AI Regulation in Estonia: How the EU AI Act Works for Estonian Companies

Estonia likes to call itself the most digital country in Europe, and it is one of the most AI-friendly places in the EU to build an AI business. That does not mean artificial intelligence is unregulated here. It means the country applies the EU rules without adding any of its own. This article explains, in plain terms, how AI regulation in Estonia works: who supervises AI, where the implementation of the AI Act in Estonia stands, and what an Estonian company should keep ready. If you first want to know what the Act itself asks of a business, read our plain guide to the EU AI Act for companies and come back here.

Is There an Estonian AI Law?

No, and there will not be one. The AI Act is an EU regulation, which means it works in Estonia exactly as written, with no Estonian version needed. Estonia’s approach has always been to adapt the laws and authorities it already has, AI oversight included, rather than write a new statute.

What Estonia still owes the EU is a short implementing act. It will formally name the AI supervisors, set the Estonian procedure and scale for penalties, and give the sandbox a legal basis. The EU deadline for naming those bodies has passed, and the country, like most member states, missed it. TTJA still describes its AI role in the future tense.

Here is the point companies most often get wrong: the missing Estonian act does not pause anything. The bans, the duty to train staff on AI, and the chatbot and content transparency rules apply to your company today because the EU regulation says so. What is not yet in place is the Estonian machinery for fining you.

Who Regulates AI in Estonia?

Estonia has not created a new AI agency. AI supervision sits with bodies that already exist, each adding AI to its old remit.

For an ordinary company, two names matter. TTJA is the market surveillance authority: the office that can knock on your door about an AI system and the one that will lead AI Act enforcement in Estonia. AKI is the privacy watchdog, and because almost every AI tool touches personal data, AKI is often the first to ask questions. It already publishes its own AI Act guidance, runs an advice line and has issued opinions on AI tools in healthcare.

If TTJA opens an enquiry, it can ask a company that makes AI for the data used to train and test the system, the system’s logs, and, for high-risk systems, access to the source code. It can order a product to be fixed, withdrawn or recalled. A company that merely uses someone else’s AI is usually asked for less: the vendor’s instructions, proof that a human oversees the tool, and the logs it holds. Documents must be in a language the authority accepts; Estonia has not said yet whether English will do alongside Estonian, so keep your file ready in both.

Does the AI Act Apply to an e-Residency Company Run From Abroad?

Yes. This is the question e-residents ask most, and the answer is simple: an Estonian OÜ is established in the EU, full stop. It does not matter whether the founder sits in Tallinn, Berlin or Singapore. If the e-resident company uses AI in its work or sells an AI product, it has the same duties as any other EU business, and TTJA and AKI are the bodies that enforce them.

The practical side is more useful than the legal one. Your Estonian legal address and, if the board lives abroad, your contact person are the channels through which an authority reaches you. Make sure a letter from TTJA or AKI would actually be seen and answered in time.

AI Act Implementation in Estonia: Key Dates

Is There an AI Sandbox in Estonia?

An AI regulatory sandbox is a supervised testing ground where a company can trial a new AI system with the authorities before launch. Every EU country must have one, and the Omnibus moved the deadline back by a year. Estonia has not waited for the deadline to build its AI sandbox. The Ministry of Justice and Digital Affairs already runs an AI test environment (tehisaru testkeskkond). It offers legal and compliance advice, help with risk and impact assessments, technical testing, secure data environments and computing power. You start with a pre-assessment of your system’s risk level, then apply and agree a test plan, and the ministry can issue a written report at the end. The service is free for SMEs and public bodies, and Finland is a partner in developing the sandbox further.

If you are building anything close to high-risk, use it early. It produces written evidence of compliance work and gets you talking to the supervisors before the high-risk dates arrive.

What Should an Estonian Company Keep Ready?

Most Estonian companies will never hear from TTJA. Those that do will be asked for documents, not opinions. AI governance here can be simple. Keep a short AI compliance file next to your accounting and GDPR records:

• A list of AI tools you use or sell, with the vendor, the purpose and whether you built it or just use it.
• One named person responsible for AI in the company, even if that is you.
• Vendor paperwork: terms, instructions for use and any conformity statement.
• Proof of the live duties: the chatbot notice your customers see, your AI-use policy and training records, and how you label AI-generated content.
• The GDPR link: the data-protection assessment or processing record that covers the AI tool.

A company that makes AI adds its technical file. A company outside the EU adds the written mandate of its EU representative.

Starting an AI Company in Estonia From Outside the EU

An AI start-up based outside the EU must appoint a representative inside the Union before it can sell a high-risk product or a large general-purpose model on the European market. Register an AI company in Estonia, fully online through e-Residency, and you have an EU company that can play that role. It can also go one step further and become the EU provider itself, selling under an Estonian name, with the full provider duties that follow. Which route is right for your AI business depends on the product’s risk level, the group’s tax position and how the European operation will be run. Decide it with advice, not by default.

How Eesti Firma Helps AI Businesses in Estonia

Eesti Firma sets up and administers Estonian companies for founders worldwide and stays with them once the company is trading in the EU. For AI businesses that means company formation in Estonia as the EU entity or representative, ongoing accounting and compliance administration, and legal services for AI compliance in Estonia: the AI governance file described above, correspondence with TTJA or AKI, and the documents a company must be able to produce on request.

Set up your EU base for AI compliance

Frequently Asked Questions