What is Agentic Government?

Agentic government is an emerging way of designing public services in which an AI system can pursue a bounded task across information, tools, and service interfaces on a person’s behalf. Its promise is not a government run by autonomous models; it is more usable public administration with authority, accountability, and safeguards designed into every consequential action.

Key takeaway: An agent may help plan and prepare, but a legitimate public-service action still needs a lawful basis, a clearly bounded authority, a responsible institution, and an enforceable decision point.

A pattern, not a legal category

“Agentic government” is best understood as an architectural and governance pattern, not as an established legal category. The pattern combines an AI system that can interpret a goal, select steps, use approved tools, and adapt its course with public-service controls that constrain what may actually happen. A citizen might ask for help assembling evidence for a benefit application, checking a record, or preparing a submission. An agentic system could retrieve authorised information, explain the process, draft an application, and propose the next action. It becomes materially different when it can initiate a real transaction through a government interface.

The EU AI Act does not define an “agentic system.” It defines an AI system more broadly as a machine-based system operating with varying levels of autonomy that may adapt after deployment and that infers how to generate outputs capable of influencing physical or virtual environments. Whether an agentic application falls within the Act, and what duties attach, therefore depends on its design and intended use—not on the label “agentic.” [6]

Beyond the chatbot, the workflow, and the forecast

Ordinary AI tools can be valuable in government without being agentic. The difference is principally about agency over a multi-step objective and the ability to affect an external system.

Pattern	Primary function	Typical degree of action	Core public-sector control question
Conversational chatbot	Answers questions or guides a user	No action beyond the conversation	Is information accurate, accessible, and clearly identified as AI-generated where required?
Robotic process automation (RPA)	Repeats pre-specified rules and steps	Executes a fixed workflow	Are rules correct, exception paths safe, and changes controlled?
Predictive or analytical AI	Produces a score, forecast, classification, or recommendation	Influences a human or downstream process	Is the use valid, fair, explainable enough, and appropriately reviewed?
Agentic AI	Interprets an objective, plans, invokes tools, and revises steps toward an outcome	May act across systems within delegated limits	Who delegated authority, what is the exact scope, and what stops or confirms a consequential act?

An agent links reasoning, tool use, and iteration: it can decide that a missing document should be requested, find the relevant service, prepare the request, and attempt to advance the task. That broader operational reach is why the governance problem changes from answer quality alone to delegation, authorization, and execution control.

The authority chain is the design problem

A credible design separates four things that are too often merged: identity, mandate, decision, and execution.

• Identity establishes who the person or organisation is.
• A mandate establishes what the person has empowered an agent to attempt, with an explicit purpose, service, resource, limit, and expiry.
• The responsible public service evaluates the request against current law, policy, and authoritative case data.
• Only then should a constrained execution component make the change and produce a durable record.

The service that owns the record or statutory process must remain the policy-enforcement point. It should verify credentials and workload identity, evaluate the proposed action against current state, and return an explicit outcome: permit, require confirmation, or deny. For consequential acts, confirmation should show the citizen the exact transaction that will be submitted—not a model-generated paraphrase—and must be cryptographically bound to that payload. The action should also be idempotent, ensuring a network retry cannot silently produce duplicate payments, filings, or records.

Project perspective: delegation rather than magical autonomy

In my technical blueprint essay, Technology Does Not Create Public Value (also published on the AgenticGov project site), I presented this exact architectural framing: process and legal authority must precede the model, citizen delegation must be strictly bounded, and the public service must retain the final decision. On the AgenticGov FAQ, I clarify that this architecture is an independent proposal—its reference evaluator uses synthetic state to demonstrate the concepts, and it is a specification for what is required rather than a description of an existing national deployment. Those are design propositions to guide safe, principled implementation—not a claim that such an architecture is already an established public-sector standard or operating service. [2] [3]

The AgenticGov project distils the challenge as a delegation problem rather than an AI problem, proposing that a public service permit, request confirmation, or deny each request strictly at its own boundary. It is a necessary reminder that technical fluency should never be confused with public authority. [1]

Human authority is more than a review button

Human oversight should be designed around authority, competence, and timing. A nominal human who rubber-stamps hundreds of opaque recommendations is not meaningful control. For low-consequence tasks, people may set preferences, observe execution, and intervene after the fact. For actions with legal, financial, or rights consequences, an institution should decide which actions an agent may prepare, which require a caseworker’s reasoned judgment, which require the affected person’s explicit confirmation, and which are unsuitable for automation.

The EU AI Act [6] requires high-risk systems to be designed for effective oversight by natural persons. Its oversight provisions include understanding relevant limitations, avoiding automation bias, correctly interpreting output, deciding not to use it, and intervening or stopping it safely. That is a useful floor, but administrative legitimacy also needs procedures outside AI regulation: notice, reasons, appropriate review, an accessible human channel, and mechanisms to contest errors.

Data protection adds a separate constraint. Under Article 22 of the General Data Protection Regulation (GDPR) [8], a person has the right not to be subject to a solely automated decision with legal or similarly significant effects, subject to specified exceptions. Where an exception relies on law, that law must provide suitable safeguards; in contract and consent cases, safeguards include human intervention, an opportunity to express a view, and the right to contest the decision. An agent that prepares a case is not necessarily making the decision, but naming a system “assistive” will not resolve the question if its output in practice determines the outcome.

