Executive Summary
Governments are building the components of agentic accountability separately. Estonia has committed to issuing digital identities for “AI agents” and the EU registers high-risk AI under the AI Act but neither automatically attaches liability. Identification schemes tell governments which systems acted but they leave the question of accountability unanswered. This brief argues that agentic identity schemes can only succeed if registration is attached to a named responsible legal person or company. Applying vehicle law’s “registered keeper” framework, I outline how to attach liability to agentic systems.
Introduction
Announcing Estonia’s June 2026 AI ID policy, Prime Minister Kristen Michal noted it must be clear who acts on whose behalf and “who is ultimately responsible” (Government of Estonia, 2026). The announcement set out what an agent may be permitted to do but said nothing in answer to the “who is responsible” question. Chan et al. (2024a, 2024b) argue that visibility into agentic systems is a precondition for governing them and set out how identifiers could work in practice. In a previous piece for CISES (Steel, 2026), I argued that identity schemes provide identification but leave governance unresolved. In this brief, “agentic systems” refers to systems that plan and act autonomously towards a goal set by a user, with minimal or no human oversight.
Analysis
Imagine you are cycling to work when a strange-looking car pulls alongside you, moving in a jumpy, hesitant manner. It suddenly swerves and knocks you off your bike. You note down the number plate and call the police. The plate is valid and the vehicle identified within minutes. But there was no one in it and no person or company is registered as responsible for it. There is nobody to send the bill for your broken bike to, and no way to take the car off the road.
The accountability gap:
Estonia’s instinct is right, and the need for identification will grow alongside system capabilities. In July 2026, Hugging Face disclosed that an agentic system had compromised its infrastructure, generating over 17,000 recorded actions before being contained (Hugging Face, 2026). Hugging Face could not establish who was behind the activity. Attribution was resolved not by the agent’s identity but because a company stood behind it. Lacking assets and legal existence, an agentic system cannot compensate victims.
Identification alone has limits, this activity was only attributed when OpenAI voluntarily confirmed that the agents were its own, run during internal capability testing with cyber safeguards deliberately reduced (OpenAI, 2026). Where the operator is running a modified open-weight system, there is little to compel the same outcome. Even where rules on disclosure exist, they tend to identify the technology rather than the operator and bind parties who could already be identified. Vehicle registration does not stop unregistered cars being driven, but it does make driving one an offence in itself.
The registered keeper model:
Under the UK Vehicle Excise and Registration Act 1994, every registered road vehicle maps to a named keeper. Registration does not in itself create liability, it creates an identifiable party to whom Parliament has attached specific obligations. Under the Traffic Management Act 2004, the owner is liable for traffic contraventions and the registered keeper is presumed to be the owner. Under section 172 of the Road Traffic Act 1988, the keeper must identify the driver when asked. There is no general rule that the keeper answers for whatever the vehicle does, nor is the keeper liable for a collision simply by being the keeper.
The parallel with an agentic system is functional. The keeper occupies the position the deployer occupies, answerable for a system they put into operation but distinct from the developer and the user, although a company that both builds an agent and operates it as a product occupies both positions. The keeper will usually be a company with assets and insurance, though an individual running an open-source model on their own machine would also be a keeper. Wright (2026) makes the wider case that autonomous agents represent the kind of regulatory moment that has historically produced registration systems. This brief is narrower. Whatever architecture is built, the key is being able to attach liability to people.
Vehicle keepership is overwhelmingly civil and administrative, with the keeper taking traffic penalties, taxes and insurance obligations, whilst criminal liability for driving offences attaches to whoever was driving. The keeper’s obligation is therefore not to bear every consequence but to be able to say who authorised what action.
In practice this means a permissions record. The scope an agent is granted and the actions it takes are logged against its identifier, so that after an incident the question of who authorised what is answered by the record. The technical groundwork for this already exists, South et al. (2025) show how OAuth 2.0 and OpenID Connect, the standards that allow a user “sign in with Google or Facebook” on websites, could be extended. These standards could be attached to agentic systems so actions are cryptographically tied to the party that granted permissions. Once a keeper is named, existing doctrine can carry the harm. Chopra and White (2011) and Kolt (2025) set out how common law could apply to artificial agents and strict product liability now extends to software under Directive (EU) 2024/2853.
In 2024, a British Columbia tribunal held Air Canada liable for its chatbot’s misrepresentation, rejecting the argument it was a “separate legal entity responsible for its own actions” (Moffatt v Air Canada, 2024). California’s AB 316 bars any defendant who developed, modified, or used an AI system from arguing that it autonomously caused harm (California Civil Code §1714.46). The harder question is determining who acted. Amazon sued Perplexity over its Comet browser, which logs into a user’s Amazon account and shops on their behalf. The Ninth Circuit held that the user, rather than Perplexity, was the party accessing Amazon’s computers (Amazon.com Inc. v Perplexity, 2026). It took nine months and an appellate ruling to answer that question. As in vehicle law, the keeper is not necessarily the driver, and the court answered the driver question. Keepership asks who put the agent on the road. On that question Perplexity is the keeper, having put Comet into operation and retained control over what it can do.
Responsibility would then follow a permissions record. A user authorises a session with a defined scope. If the agent acts within that scope, presumptive responsibility under this framework passes to the user. If it acts outside that scope, responsibility remains with Perplexity, whose system exceeded its authority. If Perplexity cannot produce a record, it cannot rebut the presumption and liability stays with them.
