55% of Organizations Run System-Changing AI Agents Without Identity Controls

What happened

Why it matters

• ·Organizations subject to the EU AI Act (Regulation (EU) 2024/1689) or financial-sector model risk rules face direct exposure. Agents that can change permissions or records without a documented access trail are likely to fail conformity assessments and supervisory reviews. The 59 percent figure gives regulators a concrete benchmark for how widespread the gap is.
• ·The operational risk is immediate: an agent running with broad, unreviewed permissions can modify data, escalate its own access, or take irreversible actions before any human is aware. Without a revocation procedure, even a decommissioned agent may retain live credentials and continue acting.
• ·Accountability is the hardest gap to close. If no named owner is recorded for an agent's identity and permissions, compliance teams cannot answer basic audit questions. They cannot establish who approved the access, who can revoke it, or who is responsible when something goes wrong.

Governance controls affected

What to do now

• ☐Pull a complete list of every AI agent in use or in testing across the organization, noting whether each one has the ability to change systems, move money, update records, or modify access for other users or systems.
• ☐For each agent identified, confirm that a named human owner is recorded in your access management system and that the agent's credentials are separate from any individual employee's login.
• ☐Audit whether your existing access management policies, including periodic reviews and revocation procedures, have been formally extended to cover AI agents, and document any gaps in writing.
• ☐Require that any agent with the ability to change permissions or take irreversible actions goes through a human approval step before those actions execute, and verify that this gate is technically enforced, not just a policy statement.
• ☐Set a recurring review cycle for agent credentials, no less frequent than your human access reviews, and confirm that credentials are automatically revoked when an agent is decommissioned or its scope changes.

What to watch next

Regulatory guidance on non-human identity controls for AI agents is accelerating. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services already names identity and least-privilege as baseline requirements. Financial regulators in the EU and US are incorporating agent access controls into model risk supervisory reviews. Enforcement actions targeting agents that operated with unchecked permissions are expected to increase through 2027. Compliance teams should also monitor updates to EU AI Act (Regulation (EU) 2024/1689) conformity guidance. If non-human identity is addressed explicitly, the current 59 percent gap becomes a formal compliance deficiency, not a best-practice shortfall.