Why AI raises the stakes for Digital Public Infrastructure (DPI)
Read part one of this blog series: Beyond the Rails: trusted digital ecosystems
Artificial intelligence is making the next phase of DPI more urgent. The first phase of the global DPI movement focused on building the interoperable digital foundations of modern economies: digital identity, modern payment rails and secure data exchange systems. Those core components will matter even more as AI-enabled services come to depend on trusted data, secure identity, consent-based exchange and reliable institutions.
This is no longer theoretical. AI is already being explored for automation, fraud detection, multilingual access, case management and decision support. As these uses move into public and private services, the quality of the underlying digital foundations becomes a governance issue, not just a technical one.
AI agents raise the stakes further. They are not merely tools that advise users. Increasingly, they may act for them: submitting applications, exchanging information, updating records or initiating transactions.
Consider an AI agent applying for a public service on someone’s behalf. It may need to verify the person’s identity, retrieve information from several registries, provide evidence of eligibility and authorise a payment. If the agent uses outdated data, exceeds its permissions or makes the wrong decision, who is accountable? How can the user see what happened, withdraw consent or challenge the outcome?
Weak digital foundations become operational risks in such scenarios. Poor identity, fragmented data, weak consent mechanisms and limited auditability may no longer produce isolated failures. They could automate mistakes, amplify bias and scale exclusion at machine speed.
The DPI-AI convergence should therefore be seen less as a race to deploy intelligent systems and more as a test of institutional maturity. Countries do not wait until every DPI component is perfect before innovating. But AI cannot become a shortcut around the hard work of building trusted digital foundations.
AI will magnify the strengths and weaknesses of whatever foundations exist. Where identity is trusted, data is reliable, safeguards are credible and governance is strong, AI can improve services and expand inclusion. Where those foundations are weak, it can scale failure just as efficiently.
The message is simple: AI does not replace strong DPI. It makes it indispensable.
The next trust challenge
AI is changing more than digital service delivery. It is changing who, or what, can participate in digital ecosystems. As AI systems begin to mediate interactions between people, institutions and services, trust has to account for new actors, new forms of delegation and new points of accountability.
DPI has largely been designed around interactions among people, businesses and governments. AI agents are beginning to complicate that model. They can search for information, complete transactions, submit applications and act on behalf of individuals or organisations. The next trust challenge is therefore not simply how to provide better digital services, but how to establish confidence in increasingly autonomous digital interactions.
Many DPI architectures were not originally designed to distinguish among people, organisations and AI agents. Nor were they designed to verify when authority has been delegated or preserve consent, accountability and liability when humans and machines act together.
The practical implications are significant. If an AI agent can query a registry, submit a form, authorise a payment or update a record, the system must know who initiated the action and under whose authority. It must also establish what the agent may do, for whom, for how long and under which conditions. Without clear boundaries, delegation can become a source of risk rather than convenience.
In this context, a digital identity must do more than prove who someone is. It must become part of a broader trust architecture that can establish who is acting, under whose authority, within which permissions and at what level of assurance. Depending on the service and its risks, this could involve proof of humanity, delegated authority, verifiable credentials, consent receipts and trusted network signals.
The mobile industry may have an important role to play. Network capabilities can provide signals that help verify devices, detect anomalous behaviour, reduce fraud and strengthen transaction assurance. Combined with identity and consent mechanisms, these capabilities could help services distinguish legitimate delegated actions from manipulation or abuse. Their use must remain proportionate, privacy-preserving and subject to clear accountability.
There will be no universal solution. A low-risk information request should not require the same assurance as a benefits application, medical decision or high-value transaction. Different services will need different safeguards, balancing security, privacy, inclusion and user choice.
The first generation of digital identity helped answer one simple question: Who are you?
The next generation may need to move from electronic know-your-customer (eKYC) towards know-your-agent (KYA), asking a broader set of questions: Who are you? Who are you acting for? What are you authorised to do? How can others trust that interaction?
This expanding set of questions is not a weakness. It reflects the growing complexity of digital trust. Unless questions of identity, authority and accountability are resolved, AI-enabled services may become powerful but difficult to trust or challenge.
Trust architecture is therefore not an add-on to AI-enabled DPI. It is what makes autonomous interactions usable, accountable and safe – and what allows people to seek redress when automation gets things wrong.
