The Accountability Gap AI Agents Create
When an AI agent files a tax declaration, processes a payment, or queries a government database on your behalf, whose identity does it use? Under every digital-identity framework currently in force — including Estonia's own X-Road — the answer is yours. Agents either borrow the full credentials of their human or corporate principal, or they operate outside formal identity systems entirely. The first option grants machine-speed software the complete legal footprint of a person or company. The second creates an accountability void. Both are untenable as agentic AI scales.
On June 16, 2026, Estonian Prime Minister Kristen Michal approved a proposal by the Eesti.ai advisory council to resolve this structurally. Estonia will issue "AI ID codes" — discrete digital identities for AI agents that are legally distinct from the humans, companies, or institutions they serve. The system allows agents to act within defined, auditable, and revocable permission scopes rather than inheriting the full rights of their principal. If the proposal advances into law on schedule, Estonia will be the first country in the world to create an official digital identity framework for autonomous software.
What AI ID Codes Would Actually Do
The mechanics build on infrastructure Estonia has been developing since 2001. X-Road — the country's interoperability data exchange layer — now processes approximately 2.2 billion transactions per year, connecting more than 52,000 organisations through over 3,000 e-services. Every Estonian resident over 15 holds a digital ID card; 100 percent of government services are accessible online. Estonia's e-ID ecosystem is not a product but a trust platform on which further services are layered.
The AI ID code extends this architecture. As PM Michal stated: "In the future, AI will increasingly carry out digital tasks on our behalf, compiling reports, preparing declarations or interacting with information systems. To that end, it must be clear who is acting on whose behalf with what rights, and who is ultimately responsible."
In practice, an AI agent holding its own ID code could be authorised to view a dataset but not modify it, draft a payment but not execute it, or interact with a specific government service only within a prescribed financial ceiling. When the transaction is logged on X-Road, the audit trail names the agent separately from its principal — ensuring granular traceability without requiring the principal's credentials to flow through the agent's session.
This is a least-privilege model applied to autonomous software: instead of the AI carrying a master key, it receives a key that opens only the doors it has been explicitly delegated to open.
The Strongest Case For Caution
Skeptics deserve a fair hearing. Georgia Tech academics Mark Riedl and Deven Desai identified a structural problem The Register surfaced in its coverage of this proposal: a software agent is not the same as a human agent under existing law. Human agents face financial and criminal liability that disciplines behaviour. Software agents cannot be fined, imprisoned, or deterred by reputational harm. Granting them formal identities risks producing the appearance of accountability — a legible audit trail — without its substance; human victims may still lack meaningful recourse against a legal phantom.
There is also the question of scope creep. Assigning an entity an ID code implies administrative standing. If AI agents can hold IDs, file documents, and transact within government systems, the line between "tool" and "actor" becomes progressively harder to draw in courts. The EU AI Act (Regulation 2024/1689), which entered application in August 2024 and covers Estonia as an EU member state, governs AI systems by risk class but does not address identity for autonomous agents. Estonia's initiative begins to fill that gap — but could also invite inconsistent interpretations across the 27-member bloc if Brussels does not follow with harmonised standards.
Why the Proposal Is Still the Right Direction
The case for proceeding is not that these concerns are wrong — it is that the status quo is already worse. Agentic AI products from OpenAI, Anthropic, Google, and Microsoft are already operating at scale. Without formal identity infrastructure, agents either inherit full human credentials (overbroad) or remain anonymous (unaccountable). A structured, limited-rights model with a clear audit trail is less dangerous than either alternative.
Critically, the Estonian proposal does not grant AI agents rights of their own — it defines the rights they may exercise on behalf of others. This is a delegation framework, not a legal-personhood bill. PM Michal's framing is clear: the purpose is to clarify responsibility upward to the human or corporate principal, not to create a new class of rights-bearing entity. That distinction must be preserved in drafting.
Estonia's track record earns it credibility here. The country that digitised national elections, healthcare, tax filing, and corporate registration — and that built X-Road into a platform now adopted in more than 20 countries, saving an estimated 1,345 person-years of working time annually — has demonstrated that digital governance infrastructure can be built carefully and iteratively. The Eesti.ai advisory board is the policy engine for the "Most AI-Savvy Nation" national programme, combining technical deployment with broad AI literacy.
The Cross-Border Test
The June 16 decision is an approval to develop the framework, not a finished statute. Estonia must now define technical standards, determine how AI ID codes integrate with X-Road's security protocols, and address cross-border recognition — particularly within the EU's eIDAS 2.0 framework (Regulation 2024/1183), which extended mutual recognition of digital identities across the bloc but was written for natural and legal persons, not autonomous agents.
X-Road already operates across 20-plus countries. If AI agent IDs issued by Estonia are unrecognised — or legally contested — by Finland or other X-Road partners, the system's value shrinks to domestic transactions. The more consequential outcome is if Estonia moves fast enough to draft the standard before the EU machinery moves, becoming to agentic identity what it became to government interoperability: the country whose proof of concept became everybody else's starting point.