Estonia’s AI agent ID plan raises new questions about digital identity

An AI agent is not a person. But is it an identity? In Estonia, the answer is now yes. The tech-forward nation has announced its intention to assign digital identities in the form of “AI ID codes” to AI agents, for identification purposes and to limit the scope of their activity.

A release from the office of Prime Minister Kristen Michal says the plan will “enable AI to act on behalf of people, companies or organisations within clearly defined limits and in a manner that is both verifiable and auditable.”

“In the future, AI will increasingly carry out digital tasks on our behalf. To that end, it must be clear who is acting on whose behalf with what rights, and who is ultimately responsible.” The goal is to make life easier but without losing control and accountability. “If we act quickly, and smartly, Estonia will become the first country in the world to create official digital identities for AI agents.”

Estonia has wider implications for agentic trust

Philipp Pointner, chief of digital identity at biometrics firm Jumio, says “Estonia’s decision to assign digital identification numbers to AI agents is setting a precedent on how we must audit what agents can do on behalf of an individual.”

“Estonia’s initiative recognizes that digital trust requires identity systems that can distinguish between human identity and agent authority. By creating these auditable permissions for agents, security and user control can be preserved, which will become a foundational requirement if agentic AI is going to operate safely at scale.”

It has been widely reported how AI agents are now part of the identity ecosystem, in that they require governance and authentication. Less has been written about how agents are changing identity at the conceptual level. AI agents can operate at scale, at machine speed. This gives them the power to shape what an organization’s activity looks like at a high level. Estonia’s position is that agents with the power to reshape culture must have built-in accountability. They must be more than just code: they need an identity.

Who am I? I am AI

A new publication from Boston Consulting Group argues exactly that. “Why AI Agents Need an Identity, Not Just Instructions” asserts that, “as AI agents grow more autonomous, companies must deliberately embed their purpose, values, and culture into every interaction – or risk scaling sameness.”

“Without cultural grounding, AI agent interactions fail to reflect the behaviors and experiences that differentiate companies and their brands,” says the paper. “Most agents today are still built to optimize for performance: speed, accuracy, efficiency, compliance. They are aligned to metrics, not to meaning.” That can erode cultural values that organizations have invested ample time and money to establish.

“Customer interactions become consistent but not distinctive; decisions become efficient but not principled; experiences become scalable but not meaningful. The system works. But it no longer reflects who the organization is.”

The upshot is that governing AI agents means more than metrical safeguards and compliance measures. As with human governance, it also involves optics, values, messaging, reputation and culture. “If agents are going to represent companies, then the company’s identity has to be translated into a language that systems are comfortable with,” the piece says.

Culture must be embedded into AI systems

The case of Estonia backs this up. The Institute of the Estonian Language (IEL) assesses and benchmarks “the quality of large language models in Estonian, their knowledge of the Estonian cultural sphere and their resistance to propaganda.” The organization believes “is not enough to simply adopt the technology: Estonia must also play a part in the development of Estonian-language AI, primarily by ensuring the availability of high-quality pre- and post-training data.” In other words, AI must speak Estonian, both literally and (if you will) spiritually.

BCG says that applies for businesses, as well. “In fully reflective agentic design, companies need to turn purpose, values, and behaviors into operational guidance.” A culture must be fostered; it can “no longer remain implicit,” but must “be embedded directly into how systems operate, make decisions, and interact with people.”

Turning organizational identity into operational logic is not easy. A luxury hospitality firm looking to integrate agents into its workflow will effectively need to learn to train its agents with the same rigor and effect it applies in training human workers. No one wants a rogue AI to spoil their vacation, and no resort wants a review that suggests the company might be getting sloppy in how it deploys new systems.

Integrity not a prompt: BCG

“Values are not rules,” the authors note. “They are beliefs and principles formed through thousands of human decisions, shaped by context, exception, and precedent. The challenge of making culture computable is, at its core, the challenge of making tacit knowledge explicit.”

The implication is of existential import for the AI economy. The quest to get humans to use AI may hinge on making AI more human – and does not eliminate the risk that people may just end up preferring the real thing, after all.

Article Topics

AI agents  |  AI ID  |  digital identity  |  digital trust  |  Estonia  |  Jumio  |  non-human identities