Openness is more than open source
If AI raises the cost of weak digital foundations, it also raises the value of openness. In AI-enabled DPI, openness must extend beyond code to the models, data, interfaces and operational dependencies that shape how systems behave.
Open-source software has played a transformative role in the DPI movement, particularly through digital public goods. It has lowered barriers to reuse, encouraged collaboration and enabled countries to build on proven solutions rather than start from scratch. These advantages matter even more as AI-enabled services come to rely on DPI foundations.
But open source is not a silver bullet. It does not eliminate the hard work of adapting, securing, operating and governing digital systems. Code may be open, but implementation is never automatic. Without capable institutions, sustainable financing and clear accountability, open-source systems can become difficult to maintain, expensive to develop and dependent on a small number of specialist providers.
This complicates any simple public-versus-private framing. Today’s open-source ecosystem is sustained by volunteer communities, foundations, companies and paid contributors. Commercial organisations contribute code, fund maintainers, support foundations and help shape project roadmaps because open source has become part of core digital infrastructure.
That participation can strengthen the ecosystem. It can also concentrate influence. If open-source DPI depends on a narrow group of firms, funders or specialists, openness in code may coexist with concentration in capability.
Some governments are responding by establishing Open-Source Programme Offices to improve software governance, build internal expertise and coordinate adoption. Such initiatives can encourage reuse and reduce implementation risks. But software governance addresses only part of the challenge.
AI introduces further dependencies. Countries may gain access to source code while remaining reliant on proprietary models, closed data pipelines, external compute platforms, cloud infrastructure or specialist expertise. Tools intended to reduce lock-in can therefore create new forms of dependence.
The underlying questions are economic as well as technical. Who funds long-term operations? Who maintains models and data pipelines? Who invests in cybersecurity? Who bears liability when an AI-enabled service fails? Can entrepreneurs and smaller firms participate, or will the costs of compute, compliance and specialist skills concentrate capability among a few providers? These are not simply questions of code. They are questions of ecosystem governance.
True openness is not just a software property. It is an ecosystem property. It depends on open standards, modular design, accessible interfaces, sustainable business models and governance arrangements that allow different actors to participate without becoming locked into one technology, supplier or implementation model. In the age of AI, open-by-design ecosystems will be better placed to adapt, manage emerging risks and remain accountable as technologies and use cases evolve.
From intelligence to wisdom
The argument so far points to a simple lesson: AI does not only test the intelligence of digital systems. It tests the judgement of the institutions and ecosystems that govern them.
Part one of this blog series argued that DPI only matters when it becomes part of a trusted ecosystem. Part two has shown why AI makes that harder, and more urgent. AI can improve services, detect risks and expand access. It can also automate weak assumptions, deepen dependencies and make mistakes harder to see or challenge.
The answer is not simply to make DPI more intelligent. It is to make it wiser.
Wisdom is different from intelligence. Intelligence helps systems recognise patterns and act faster. Wisdom asks the harder questions: what should be acted on, what should be protected, what should remain human, and what should not be automated simply because it can be.
Unlike intelligence, wisdom is not just a technical capability. It is a human and institutional property: the capacity to understand context, weigh trade-offs, exercise restraint and keep public purpose at the centre.
That distinction matters because smarter tools cannot repair weak foundations. Technical verification alone cannot establish trust when AI agents act for people and organisations. Access to source code cannot guarantee openness when countries remain dependent on models, data, compute or specialist expertise.
These challenges demand institutional judgement. They require governments, the private sector, civil society, academia and affected communities to determine where AI can add value, what safeguards are proportionate and who remains accountable when systems fail.
This is especially important for DPI. Its purpose is not to make societies dependent on intelligent systems. It is to give people, institutions and ecosystems better foundations on which to act.
Trusting our own abilities does not mean rejecting AI. It means remembering that the most important choices about digital futures still belong to us: what to value, what to protect, what to automate, and what kind of society these systems should help sustain.
The real test is not whether AI can make DPI more intelligent. It is whether DPI can help societies use AI with confidence, discipline and purpose. Intelligence may make systems faster. Wisdom can make them trusted, accountable and worth relying on.
Part three turns from intelligence to endurance: what does it take for DPI to move from launch to legacy? If AI raises the cost of getting DPI wrong, legacy asks whether trust can survive once the excitement of launch has passed. The next test is not merely to build systems that work, but to sustain ecosystems that endure and thrive.