Estonia - AI and Data Action Plan

AI and Data Action Plan (Kratt) 2024–2026

Tehisintellekti tegevuskava 2024–2026

Estonia

RAI-EE-NA-ADAPKXX-2024
Effective: February 8, 2024
In Force(In Force)
PolicyGovernance and OversightAccountability and Documentation
Export PDF

The AI and Data Action Plan (Kratt) 2024–2026 is Estonia's three‑year national strategy to accelerate trustworthy, human‑centred AI and data adoption across public and private sectors. Led by the Ministry of Economic Affairs and Communications, the plan focuses on capacity building, public sector transformation, data governance, language technologies, funding and international alignment (notably with EU AI policy).

Summary

The AI and Data Action Plan (commonly referenced as the Kratt action plan) 2024–2026 sets out Estonia’s strategic priorities and concrete measures to advance the country’s data economy and artificial intelligence (AI) capabilities from 2024 through 2026. Building on earlier national AI strategies (2019–2021 and 2022–2023) and a recent Data & AI White Paper (2024–2030), the plan is framed as a practical implementation roadmap rather than binding legislation. It is organised around strengthening public sector adoption, enabling private sector innovation (especially SMEs and deeptech), promoting Estonian language and culture through language technology, improving skills and education, and ensuring trustworthy and human‑centric AI development.

The plan emphasises a whole‑of‑government approach led by the Ministry of Economic Affairs and Communications (MKM) in cooperation with the Government Office (Riigikantselei), Riigi Infosüsteemi Amet (RIA), the Data Protection Inspectorate, and sectoral ministries. A prominent strand of the plan is the creation of an AI competence centre and a dedicated public‑sector implementation support capacity to help state agencies map use cases, run pilots and scale mature solutions. The plan envisions targeted investment (the public communications around it refer to a package of around €85 million for implementation across measures), a mix of grants, transformation support and catalytic funding instruments designed to reduce uptake barriers.

From a governance perspective, the strategy aligns Estonia’s approach with EU‑level developments (including the EU AI Act and broader EU data policy) and stresses interoperable standards, risk assessments, model documentation and heightened attention to privacy and fundamental rights. It calls for adoption of impact assessment practices and safety testing for systems with significant societal effect, expansion of language models and resources for Estonian, and the development of metrics to monitor progress. The plan also includes measures for education and workforce reskilling, public awareness, cybersecurity and model security best practices, and incentives for private sector collaboration with research institutions.

As a policy document rather than a statute, the action plan does not itself create new criminal or administrative penalties; enforcement and sanctions remain within the scope of existing legal instruments (e.g., GDPR and sectoral regulation). However, it sets obligations and expectations for public bodies that receive funding or that implement state‑led projects, and it establishes monitoring and evaluation processes to ensure accountability and course corrections. The plan explicitly situates Estonia to be an early implementer of EU rules and standards while supporting local innovation and safeguarding fundamental rights.

Full article

Read full text ↗

Overview

The AI and Data Action Plan 2024–2026 (commonly referred to as the Kratt plan) is Estonia’s operational roadmap to deliver an inclusive, human‑centred and innovation‑friendly data and AI ecosystem over a three‑year horizon. Released alongside the Data & AI White Paper 2024–2030, the plan sets out a series of coordinated measures to accelerate public sector adoption, support private sector uptake (with special focus on SMEs and deeptech), and strengthen national capabilities in language technologies and data governance. The plan was developed under the leadership of the Ministry of Economic Affairs and Communications (MKM) with contributions from sector ministries and the Government Office; its strategic framing and continuity with Estonia’s prior AI strategies are summarised on the national Kratt portal at Kratid – Vision & Strategies.

Definitions

Key terms used in the action plan reflect EU common usage and Estonian policy practice: "AI" covers systems that perform tasks with varying degrees of autonomy, including machine learning and generative models; "data governance" refers to legal, organisational and technical arrangements for responsible data use; "human‑centred" denotes approaches prioritising human oversight, rights protection and explainability; "competence centre" refers to an institutional vehicle for training, advisory services and cross‑sectoral assistance; and "high‑impact" or "high‑risk" systems are those with substantial effects on safety, health, fundamental rights or essential services. The plan intentionally aligns its terminology with contemporary EU acts and guidance to support interoperability and legal alignment.

