Estonia proposes digital identity for AI agents: a legal milestone

What happened?

The Estonian government has announced its intention to create digital identities for artificial intelligence agents, so they can act on behalf of individuals or legal entities with full verifiability and auditability. The proposal, backed by the Eesti.ai advisory council, contemplates the development of identification codes that AI agents will use to execute actions, subject to an authorization and task delegation process yet to be defined.

According to statements by Prime Minister Kristen Michal, reported by The Register, the measure responds to the need to clearly establish who acts on whose behalf, with what rights, and who is ultimately responsible. Estonia presents itself as the first country to create digital identities for AI agents.

Why is this important?

The Estonian initiative addresses a critical legal vacuum: as AI agents perform an increasing number of digital tasks—from preparing reports to interacting with information systems—traditional law is not prepared to assign responsibilities when autonomous software makes decisions affecting third parties. As professors Mark Riedl and Deven Desai point out in their article 'AI Agents and the Law', human agency law does not adapt well to software agents, as they cannot be disciplined through traditional legal sanctions.

The Estonian approach focuses on permission and accountability, in contrast to technical initiatives like OWASP's Agent Name Service or DNS for AI Discovery, which deal more with the infrastructure of discovery and interoperability among agents. Estonia, instead, puts the spotlight on the legal framework that allows agents to act with clear limits, preventing users from delegating excessive authority at the expense of their rights.

Consequences and global context

The Estonian proposal does not arise in a vacuum. Two weeks earlier, Argentine President Javier Milei backed a similar idea: legislating to allow 'non-human corporations' managed by software, with limited liability. Milei argued in an opinion piece in the Financial Times that limited liability is not a luxury but a prerequisite for the existence of such entities.

In the private sector, companies are already taking positions. Target Corporation modified its terms and conditions to include a section on 'Agentic Commerce and Delegated Access', establishing that purchases made by an authorized AI agent are considered transactions authorized by the customer. American Express, on the other hand, assumed responsibility for AI agent errors in purchases, offering protection to its cardholders.

These divergent stances reflect the current legal uncertainty. While Estonia bets on a state framework of digital identity, companies experiment with contractual clauses that either transfer risk to the user or assume it as a competitive advantage.

What should readers know?

Digital identity for AI agents is not just a technical issue but a legal paradigm shift. If Estonia succeeds in implementing its plan, it could become a model for other countries, similar to how its e-Residency system inspired digital identity initiatives worldwide.

However, open questions remain: how will it be ensured that an AI agent does not exceed delegated permissions? What audit and revocation mechanisms will be established? How will conflicts between agents from different jurisdictions be resolved? The Estonian proposal is a first step, but the path toward an ecosystem of legally responsible autonomous agents will be long and require international cooperation.

“In the future, AI will perform more and more digital tasks on our behalf. For that, it must be clear who acts on whose behalf, with what rights, and who is ultimately responsible.” — Kristen Michal, Prime Minister of Estonia

Implications for businesses and professionals

For startups and software companies, the Estonian initiative opens the door to new business models based on autonomous agents that can contract services, make payments, and sign digital contracts. Legal and compliance professionals will need to familiarize themselves with concepts such as algorithmic authority delegation and vicarious liability for AI agents.

In the productivity realm, AI agents with digital identity could automate complex administrative tasks, such as filing tax returns or managing bureaucratic procedures, with full legal validity. This could significantly reduce compliance costs and free up time for higher-value activities.