Skip to main content

    AI by country · Northern Europe

    AI in Estonia: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Estonia know before starting with AI?

    In Estonia, AI that uses personal data falls under the GDPR and the Personal Data Protection Act (Isikuandmete kaitse seadus), supervised by the Data Protection Inspectorate (AKI). The EU AI Act applies directly, but Estonia's national law naming its AI supervisors was not confirmed as adopted on 29 October 2026. A company should map its AI uses against the AI Act now and keep personal data handling in line with the GDPR.

    At a glance

    Estonia at a glance

    Key facts about Estonia
    Data protection lawGDPR plus the Personal Data Protection Act, passed 12 December 2018, in force since 15 January 2019 (current text in force since 1 October 2026)
    RegulatorAndmekaitse Inspektsioon (Data Protection Inspectorate, AKI); TTJA is listed as AI Act single point of contact, designation pending
    AI policyEU AI Act (Regulation (EU) 2024/1689), phased. National implementing law not confirmed as adopted as of 29 October 2026
    Time zoneEET, UTC+2 in winter and EEST, UTC+3 in summer (India is 3.5 or 2.5 hours ahead)
    CurrencyEUR (euro)
    Business languageEstonian, with English widely used in business

    Why now

    Why Estonia is worth watching

    Each point links to the document it comes from.

    • Eurostat reports that 23.4% of Estonian enterprises with 10 or more staff used at least one AI technology in 2025, up from 13.89% in 2024. The EU figure was 19.95%.[8]

    • The AI Leap programme, announced on 25 February 2025, started on 1 September 2025 with 20,000 students in grades 10 and 11 and 3,000 teachers, with a planned expansion in September 2026.[6]

    • The European Commission lists Estonia's Consumer Protection and Technical Regulatory Authority (TTJA) as its AI Act contact point, with the national decision still pending final adoption on 7 September 2026.[5]

    • Estonia is part of the LUMI AI Factory consortium, whose EUR 387.8 million LUMI-AI supercomputer in Finland is expected to be available in 2027.[7]

    • The EU's Digital Omnibus on AI entered into force on 27 July 2026 and moved high-risk duties for Annex III uses, such as education and hiring, to 2 December 2027.[4]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    General Data Protection Regulation (EU) 2016/679

    In force2016People have a right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, with listed exceptions (Article 22). High-risk processing needs a data protection impact assessment (Article 35), and breaches must be reported within 72 hours where feasible (Article 33).[1]

    Personal Data Protection Act (Isikuandmete kaitse seadus), RT I, 04.01.2019, 11

    In force2018A child must be at least 13 to consent to online services (section 8). Breaches are handled as misdemeanours: for example, ignoring an AKI order or breaching data subject rights can lead to a fine of up to EUR 20 million, or 4% of worldwide turnover for a company (sections 66 and 69).[2]

    EU Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744

    Phased2024Bans and AI literacy apply from 2 February 2025, general-purpose AI rules from 2 August 2025, and most other rules, including transparency, from 2 August 2026. High-risk duties now apply from 2 December 2027 (Annex III) and 2 August 2028 (AI in regulated products). Fines for banned practices can reach EUR 35 million or 7% of worldwide turnover.[3]

    Estonian law implementing the AI Act

    Draft2026We could not find an adopted Estonian law naming AI Act supervisors and penalties as of 29 October 2026. The Commission's list shows TTJA as contact point with the national decision pending. Treat the supervisory set-up as not yet confirmed.[5]

    Where AI fits first

    Where AI fits first

    Education

    Study support tools, feedback on written work and lesson planning, with teachers in charge of grading.

    AI used to decide admission or evaluate learning outcomes is an Annex III high-risk use from 2 December 2027. The AI Leap programme already brings AI tools into upper secondary schools.[6]

    Fintech and payments

    Customer onboarding checks, fraud signals and support in Estonian, Russian and English.

    Credit scoring of individuals is an Annex III high-risk use from 2 December 2027. Fraud detection is excluded from that entry.[3]

    Software and IT services

    Code review support, test generation and internal knowledge search.

    If you build AI products for others, you may be a provider under the AI Act, with transparency duties from 2 August 2026.[3]

    Public sector

    Drafting replies, searching case files and summarising documents for officials.

    Any decision about a person needs a lawful basis under the GDPR, and Article 22 limits decisions based solely on automated processing.[1]

    Your first steps

    Your first steps

    1. Make an inventory of the AI tools and systems your company builds or uses, and mark any in education, hiring, credit or biometrics.
    2. Train staff who use AI, since the AI literacy duty has applied since 2 February 2025.
    3. Check that chatbots and AI-generated content are labelled where the AI Act transparency rules apply, from 2 August 2026.
    4. Run a data protection impact assessment before AI processes personal data at scale, and keep a person reviewing significant decisions.
    5. Prepare to report personal data breaches to AKI within 72 hours.
    6. Check TTJA and Riigi Teataja for the final Estonian AI supervision law.
    7. Use a GDPR transfer mechanism before personal data goes to a country without an adequacy decision.

