AI Agents Are Already Paying: Why EU Law Still Cannot Verify Their Mandate, Ilija R. & Aleksandra C.

Hello everyone. Uh thank you Miros for introduction. I'll skip that part. And um Anna already made a good uh intro to to what we are going to talk about. Uh and TLDDR uh as far as I understood it is uh looping your lawyer sooner rather than later.

Uh and yeah, let's talk about uh AI agents who are hot topic these days. But first, uh as a way of an intro, uh assume that my dog uh bites you or I forget handbreak uh on my car and it crashes into your vehicle. So uh who you going to sue? Uh my dog or my car? uh neither neither of that but but me because literally every legal system in the world has uh rules on those situations who is held liable for those who don't have legal capacity like a dog or a car you sue the owner and why I am bringing up this it's because uh if my AI agent moves couple of thousand and euros to uh wrong wallet.

Uh who is going to be liable? What can I do? Uh am I liable? Is the deployer of that agent liable or developer of that agent? Those are the questions that are still not uh truly answered.

Um so to begin with uh the the discussion you Alexandra already worked on um draft of of Serbian uh uh Serbian uh AI act version that looks like uh like the European AI act. Do you have uh some ideas or solutions how uh if anything uh AI in Serbia is regulated? So um I would say that uh first of all I don't think that Serbian AI act should be the same uh not only the same but uh I think that it shouldn't be similar to uh EU AI act because we are completely different market but uh when it comes to uh regulation of AI uh people um almost always think that it is not regulated now because we do not have specific ific law. Uh that is not true because uh usage of AI and uh any business transactions uh any business model you have uh whether you are using AI uh within it or not is already regulated by existing laws. uh when it comes to our topics uh and payments uh of course uh payments law regulates something completely different and uh it connects uh human centric transactions uh it always search human behind uh that transaction that is why we have uh IML KYC um and we have of course uh proofs and uh identifications of every transaction that is requested by the bank.

When we speak about AI agents and uh transactions in crypto, uh it is not the same uh on the EU level uh as when we speak about uh regular transactions. Uh we could we could speak about Mika. You will uh maybe know uh you will certainly know uh more about that. Uh we can speak about AI act but uh AI act is basically regulation about customer protection and uh it does not regulate concrete uh use cases uh if they are not of course perceived as risk use cases and qualified as high-risk uh usage cases. We have payments directive uh uh in uh EU.

Uh we have of course IML uh regulation sixth edition. uh we have uh something that is relatively new and this is regime which is maybe the closest to transactions uh when it comes to crypto and uh it basically uh certifies uh individual digital identity of course digital identity of uh entities as well but it is only about that about identity uh it is not about mandate and It is not about transactions specifically

and that's the the next segment before we uh go back to to EU regulations because technical standards like ERC uh 8004 uh that covers identity and uh enables uh identity and validation uh of AI agents. uh ERC 18 uh 8183 as well enables agent to aagent uh tasks and uh finally the most popular one probably uh X42 uh which uh enables um machine payments basically machine to machine payment or agent uh agent to agent payments. So there are there are several uh pieces of this puzzle uh that enable uh technically uh AI payments uh and we can boil them down to identity performance and actual uh payments but there is a piece that is missing and uh what that piece would be. Yeah, I like that you

and why that is the issue.

Yeah, I like that you uh presented this as the missing piece because we have a puzzle and within that puzzle we have technical standards and we have of course some legal provisions whatever they are. Um but we do not have actual proof that an AI agent uh was uh mandated to do what it did. uh we don't know what uh was the scope of its let's say power of attorney although we do not have power of attorney uh in machine readable way and that is basically the the core of this conversation and uh the search is basically where we should find it whether it is some technical standard or whether it is some legal standard I don't believe that legal standard uh could resolve this issue we have as I mentioned like uh five or six different legal uh frameworks and neither of that and for the reason um does not solve this issue when it comes to technical standards. I think that there are some ERC standards in in um let's say development but uh the issue should be uh resolved in a way that combines uh these two uh let's say different uh layers legal layer and technical layer. Um I don't know what you think but maybe uh maybe it is not uh only ERC standard maybe we can resolve it in some sort of let's say eidas uh sort of digital identity for AI agents and for payments which will not be uh for the time being uh legally uh accepted but it will be accepted by the community itself.

But the other issue then is what happens legally if something if something happens badly like if AI agent transacts for I don't know uh 100,000 and it should transact with €100.

