AI Act drives stricter AI governance

The AI Act is pushing companies to improve how they manage AI agents, focusing on aspects like identity, access control, traceability, and human oversight. This is in response to the growing autonomy of AI systems, which can now take actions within information systems, challenging older models where one person had one identity with defined rights and responsibilities.

Challenges in tracking AI agents

According to the Okta Global CISO Insights 2026 report, 81% of security officers are worried about AI having too much access, but only 47% say they can identify all AI agents in their systems. The AI Act does not specifically regulate AI agents, but it requires stronger identification, management, and control of certain systems depending on their risk level.

Control over autonomous systems is difficult

Maintaining control over AI systems that can act on their own is a major challenge. Before allowing an AI agent to take part in a critical process, it must be clear what data it can access, what actions it can perform, who is responsible, and how to stop it if needed. However, many organizations lack the visibility required to manage these aspects effectively.

Identity management expands to include AI agents

Identity management is now a key part of AI governance, covering not just employees but also these new digital actors. Each AI agent must be identifiable, linked to a team or responsible party, have a defined access scope, and have its permissions regularly reviewed. This is crucial for building trust in AI systems.

AI access governance mirrors human standards

The same principles of good access governance apply to AI agents, including minimal access rights, limited access over time, and regular reassessment of permissions. The fact that an actor is a machine should not automatically grant it more trust than a human user. In fact, its autonomy makes precise permission settings even more critical.

Human oversight defines AI limits

For high-impact actions, companies must clearly define when human intervention is needed. This can include requiring approval before a critical action, separating tasks, and being able to quickly stop an AI agent if it exceeds its permitted actions. Oversight involves setting limits in advance and ensuring control can be regained if necessary.

AI deployment needs clear purpose and supervision

AI should not be used just for experimentation. Projects that lack a specific goal or supervision can multiply risks without showing real value. The focus should be on solving a business problem, expecting measurable results, and understanding the level of autonomy needed. This discipline helps determine the actual level of AI autonomy required.

Regulatory deadlines loom for high-risk AI

Starting December 2, 2027, rules for high-risk AI systems under Annex III will take effect. However, governance of AI agents is not something that starts when a regulation is introduced, but when a company decides to let an AI act on its behalf. Companies must be ready to clearly define who authorized the AI, what it can do, and how to regain control.