2026-09-10 | IT Law
What Does Know Your Agent Mean?
Know Your Agent, or KYA, is an emerging governance approach aimed at the identification, authorisation and accountability of AI agents.
Its core idea is that, in the case of an AI agent, it should be possible to establish not only which system the agent belongs to, but also on whose behalf it is acting, what authority it has been granted, within what limits it may operate, and to whom the actions it performs can ultimately be attributed.
In this sense, KYA can be understood as an extension of the traditional “Know Your Customer” concept. While KYC seeks to answer the question of who the customer is, KYA asks: who or what is actually acting on the customer’s behalf, and under what authority?
This is particularly significant in the financial sector, where a transaction or decision initiated by an AI agent may have direct financial and legal consequences.
The AI Agent as a Representative?
From a legal perspective, the issue is particularly interesting because, at first glance, the situation resembles representation under civil law. In the traditional model, the principal grants authority to a representative, who then makes a legal declaration on behalf of the principal.
A similar structure may emerge in the case of an AI agent:
user – authorisation – AI agent – third party
Under the rules of the Hungarian Civil Code governing representation, a legal declaration made by a representative in the name of the principal – provided that appropriate authority to represent exists – directly entitles and binds the principal.
This does not, however, automatically mean that an AI agent itself would qualify as a representative within the meaning of the Civil Code. On the contrary, the emergence of autonomous systems raises the question of how existing rules on representation can be applied in situations where the specific act is performed not by a natural person, but by a technological system.
KYA may become significant in this context because it could document the chain of authorisation and make it technically verifiable.
What Happens If the AI Exceeds Its Authority?
Suppose a user authorises an AI agent to purchase a specified product for no more than HUF 100,000. The agent nevertheless completes a purchase worth HUF 250,000.
In such a case, it is not sufficient simply to say that “the AI made a mistake”. From a legal perspective, it must be determined what authority was granted, what the scope of that authority was, and whether the action carried out by the agent remained within those limits.
The Hungarian Civil Code also contains rules on so-called unauthorised representation. Where a person makes a legal declaration in the name of another person without authority to represent them, or exceeds the scope of their authority, the legal effect of that declaration may, among other things, depend on subsequent approval by the purported principal.
Accordingly, there is already a legal framework governing the consequences of an absence of authority or an excess of authority.
In the case of AI agents, however, a new issue arises: how can the content and scope of the authorisation be proven? If a system performs operations automatically across several services, potentially involving other agents, it may be necessary in a subsequent dispute to reconstruct precisely which instructions the agent acted upon and within what limits of authority it was operating.
Who Is Liable If the AI Makes a Mistake?
In a dispute arising from the operation of an AI agent, the liability of several actors may potentially come into consideration.
The legal assessment may differ depending on whether the user granted excessively broad authority, whether the incident resulted from a technical failure attributable to the provider of the AI agent, or whether the third party failed to adequately verify the agent’s authority.
The issue, therefore, is not necessarily the creation of a new and separate category of “AI liability”. Rather, it is about determining how existing rules on contractual liability, representation, damages and, where applicable, sector-specific liability should be applied to actions carried out by AI agents.
Verifiability Will Be One of the Key Issues
One of the most important practical benefits of KYA may therefore lie not merely in identifying the agent itself, but in ensuring that the entire chain of actions can be documented and subsequently verified.
In a legal dispute, the relevant questions will not be limited to:
“Which AI agent executed the transaction?”
It will also be necessary to ask:
“Who authorised it?”
“What was the scope of that authority?”
The verifiable recording of an agent’s identity, permissions, operation and actions may therefore prove significant not only from a technological perspective, but also from an evidentiary one.
AI May Be Autonomous, but Liability Cannot Be
The development of Know Your Agent highlights that the spread of AI agents does not necessarily require the law to invent entirely new concepts. Rather, existing legal categories – in particular representation, authority and liability – may need to be interpreted and applied in a way that reflects how autonomous systems operate.
Ultimately, one of the most important questions raised by KYA is therefore not simply:
“Who is the agent?”
but rather:
“Who stands behind it, what authority has it been granted, and who bears the consequences if it acts beyond that authority?”