So it's the question how do we react? Do are we reacting proactively as EU typically does to regulate everything in advance or to uh have the American approach when you wait uh for the betting to hit the fan and then you um do a do a cleanup. Uh uh so the issue with um authorization and why why we are talking about is basically how do I know that you are authorized to to do something to uh do you have a mandate to to do so for example to translate into human language um I'm a attorney at law I'm licensed one but can I out of southern file uh divorce uh divorce papers uh for for Miros. Is it um something that he authorized me to do or I did it at uh at will? Um

because you think he wants it or [laughter]

That's a good question. Uh how how do we uh proceed then? I mean in terms of of um legal profession and um these legal legacy industries it's kind of resolved but uh it's not how uh it's it's not well defined and uh not resolved on um AI uh level and what expedites uh and and accelerates the uh issue further is that we have stable coins which are um something uh quite new in financial industry and when you pair them with um AI agents at scale you can have hundreds of thousands of uh payments within a day or or even a short uh short period uh of time. And there are uh pieces of legislation that govern um stable coins like Mika, but they uh presuppose a human in the loop and they probably uh do not um do not cover u AI uh AI in the loop. Although there are uh transactions that happen with AI uh as we speak now.

So u although the mika tells that uh somebody or something uh is uh licensed, it does not tell us anything if that uh person agent or entity uh is allowed to to do. Again, for example, we know that a car is um technically good and registered uh to to be driven, but and you have uh driving license, but I don't know if that's your car and if you are entitled to to drive that car uh you are you are in uh which brings us to to the question when um and you already uh touched upon this If Mika does not solve it, can we somehow fit those um authorization issue um issues with AI agents into existing uh European uh regulatory framework?

Yeah. So since we are making um comparisons with uh existing laws and where we should put uh current state of uh transactions involving AI agents. I would use um also analogy with uh payments law and not not lawyerish stuff but imagine employee uh of a company that uh wants to do on behalf of the company certain transactions. So the company will certainly not be interested in uh the mere identity of the employee. uh it will ask whether that employee uh could uh whether it has a mandate by the company whether it was revoked uh let's say yesterday uh what is the limits of that mandate whether it is limited to transact with a certain person etc.

uh in this moment we do not have uh within current legislation uh on the European level uh nothing that covers there is no drawer that that holds uh the key to this question. We have Yidas which just um resolves identity issues but we do not have how to we do not know how to solve this mandate issues and if you have you have already registers for AI agents uh registry just confirms that AI agent exist. uh then uh we could of course with the different ERC standards uh check whether it is genuine but uh even if we use that ERC standard I don't know the number now uh which confirms that two AI agents transacted uh with each other and that transactions took uh place we cannot know uh basically uh whether it was within the scope of uh either mandate and uh even if we have uh now a perfect legal standard. Uh if we make uh comparison with the payments law, what do you think it will look like? Because you know banks always have some uh sort of commissions.

Yes. how it will be trans translated uh into machine readable way uh on the uh AI agents level if you have to basically also check whether that AI agent uh was authorized to do something. Uh well even if we find a perfect perfect legal solution for for this issue uh then it's matter of uh design and it's a commercial uh question how do you um charge for those authorizations because uh somebody has to build the way uh one agent confirms that another has uh the authorization or can perform certain uh transaction and the that commercial aspect is important because uh on on a on a scale with small transactions uh it doesn't make sense to uh pay couple of of euros for verification of of a mandate when transaction is is less. it makes sense for huge amounts but uh for for smaller amounts doesn't really make sense and um you uh you mentioned uh ADAS uh and uh just want to to follow up on on this EU regulations uh concerning the AI act since we don't have the law but the European Union has uh dedicated dedicated uh specifically for for AI. Does that help resolving the the problem with this or is it hinting somehow where we could uh go and find answer?

Yeah. So first of all AI act is technically agnostic and uh in most of its parts it is also agnostic to uh usage uh cases uh whether it is used for payments or something else. It just look whether uh persons or uh assets could be harmed. Uh here we could of course uh advocate for the for the fact that AI agent could uh do some damages if it acts uh outside of its limits. But uh AI act is more focused on when it comes to that um higher bar of uh compliance to use cases such as employment or uh education.

uh and when it comes to payments, it is concerned to individuals to humans uh in a sense that if you use AI agents or any other way of um AI tools to check whether um some human could uh use uh could get credit or something like that, it will be considered as high risk and it will uh be covered by AI act. If you are if you want to regulate something between machines, it is not covered by AI act and I personally think it shouldn't be. uh AI act should uh remain uh technically agnostic and uh we are basically in this sort of problem because it is crypto uh crypto is regulated by mika but I think that regulators at the time being uh didn't think that uh crypto will be moved without humans in the loop uh then we have layer of AI AI regulators thought about uh how to protect uh person's citizens But they didn't think that we have also other ways uh of involving AI even within blockchain and we have payments regulations and Ilia and I could confirm that um especially in Serbia we have a very bad uh foreign exchange law uh uh and uh

troublesome.