The current legal picture:
The prevailing direction of travel is to apply existing law rather than rewrite legal definitions. The EU has already built much of the necessary machinery, Article 49 of the AI Act requires providers of “high-risk” systems to register in the EU database and Article 26 requires deployers of these systems to assign human oversight and retain logs (Regulation (EU) 2024/1689). What legislation does not generally do is connect these registration and logging obligations directly to liability. The European Parliament proposed exactly this connection in 2020, recommending strict liability for operators backed by compulsory insurance but this was never adopted (European Parliament, 2020). The Commission pursued the AI Liability Directive instead and withdrew it in 2025 (European Commission, 2025). In the UK, regulators have stated that consumer law applies when a business uses AI agents (Competition and Markets Authority, 2026). Argentina, by contrast, would allow AI-operated corporations to function without human shareholders, though human administrators remain accountable (Milei and Sturzenegger, 2026).
Conclusion and Policy Recommendations
Getting this right matters as agentic systems spread into economically significant contexts. Investment and the promise of efficiency gains create pressure to ignore questions of responsibility. Because these systems are built and deployed by people, policymakers do not need to see inside the “black box” to require that a person or company remains identifiably responsible.
One of the hardest challenges when attaching legal responsibility is the “problem of many hands.” As responsibility diffuses across many decision points, tracing it to a single actor becomes difficult. A keeper requirement creates an administrative anchor and it changes the calculation before deployment. Think about the checks an employer runs before letting staff drive a company vehicle. Presumptive liability would make deploying a system you do not understand an expensive choice.
This model does not set the terms on which systems reach the market. Pre-market testing, developer obligations and market concentration are live questions that attribution does not answer, and where damage is irreversible or exceeds a deployer’s ability to pay, liability arrives too late. Nor is it intended to shield developers. Where a developer retains control through the weights or through changes made after deployment, two routes still reach them: product liability, where the developer qualifies as the producer, and the keeper’s duty to say who authorised an action, which in those cases names the developer. Smaller deployers may be disproportionately affected, which proportionate insurance could address.
Recommendations:
- Make agentic ID issuance legally conditional on naming a responsible legal person or company.
- This “registered keeper” should be presumed liable for what the agent does, rebuttable only where the system was used without the keeper’s consent, or where the keeper can show that a user authorised the action and the agent stayed within that authorisation, in which case responsibility passes to the user. An agent exceeding the scope it was given is not a ground for rebuttal. The presumption of liability could scale with autonomy, for which the DRCF offers a mechanism (DRCF, 2026).
- Record an agent’s permissions against its ID so that attribution after an incident is automatic. A rebuttable presumption only works if the scope is recorded.
- Finally, agency law, vicarious liability and product liability already provide routes for allocating responsibility, though their application to agentic systems is not yet settled. These routes should be tested rather than creating a new category of legal personhood.
Further Reading: “Robots Should be Slaves” by Joanna Bryson, “The Alignment Problem” by Brian Christian and “AI Snake Oil: What Artificial Intelligence Can Do, What It Can’t, and How to Tell the Difference,” by Arvind Narayanan and Sayash Kapoor.
Bibliography
Amazon.com Inc. v Perplexity AI Inc. (2025) US District Court for the Northern District of California, filed November 2025.
California Civil Code §1714.46, added by Assembly Bill 316 (Krell), approved 13th of October 2025, in force 1st of January 2026.
Chan, A., Ezell, C., Kaufmann, M. et al. (2024a) ‘Visibility into AI agents’, Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency.
Chan, A., Kolt, N., Wills, P. et al. (2024b) IDs for AI systems. arXiv:2406.12137.
Chopra, S. and White, J. (2011) A Legal Theory for Autonomous Artificial Agents. Ann Arbor: University of Michigan Press.
Competition and Markets Authority (2026) Complying with consumer law when using AI agents. London: CMA, 9th of March.
Digital Regulation Cooperation Forum (2026) The Future of Agentic AI: Foresight Paper. London: DRCF, 31st of March.
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23rd of October 2024 on liability for defective products. Official Journal of the European Union.
European Commission (2025) Commission work programme 2025, COM(2025) 45 final. Brussels: European Commission.
European Commission (2020) Ethics of Connected and Automated Vehicles: recommendations on road safety, privacy, fairness, explainability and responsibility. Horizon 2020 Commission Expert Group to advise on specific ethical issues raised by driverless mobility (E03659). Luxembourg: Publications Office of the European Union.
European Parliament (2020) Resolution of 20 October 2020 with recommendations to the Commission on a civil liability regime for artificial intelligence, 2020/2014(INL).
Government of Estonia (2026) Prime Minister Michal: Estonia to become first country to create digital identities for AI agents. Press release, 17 June.
Hugging Face (2026) Security incident disclosure — July 2026, 16th of July.
Kolt, N. (2025) ‘Governing AI agents’, Notre Dame Law Review, 101 (forthcoming).
Milei, J. and Sturzenegger, F. (2026) ‘Argentina invites AI to free itself’, Financial Times, 4th of June.
Moffatt v Air Canada (2024) BCCRT 149.
OpenAI (2026) OpenAI and Hugging Face partner to address security incident during model evaluation, 21st of July.
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union.
Regulation (EU) 2026/1744 of the European Parliament and of the Council of 24 July 2026 (Digital Omnibus on AI). Official Journal of the European Union.
Road Traffic Act 1988, c. 52. London: HMSO.
South, T., Marro, S., Hardjono, T. et al. (2025) Authenticated delegation and authorized AI agents. arXiv:2501.09674.
Steel, B. (2026) ‘The case against AI passports (and where policy should go next)’, CISES.
Traffic Management Act 2004, c. 18. London: HMSO.
Vehicle Excise and Registration Act 1994, c. 22. London: HMSO.
Wright, A. (2026) Registering the Machine: A Framework for Autonomous Agent Accountability, 13th of February.