--- title: "Know Your Agent in Germany: verifying AI agents" url: https://knowyouragent.ch/en/know-your-agent-germany lang: en updated: 2026-10-13 license: © Innopulse Consulting GmbH --- # Know Your Agent in Germany: verifying AI agents Know Your Agent (KYA) means verifying whether an AI agent was authorized for a specific action, with evidence that third parties can recompute independently. In Germany, this ties in with the Civil Code, the GDPR and the upcoming EUDI wallet. [Leutrim Miftaraj](https://knowyouragent.ch/en/about/leutrim-miftaraj), Founder, Innopulse Consulting GmbH Published 13 October 2026 ## Key points - Know Your Agent verifies whether an AI agent was authorized for an action, with recomputable evidence. - According to the prevailing view, automatically generated declarations are attributed to whoever deploys the system. - The GDPR applies to agents processing personal data, supplemented by the Federal Data Protection Act. - The EUDI wallet under eIDAS 2.0 can in future prove an agent's [principal](https://knowyouragent.ch/en/knowledge/glossary/principal). ## What Know Your Agent means in Germany German companies increasingly use AI agents in purchasing, sales, customer service and administration. When an agent acts with external effect, it must be traceable what it was deployed for. [Know Your Agent](https://knowyouragent.ch/en/knowledge/glossary/know-your-agent) makes this question verifiable: who is the agent, on whose behalf does it act, what was it allowed to do, and did the action match? knowyouragent.ch verifies evidence neutrally and locally in the browser. No data is transmitted, and no account is needed. The site is available in German and English. ## Computer declarations and agency under the BGB According to the prevailing view, automatically generated declarations are attributed to whoever deploys the system; they are called computer declarations. It is also debated whether the rules of agency under Sections 164 et seq. BGB apply by analogy. A contract without authority remains provisionally ineffective until ratified (Section 177 BGB), and the agent is liable under Section 179 BGB unless it proves its authority. Case law on apparent authority and authority by acquiescence protects third parties who were entitled to rely on an appearance created in an attributable way. A presented [mandate](https://knowyouragent.ch/en/knowledge/glossary/agent-mandate) with limits creates clarity for both sides here. More in the article [AI agent liability](https://knowyouragent.ch/en/knowledge/ai-agent-liability). ## Data protection under the GDPR If agents process personal data, the GDPR applies, supplemented by the German Federal Data Protection Act. Important are the principles under Article 5 GDPR, data protection by design (Article 25 GDPR), security of processing (Article 32 GDPR), processing agreements (Article 28 GDPR) and the specific rules for automated individual decisions (Article 22 GDPR). A verification that runs locally in the browser and transmits no evidence to third parties makes the data protection assessment easier. With [selective disclosure](https://knowyouragent.ch/en/knowledge/glossary/selective-disclosure), details in evidence can be limited to what is necessary. ## Identity: online ID and the EUDI wallet With the online ID function of its identity card, Germany has an established government identification. Regulation (EU) 2024/1183, known as eIDAS 2.0, requires member states to offer their citizens a European digital identity wallet, the EUDI wallet. Like the Swiss e-ID, the EUDI wallet uses credentials with selective disclosure, including the [SD-JWT VC](https://knowyouragent.ch/en/knowledge/glossary/sd-jwt-vc) format, and protocols such as [OID4VP](https://knowyouragent.ch/en/knowledge/glossary/oid4vp). For agents, this opens up the possibility of binding a mandate to a principal proven by the government. ## Payments and agentic commerce For electronic payments, the Payment Services Directive PSD2 generally requires strong customer authentication. How payments by agents deal with this is governed by the payment networks' approaches, for example through tokenization and signed purchase intents such as [Verifiable Intent](https://knowyouragent.ch/en/knowledge/glossary/verifiable-intent). For merchants in German online retail, this means agent purchases should be tied to verifiable evidence of intent and limits. The article [Agentic commerce explained](https://knowyouragent.ch/en/knowledge/agentic-commerce) describes the flow and the checkpoints. ## European regulation For companies in Germany, the European regulation on artificial intelligence applies directly. It governs AI systems by role and risk and has no separate term for agents. The article [EU AI Act and AI agents: what applies to agents](https://knowyouragent.ch/en/knowledge/ai-act-ai-agents) puts obligations and deadlines in factual context. Regardless of regulation, one principle pays off: what an agent may do should be defined, checked and proven. This protects companies in disputes as well as in reviews by supervisors or auditors. ## Terms in the German context German law speaks of authorization and authority to act; KYA uses the term mandate for the machine-readable form. It means the limits within which an agent may act for its principal. ## Frequently asked questions ### What does Know Your Agent mean in Germany? Verifying whether an AI agent was authorized for an action, with independently recomputable evidence. In Germany, it ties in with attribution under the Civil Code, the GDPR and the EUDI wallet. ### Are an AI agent's declarations attributed to the company? According to the prevailing view, automatically generated declarations are attributed to whoever deploys the system. What remains decisive is whether the action was within the limits set and whether this can be proven. ### Is verification with KYA privacy-friendly? Verification runs entirely in the browser and transmits no evidence to third parties. This makes the assessment easier but does not replace your own data protection review. ### Does KYA support the EUDI wallet? KYA verifies evidence in the SD-JWT VC format, which is also used in the EUDI wallet. A dedicated profile for government wallets as proof of origin is planned. ### Are there special rules for agent payments in Germany? The general rules for payment services apply, in particular strong customer authentication under PSD2. How agent payments deal with this is governed by the payment networks' approaches. General information, not legal advice. The statutes and the circumstances of each case are decisive. ## Sources - Bürgerliches Gesetzbuch (BGB), § 164: [https://www.gesetze-im-internet.de/bgb/__164.html](https://www.gesetze-im-internet.de/bgb/__164.html) - Datenschutz-Grundverordnung (EU) 2016/679: [https://eur-lex.europa.eu/eli/reg/2016/679/oj](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - Verordnung (EU) 2024/1183 (eIDAS 2.0): [https://eur-lex.europa.eu/eli/reg/2024/1183/oj](https://eur-lex.europa.eu/eli/reg/2024/1183/oj) - Richtlinie (EU) 2015/2366 (PSD2): [https://eur-lex.europa.eu/eli/dir/2015/2366/oj](https://eur-lex.europa.eu/eli/dir/2015/2366/oj) --- Quelle: https://knowyouragent.ch/en/know-your-agent-germany · KYA – Know Your Agent