    AI services for Estonia

    AI consulting and development for teams in Estonia

    We work remotely with companies in Estonia, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. India (UTC+5:30) is 3.5 hours ahead of Estonia in winter (UTC+2) and 2.5 hours ahead in summer (UTC+3). Taking a 9:00 to 17:00 day in Estonia and 9:30 to 18:30 in India, the overlap is about 6 hours in winter (09:00 to 15:00 Estonian time) and 7 hours in summer (09:00 to 16:00). India has no EU adequacy decision, so any personal data we handle needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Estonia

    Who will supervise the AI Act in Estonia?

    Not yet confirmed. The European Commission lists TTJA as Estonia's contact point for AI Act market surveillance, but notes the national decision was pending final adoption on 7 September 2026. AKI supervises data protection.

    Does the AI Act apply even without an Estonian law?

    Yes. It is an EU regulation and applies directly. A national law is still needed to name supervisors and set procedures, so enforcement details may change.

    What are the GDPR penalties in Estonia?

    Estonia handles them as misdemeanours under the Personal Data Protection Act. Fines can reach EUR 20 million, or 4% of worldwide turnover for a company, for the most serious breaches.

    We run an edtech product. When do high-risk rules start?

    If your AI decides admission, evaluates learning outcomes or monitors students during tests, it is an Annex III high-risk use. Those duties apply from 2 December 2027 after the Digital Omnibus on AI.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Publications Office of the European Union, 2016-04-27. Regulation (EU) 2016/679 (General Data Protection Regulation), Official…(publications.europa.eu)
      Full title and what we used it for

      Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal L 119, 4.5.2016. Primary. Official Journal text. Used for Articles 22, 33, 35 and 83.

    2. [2] Riigi Teataja, 2026-10-01. Isikuandmete kaitse seadus (current consolidated text)(riigiteataja.ee)
      Full title and what we used it for

      Isikuandmete kaitse seadus (current consolidated text). Primary. Read on 29 October 2026; text in force since 1 October 2026 (RT I, 30.06.2026, 52). Used for sections 8, 66 and 69 and the original dates (passed 12.12.2018, in force 15.01.2019). The English translation is at https://www.riigiteataja.ee/en/eli/523012019001/consolide (an older version).

    3. [3] European Commission, AI Act Service Desk, 2026-10-29. AI Act, Article 113 (Entry into force and application)(ai-act-service-desk.ec.europa.eu)
      Full title and what we used it for

      AI Act, Article 113 (Entry into force and application). Primary text as consolidated after the Digital Omnibus on AI. Article 99 (https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-99) was used for fines and Annex III (https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3) for high-risk areas.

    4. [4] European Commission, 2026-10-19. AI Act: regulatory framework for AI(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      AI Act: regulatory framework for AI. Primary. Used for the timeline and the Digital Omnibus on AI (Regulation (EU) 2026/1744 of 8 July 2026) entering into force on 27 July 2026.

    5. [5] European Commission, 2026-09-07. Market Surveillance Authorities under the AI Act(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      Market Surveillance Authorities under the AI Act. Primary. A list of single points of contact for market surveillance. Used for TTJA and the pending note. We also searched the Riigikogu and Riigi Teataja and found no adopted implementing law.

    6. [6] Ministry of Education and Research (Haridus- ja Teadusministeerium), 2025-02-25. Estonia announces a groundbreaking national initiative: AI Leap program…(hm.ee)
      Full title and what we used it for

      Estonia announces a groundbreaking national initiative: AI Leap programme to bring AI tools to all schools. Primary. Used for the launch date, grades and numbers. Figures are as announced; later reports give different teacher numbers.

    7. [7] EuroHPC Joint Undertaking, 2026-08-31. EuroHPC JU signs contract to deploy LUMI-AI supercomputer(eurohpc-ju.europa.eu)
      Full title and what we used it for

      EuroHPC JU signs contract to deploy LUMI-AI supercomputer. Primary. Used for Estonia's place in the consortium, the contract value and expected availability.

    8. [8] Eurostat, 2026-06-15. Artificial intelligence by size class of enterprise (isoc_eb_ai)(ec.europa.eu)
      Full title and what we used it for

      Artificial intelligence by size class of enterprise (isoc_eb_ai). Primary statistics. Enterprises with 10 or more staff, excluding the financial sector, using at least one AI technology.

    9. [9] European Commission, 2026-10-29. Adequacy decisions(commission.europa.eu)
      Full title and what we used it for

      Adequacy decisions. Primary. Used to confirm that India has no EU adequacy decision.

    This is general information, not legal advice. Estonia's AI supervision law was not confirmed as adopted when we checked, and the AI Act dates changed in 2026. Check with a qualified Estonian lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Estonia?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score