AI agents with access
but without identity

The regulation does not mention AI agents. The obligations still apply to them: lifecycle, logging and recertification apply to all accounts, regardless of account type. Article 20 addresses only one requirement explicitly to employees: one unique account per identity.

Yes, otherwise accountability is lost. Article 21 requires that actions can be attributed to a user at all times. A single account shared by several agents does not meet this.

A service account does what was defined when it was created. An AI agent is given a goal and chooses its tools itself, steered by a language model. Its set of actions is only determined at runtime.

Under its own identity, acting with delegated authority. If it acts under a human’s identity, that person’s name appears in every log. Since 2020, OAuth 2.0 Token Exchange has separated the actor from the principal.

The agent is not deactivated. Responsibility passes to the deputy, then to the application owner, then to the line manager. If no successor is named, the case is escalated.

The principal, the delegated authorization and the intermediate steps must be logged end to end. Article 12 lists access control and identity management among the events to be logged. The test is whether the chain can be reconstructed in under an hour.

An action plan against AI-driven attacks, requested from all significant institutions on July 7, 2026. The focus is on least privilege, logging and human oversight.

To different degrees. Since spring 2026, Entra has managed agents as a separate object class with a sponsor. SailPoint has built this only for its cloud suite; IdentityIQ customers build it themselves.

From 2 December 2027, the obligations for high-risk AI systems under Annex III apply. For banks and insurers, this covers for example creditworthiness assessment of natural persons and pricing in life and health insurance. As the deployer of a system, whether built in-house or bought, an organization is in any case bound by Articles 26 and 27: human oversight by competent persons, retention of logs and a fundamental rights impact assessment. For their own systems, Articles 12, 14 and 15 also apply: record-keeping, human oversight and robustness. These obligations apply alongside the DORA requirements and do not replace them.

What is reviewed is the delegated authorization, not the list of rights. Three questions decide: whether the agent is still needed, whether its task catalog matches its actual behavior, and whether its revocation has been rehearsed.