Security: assume the agent can be misled

An agent is exposed to risks that a fixed form or workflow may never face. It reads webpages, emails, uploads, and tool responses that can contain hostile instructions. NIST notes that direct and indirect prompt injection can exploit the way language-model applications combine data and instructions; when agents have tools, the risk can extend to arbitrary code execution or data exfiltration. Current mitigations do not fully protect against all techniques, so designs should assume exposure to untrusted inputs. [10]

The appropriate response is defence in depth, not confidence in a better prompt:

• Isolate models from direct writes: Keep model output away from direct database writes and privileged commands.
• Constrained tools: Use typed, allow-listed tools with narrow parameters.
• Workload identity: Isolate credentials and bind tokens to the intended service and workload.
• Deterministic verification: Validate schemas, business rules, and state preconditions in deterministic code.
• Auditability: Log proposed and committed actions in an immutable audit trail.
• Fail closed: Make protected writes fail closed when evidence is stale, incomplete, or inconsistent.

Risk management must also be organisational. NIST’s AI Risk Management Framework (AI RMF 1.0) [9] treats governance as cross-cutting and organizes work through GOVERN, MAP, MEASURE, and MANAGE. It calls for clear accountability, documented legal and regulatory requirements, defined roles, and ongoing monitoring. Its Generative AI Profile [11] identifies risks including confabulation, privacy, harmful bias, information integrity, and information security. For a public body, that translates into a named service owner, security owner, data-protection input, procurement and vendor controls, incident response, audit access, performance monitoring, and a funded route to suspend or retire the system.

What the EU AI Act does—and does not—settle

The AI Act is a risk-based framework that assigns obligations to relevant operators, including providers and deployers; it does not itself grant a public body authority to conduct an administrative task. It also does not make every citizen-facing assistant high-risk. Annex III systems may be high-risk, but the Act allows a narrowly defined exception where an Annex III use does not pose a significant risk and, for example, performs a narrow procedural or preparatory task without materially influencing a decision. Profiling remains high-risk in that provision. Classification must be documented and assessed against the actual intended purpose. [6]

For current implementation, the European Commission [7] states that the Act entered into force on 1 August 2024 and is generally applicable from 2 August 2026. Prohibitions and AI-literacy obligations applied from 2 February 2025, while rules for high-risk systems in certain sensitive areas, including public services, are scheduled to apply from 2 December 2027; high-risk systems embedded in regulated products follow on 2 August 2028. The Commission also lists risk management, data quality, logging, documentation, information to deployers, human oversight, robustness, cybersecurity, and accuracy among high-risk obligations. These dates describe the AI Act’s phased regime, not a pause in GDPR, administrative law, cybersecurity, procurement, or sector-specific duties.

An implementation path that earns trust

The sensible starting point is a service failure, not a model demonstration. Agencies should first map the user journey, legal basis, decision rights, data sources, failure modes, and appeal paths. They can then pilot an information and preparation service with no ability to commit changes, measure completion, correction, escalation, and disparate outcomes, and only later consider a reversible action with narrow permissions.

Estonia offers useful examples of that distinction. The Estonian Information System Authority describes Bürokratt [4] as a virtual assistant that helps citizens find public-service information and directs them to customer service when it gets stuck. Separately, Estonia’s Government Office describes TarkRisk [5] as a 2026–2028 project to develop and test an AI-based prototype in at least three local authorities to support the preparation of risk assessments, capability assessments, and crisis plans. Neither official description establishes that Estonia has deployed autonomous government agents acting with administrative authority on citizens’ behalf. They instead show information, preparation, and prototyping—important but different stages on the path to more consequential automation.

Conclusion

Agentic government is not the proposition that a machine should govern. It is the more demanding proposition that public services can offer proactive, tool-using assistance while preserving the chain from legal authority to accountable decision. The technology will evolve quickly; the durable work is to specify mandates, enforce service-side limits, preserve human and institutional responsibility, secure the execution boundary, and leave people with intelligible reasons and redress.

Agencies that make those conditions real may gain useful new capability. Agencies that skip them will merely automate ambiguity.

References

• [1] Agentic Government: Delegation and Trust — Architectural proposal and reference implementation for bounded citizen delegation.
• [2] Alvar Laigna, Technology Does Not Create Public Value (also published on alvarlaigna.com) — Technical blueprint on process redesign and legal authority in agentic government.
• [3] Agentic Government FAQ — Frequently asked questions on the architecture, synthetic test state, and public-sector deployment realities.
• [4] Estonian Information System Authority (RIA), Bürokratt — The national public service AI virtual assistant network.
• [5] Riigikantselei (Government Office of Estonia), TarkRisk: AI Assistant for Improving Crisis Preparedness — Public sector innovation pilot project (2026–2028).
• [6] European Union, Regulation (EU) 2024/1689 (Artificial Intelligence Act) — Consolidated legal text laying down harmonised rules on artificial intelligence.
• [7] European Commission, AI Act: Shaping Europe’s Digital Future — Implementation timeline and policy overview.
• [8] European Union, Regulation (EU) 2016/679 (General Data Protection Regulation) — Article 22: Automated individual decision-making, including profiling.
• [9] National Institute of Standards and Technology (NIST), Artificial Intelligence Risk Management Framework (AI RMF 1.0) — NIST Special Publication AI 100-1.
• [10] National Institute of Standards and Technology (NIST), Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — NIST SP 100-2e2025.
• [11] National Institute of Standards and Technology (NIST), AI RMF Generative AI Profile — NIST SP 600-1.