Many leaders I speak with in Australia are playing a high-stakes waiting game. They are holding back from deeply integrating AI into core operations until a comprehensive local regulatory handbook arrives. On the surface, this feels safe and pragmatic.
It is, however, an illusion.
By the time local legislation is finalised, AI has already moved on. We are shifting from static chatbots to agentic AI: systems that can execute workflows, make decisions and interact with software on our behalf. Waiting for perfect rules for a capability that changes daily is a recipe for irrelevance.
The good news? We don’t have to wait.
On a recent visit to Estonia, I saw the broader digital-governance mindset that makes this kind of move possible. Estonia offers a useful example of a nation looking beyond regulatory delay and exploring proactive governance structures for emerging technologies.
One of the baseline governance problems with AI agents today is identity. When an autonomous agent goes out onto the web, enters an enterprise system, or triggers a workflow on your behalf, it usually must borrow credentials. It logs in as you, gaining your blanket permissions to access data, files, or financial records.
If that agent misinterprets an instruction, or makes an unvetted transaction, who is accountable?
In June 2026, Estonia’s Government Office announced that the Eesti.ai advisory board had agreed to move forward with a proposal to create digital identities, or “AI ID codes”, for AI agents acting on behalf of people, companies or organisations. (Prime Minister Michal: Estonia to become first country to create digital identities for AI agents | Eesti Vabariigi Valitsus).
The aim is not to give an AI agent human rights. It is to make delegated authority visible: who authorised the agent, what it is allowed to do, and who remains accountable.
The governance question then becomes “Who, or what, is acting in our systems: under whose authority, with what limits, and with what audit trail?”. Model governance is an absolute requirement, but for agentic AI the more urgent controls may be identity, delegated authority, and auditable boundaries.
By looking outward and leaning into international developments in agentic identity frameworks, Australian organisations can build proactive, sovereign governance models right now.
Katie Williams PhD
