AI Security and Identity
Access control, data protection, and identity management for AI systems and agents. As AI models gain access to sensitive data and enterprise systems, security controls designed for human users are no longer sufficient. This topic covers the security frameworks, data governance obligations, and identity controls that apply specifically to AI.
Key board-level questions
- 1.What data can AI systems access, and how do we track where that data came from, how it was changed, and what consent covers it?
- 2.Do we enforce fine-grained access control for AI models and agents?
- 3.How do we mitigate risks of data leakage or unintended exposure?
- 4.Are AI systems integrated into our identity and access management strategy?
Regulatory frameworks
OWASP Top 10 for Large Language Model Applications
OWASP's Top 10 for LLM Applications lists the most critical security risks in applications built on large language models. The current 2026 edition, published in August 2026, puts prompt injection, sensitive information disclosure, and excessive agency at the top. Development and security teams use it to prioritize safeguards.
EU Cyber Resilience Act
The EU Cyber Resilience Act sets mandatory cybersecurity requirements for products with digital elements sold in the EU. It includes hardware and software containing AI components. Duties cover the lifecycle from design through end-of-life.
EU Data Act
The EU Data Act governs access to personal and non-personal data from connected products and related services. Data holders must share covered data with users and third parties. It also sets conditions for public bodies accessing privately held data in exceptional circumstances.
EU Digital Operational Resilience Act
DORA (the Digital Operational Resilience Act), Regulation (EU) 2022/2554, governs digital operational resilience for EU financial entities. Requirements cover technology risk management, incident reporting, resilience testing, and third-party oversight. These affect financial AI systems and their technology providers.