., GDPR fines enforced by Data Protection Inspectorate) and through future regulation such as the EU AI Act which includes penalties for non‑compliance.
• Non‑compliance with sectoral legal requirements (data protection, administrative law, sectoral safety standards) may result in administrative sanctions, fines or corrective measures by competent authorities.
• Public sector accountability measures include administrative oversight, audits and corrective implementation orders.

Per Estonia - AI Expert Group Report (2019)

• The Expert Group report is advisory and does not itself prescribe penalties; it recommends that future legislation define sanctions and liability frameworks.
• Any penalties for non-compliance will be set out in subsequent sectoral laws, administrative regulations or binding acts, not in the 2019 report.

Per Estonia - National AI Strategy (2019–2021)

• The 2019–2021 strategy itself does not establish new standalone criminal or administrative penalties; enforcement relies on existing legal frameworks (administrative law, sectoral regulators, consumer protection and data protection regimes).
• Non‑compliance with GDPR and data protection obligations may trigger penalties and corrective measures as provided under EU Regulation 2016/679.
• Sectoral breaches remain subject to penalties and enforcement by the competent sectoral regulator (e.g., healthcare, transport, financial regulators) under existing law.
• Public bodies failing to follow required administrative procedures may be subject to judicial review, administrative sanctions or reputational remedies under administrative law.

Per Estonia - Automated Administrative Acts (2018)

• Procedural remedies for unlawful administrative acts include annulment, correction and re-issuance under administrative law.
• Collection measures and sanctions for unpaid environmental charges continue to apply under Keskkonnatasude seadus (e.g., collection and enforcement provisions).
• Liability for unlawful automated acts may engage administrative compensation frameworks or other remedies available under Estonian law.
• Data protection breaches may trigger enforcement and fines under GDPR and national data protection authorities.
• System security failures resulting in unauthorised access or alteration may give rise to criminal or administrative sanctions under relevant Estonian law.

Per Estonia - Automated Tax Administration (§46²)

• Administrative sanctions or corrective measures under the Electronic Identification and Trust Services Act for trust-service provider non-compliance (including possible deregistration of services). ([riigiteataja.ee](https://www.riigiteataja.ee/en/eli/527102016001/consolide?utm_source=openai))
• Invalidation or revocation of automated acts where procedural or service requirements are not met (remedies under the Taxation Act and Administrative Procedure Act). ([riigiteataja.ee](https://www.riigiteataja.ee/akt/117042025027?utm_source=openai))
• Civil liability for damages caused by misuse or improper issuance of electronic seals or faulty automated decision-making, under general civil liability rules and trust-service law. ([riigiteataja.ee](https://www.riigiteataja.ee/en/eli/527102016001/consolide?utm_source=openai))
• Operational or supervisory enforcement measures (fines, orders to remediate) administered by competent authorities in accordance with relevant legislation.