Governance and Institutional Framework

The plan designates MKM as the primary coordination body responsible for steering implementation, monitoring progress and convening stakeholder groups, working in concert with the Government Office (Riigikantselei) and sectoral ministries. Operational support and technical implementation are assigned to public agencies such as Riigi Infosüsteemi Amet (RIA) and other specialist bodies. The plan proposes establishing or strengthening an AI competence centre (a coordinated public‑private research and support entity) to provide advisory services, testing infrastructure and piloting capacity for both public sector agencies and private actors. Governance modalities emphasize cross‑ministerial steering, public consultations with industry and academia, and an annual update cycle to keep the plan current with technological and regulatory developments.

Key Focus Areas

The Kratt action plan is structured across several interdependent pillars: (1) public sector transformation — helping government institutions adopt AI into services while safeguarding rights and processes; (2) funding and financing mechanisms — a mix of public investment, grants and support instruments aimed at catalysing development and scaling; (3) skills and education — national programmes to raise AI literacy, reskilling, and targeted support for tertiary and vocational programmes; (4) data governance and human‑centred rules — strengthening data availability, quality, consent frameworks and privacy‑preserving technologies; (5) language technology — substantial focus on resources for Estonian and other Finno‑Ugric languages to avoid digital exclusion; (6) safety, testing and certification — pilot testing, evaluation frameworks and conformity approaches in line with EU good practice; and (7) international cooperation — alignment with EU rules, participation in research networks and standardisation bodies. The plan contains concrete measures under each pillar, allocated milestones and indicative budgets for priority items.

Implementation Framework

Implementation rests on a three‑year operational structure with annual workplans, measurable indicators and designated leads for each action. MKM is charged with convening a multi‑stakeholder steering group, allocating transformation support to public bodies, and disbursing competitive funding rounds. The proposed AI competence centre is tasked with producing technical guidance, model documentation templates, a catalogue of public sector use cases and support for procurement. The plan also envisages setting up common testing environments and sandboxes for experimentation under controlled conditions. A monitoring dashboard and regular public reporting will track indicator progress and budget use.

Monitoring and Evaluation

A central monitoring framework is foreseen that combines quantitative KPIs (e.g., number of public services with AI components, SMEs supported, language resources created, training participants) with qualitative case studies and annual independent reviews. MKM will publish progress reports and update the plan each year to reflect technical developments and feedback from pilot projects. The plan emphasises transparent metrics and an iterative approach enabling course corrections. Evaluation criteria include human‑rights impact, accessibility, interoperability, cost‑benefit outcomes and measurable public value delivered through deployments.

Penalties, Liability, and Appeals

As a non‑regulatory strategy document, the action plan does not itself create new criminal or administrative penalties. It anticipates that compliance and liability are governed by existing law — notably the GDPR for data protection issues, sectoral safety and liability regimes, and forthcoming EU AI Act obligations for regulated AI systems. The plan instructs public procurers and agencies to require appropriate contractual terms (e.g., warranties, audit rights, liability clauses) when acquiring AI solutions, and to use impact assessments and model documentation as preconditions for deployment. Appeals and remedies for rights infringements remain within the established judicial and administrative channels.

Relationship to Other Instruments

The 2024–2026 plan updates and supersedes Estonia’s prior AI action documents for 2019–2021 and 2022–2023 by translating strategic goals into an operational three‑year programme. It complements the Data & AI White Paper 2024–2030 and aligns with national digital‑government strategies and sectoral policies (education, health, finance). The plan also explicitly positions Estonia to adopt and implement EU policy instruments — notably the EU AI Act, EU data strategy measures and OECD AI guidance — and to adapt national procedures (procurement, data exchange, certification) accordingly.

International Alignment

International alignment is a central pillar: the plan commits to synchronising national measures with EU legislative timelines (including preparatory actions to implement the EU AI Act), participating in European testing and certification initiatives, and contributing to standardisation efforts. It seeks to maximise Finland and Nordic cooperation in language technology and to engage with EU funding instruments to co‑finance infrastructure and research. The plan emphasises reciprocity with global norms on privacy, cybersecurity and human rights in AI deployment.