Yes. And uh even in EU that payments law is basically uh concerned to you know uh authentication of the customer that is human. Uh so I think that the national banks are the last ones and regulations about uh payments law that will tackle this issue. uh and I'm afraid uh actually what you said of the EU approach that we should regulate everything in advance because I don't want another regulation where I should think whether AI act is applicable or MIA is applicable or we have the third regulation that is potentially applicable when it comes to payments by AI agents. I think that it should be resolved in some sort of mix uh or protection uh or by existing uh laws uh especially damage uh like tors law uh and uh that uh some standards should be adopted which could be in certain way uh confirmed or approved by EU or any other market or jurisdiction like like Serbia.

And one more thing to to consider is that uh EU laws applicable to all uh 28 countries. But when it comes to mandates and authorizations, there are national uh pieces of legislation that govern this issue because it's not new. It it's uh it's around for for hundreds of years and uh civil codes recognize it. Um and assuming

I'm sorry for interrupting you and then if something happens you you could actually pick jurisdiction that is more favorable not you but uh like the parties involved that is more favorable to you to uh escape uh you know uh damages or your obligations just uh just to consider something

do little bit of treaty shopping.

Yeah. Um and assuming that something uh bad happens today with the current state of of uh regulations um what do you think who would uh who would be a liable and uh who would you point your finger to?

I think it depends whether it is some you know if AI agent could be equated with some white label solution or not. So uh if you were a company and you obtained AI agent and you deployed it and your AI agent made something uh then you should u just be responsible for that in the same way as for the employee. Um I don't think that if it is not some technical breach or a cyber security breach that the company that actually built and developed AI agent should be responsible. Uh but that is my opinion. Uh what is yours?

Well uh I have opinion too but uh un unlike uh computer or AI agent whom you unplug from the wall I think that Miros has authority to uh cut us cut us short. So we have to to stop here uh and wrap up that uh I would say we don't ask for another um another regulation another law that would govern this because we already have a lot of them and it's difficult to uh to navigate through them. Um what we need is kind of guidelines or interpretations how or effort to uh see if we can fit uh existing uh problem with AI agents into exist into into current current framework. Uh do we have a time for one question maybe?

Thank you for uh for the talk. Let's have a round of applause [applause] for Alexandra and Ilia. Uh yeah, let's have uh two questions. We have time for that and then we move on. Questions

and if you don't have questions, I have to has to answer uh to my question. So save him.

I have I have a question that I think well I've heard that for for a lot of times. Um who will go to jail? Who

who will go to jail if the agent breaks the law? You want the most typical uh you you already went to jail. I I just wanted that the damages [clears throat] are settled, but okay. If the jail is the answer

for for now, um you of course cannot send an AI agent to to jail. Uh you have to do tech uh tech due diligence or a techie investigation to see uh if you as a deployer was some somehow liable and if you deployed a problematic agent or your instructions were were bad and if it's not you maybe the developer of AI agent so it's

you you would try to do the investigation to see where the problem originates. I mean it's it's not I it's not me who would do the investigation is the course attorney general or prosecutor that would be the the

under current state of affairs

and it depends of course who is his client whether the company that deployed the AI agent or

Yeah.

Yeah. Are you defending or suing? Right. So it's okay. Yeah.

Let's have a question. I would say based on the projects you discussed with uh other than regulated entities deploying AI that have like a resilience uh requirements like Dora in the U and so on other entities how much of them ask the right questions when they integrate AI agents because if they're not forced by law so often I have the impression that they don't necessarily check everything but what is your experience? Yeah, I I I could try to answer this. Uh I I think that um we have as I mentioned at the beginning, we have already existing uh laws and uh it will come to not only criminal law but uh to tors law. Uh depending on whether it is payments or something else uh we can search whether there is some industry regulation.

Uh but for now uh Mika if it is not CASP uh which is also um of course obliged by IM IML regulations but it is just you and me you know then we are responsible for our actions as if we conclude some agreement and for example you are the one uh who deployed an AI agent I trusted that AI agent I didn't verify if you are if you just promised me something that I could sue you on the basis of that of on the basis of your promise but I cannot have some regulation or you or just say that you uh didn't achieve some standards because you are not a regulated entity.

Okay, thank you. I think this topic goes as deep as the the you know the AI agent stack goes right the data and where it comes from who is responsible where's the jurisdiction. So funny times a lot of work for lawyers right in the future. So let's let's have another round of applause.

Thank you very much.

Thank you.

Thank you guys. Thank you. Okay. Uh we will continue in a second.