Implementation Timeline

PeriodMajor Deliverables
Q1–Q2 2024Publication of the White Paper and the 2024–2026 action plan; public consultations and launch of initial pilots (MKM announcement on 2024‑02‑08; seminar 2024‑04‑09).
H2 2024Establishment of competence centre design, first funding rounds and public‑sector transformation pilots.
2025Scaling of successful pilots, rollout of national skills programmes and launch of Estonian language model initiatives (e.g., AI Leap education initiatives announced later as complementary measures).
2026Consolidation of infrastructure, evaluation, annual reporting and preparation for next planning cycle and full alignment with EU regulatory milestones.

Sources and References

SourceType
Majandus‑ ja Kommunikatsiooniministeerium — MKM: Plan for AI and data development (news release, includes links to the White Paper and action plans)Primary Source
Kratid — Vision & Strategies (national AI taskforce portal listing the 2024–2026 plan)Primary Source
ERR News — Report on planned funding and measures for AI implementationSecondary/Media

Requirements for a company

What an organisation has to do under Estonia - AI and Data Action Plan, at a glance. Not legal advice — the table below gives the provision and deadline for each item.

Must do

7
  • Conduct human-rights and data protection impact assessments before deploying high-impact AI systems.Entities deploying high-impact AI systems
  • Maintain documentation and logs sufficient for audits and reproducibility of AI models.Entities deploying AI systems
  • Include contractual requirements for liability, audit, and security when procuring AI solutions.Public procurers and agencies acquiring AI solutions
  • Safeguard human rights and processes when adopting AI into public services.Government institutions adopting AI
  • Strengthen data availability, quality, consent frameworks, and privacy-preserving technologies.Entities handling data for AI systems
  • Use sandbox or testing environments for safety evaluation of machine learning models before production.Entities developing or deploying ML models
  • +1 more in the table below

Must not do

0

Nothing in this category.

Should do

1
  • Record staff training and reskilling activities aligned with national AI programmes.Organisations adopting AI solutions

Should not do

0

Nothing in this category.

Who must do what

The obligations under Estonia - AI and Data Action Plan, most serious first. Not legal advice — verify against the official text before relying on it.

#WhoRequirementBy whenWhereSeverity
1Entities deploying high-impact AI systemsConduct human-rights and data protection impact assessments before deploying high-impact AI systems.
Conduct human‑rights/data protection impact assessments before deployment of high‑impact systems.
Before deploymentCompliance ChecklistCritical
2Entities deploying AI systemsMaintain documentation and logs sufficient for audits and reproducibility of AI models.
Maintain documentation and logs sufficient for audits and reproducibility.
Before deploymentCompliance ChecklistCritical
3Public procurers and agencies acquiring AI solutionsInclude contractual requirements for liability, audit, and security when procuring AI solutions.
Include contractual requirements for liability, audit and security in AI procurement.
Before acquiring AI solutionsCompliance ChecklistCritical
4Government institutions adopting AISafeguard human rights and processes when adopting AI into public services.
public sector transformation — helping government institutions adopt AI into services while safeguarding rights and processes
Before adopting AI into servicesKey Focus AreasImportant
5Entities handling data for AI systemsStrengthen data availability, quality, consent frameworks, and privacy-preserving technologies.
strengthening data availability, quality, consent frameworks and privacy‑preserving technologies
Key Focus AreasImportant
6Entities developing or deploying ML modelsUse sandbox or testing environments for safety evaluation of machine learning models before production.
Use sandbox/testing environments for safety evaluation of ML models prior to production.
Prior to productionCompliance ChecklistImportant
7Public sector entities implementing AI solutionsIdentify your lead ministry or agency and contact MKM for alignment and reporting.
Identify lead ministry/agency and contact MKM for alignment and reporting.
Compliance ChecklistImportant
8Organisations adopting AI solutionsRecord staff training and reskilling activities aligned with national AI programmes.
Record staff training and reskilling activities aligned with national programmes.
Compliance ChecklistRecommended

© Regulations.AI — created on 13-Jun-2026