[et_pb_section fb_built=”1″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” collapsed=”off” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_text admin_label=”test” _builder_version=”4.27.7″ text_text_color=”#171529″ header_2_text_color=”#E62E3B” header_3_text_color=”#E62E3B” header_4_text_color=”#E62E3B” background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”]<\/p>\n
Artificial Intelligence is transforming how organizations operate. AI is no longer limited to generating content or answering questions. Increasingly, AI systems are executing business processes, accessing enterprise applications, interacting with enterprise systems, and even making autonomous decisions.<\/p>\n
With the AI Act, the European Union has taken the first major regulatory step toward governing Artificial Intelligence through the world’s first comprehensive legal framework for AI. While the regulation establishes obligations around transparency, human oversight, and risk management, it leaves one critical question unanswered that will become increasingly important as AI adoption accelerates:<\/p>\n
La Inteligencia Artificial est\u00e1 cambiando la forma en que trabajamos. Ya no solo genera contenido o responde preguntas; empieza a ejecutar procesos, acceder a aplicaciones, interactuar con sistemas corporativos e incluso tomar decisiones<\/strong> de forma aut\u00f3noma.<\/span>\u00a0<\/span><\/p>\n Europa ha dado el primer paso regulando esta nueva realidad con el AI\u00a0Act<\/strong>, la primera legislaci\u00f3n integral sobre Inteligencia Artificial. Sin embargo, mientras el reglamento establece obligaciones sobre transparencia, supervisi\u00f3n y gesti\u00f3n del riesgo<\/strong>, deja abierta una cuesti\u00f3n que ser\u00e1 determinante en los pr\u00f3ximos a\u00f1os:<\/span>\u00a0<\/span><\/p>\n As digital identity becomes the new security perimeter for people, it must also become the security perimeter for autonomous AI agents.<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.7″ header_2_font=”|600|||||||” header_2_text_color=”#E62E3B” header_3_font=”|600|||||||” header_3_text_color=”#E62E3B” background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”]<\/p>\n The AI Act (Regulation (EU) 2024\/1689) is the world’s first comprehensive legal framework governing the development, deployment, and use of Artificial Intelligence. Its goal is to ensure that AI systems operating within the European Union are safe, transparent, and respectful of fundamental rights while continuing to foster innovation. To achieve this, the regulation classifies AI systems according to their level of risk:<\/p>\n The AI Act is being implemented in phases. The provisions banning unacceptable-risk practices and the AI literacy requirements are already in force. The transparency obligations<\/strong> under Article 50, including the requirement to inform users when they are interacting with AI,\u00a0 become applicable on 2 August 2026. Following a revised implementation timeline introduced in 2026, the more demanding obligations for high-risk AI systems are now scheduled to apply from 2 December 2027<\/strong>.<\/p>\n Beyond compliance, however, the AI Act signals a broader shift in how organizations must think about AI governance. AI is no longer viewed as just another technology tool. It is becoming a core business capability that must be governed with the same discipline applied to any other critical enterprise asset.<\/strong><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.7″ header_2_font=”|600|||||||” header_2_text_color=”#E62E3B” header_3_font=”|600|||||||” header_3_text_color=”#E62E3B” background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”]<\/p>\n Until recently, Artificial Intelligence was primarily associated with systems that generated responses, such as writing text, classifying images, or suggesting answers. Today, we are entering the era of AI agents that can take action.<\/p>\n An AI agent can schedule meetings in an enterprise calendar, procure goods or services within predefined spending limits, execute end-to-end workflows without human intervention, interact directly with third-party APIs, sign documents or transactions on behalf of an organization, communicate with banks and payment platforms, and, in some cases, use digital certificates to authenticate itself to other systems.<\/p>\n In practice, a well-designed AI agent can operate much like an employee<\/strong>. It may access enterprise resources, receive specific permissions, and perform assigned tasks. Crucially, it should also leave a complete audit trail of every action it takes.<\/p>\n Once an AI agent is capable of acting like an employee, it is no longer merely an AI application. It becomes a digital identity.\u00a0<\/strong><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.7″ header_2_font=”|600|||||||” header_2_text_color=”#E62E3B” header_3_font=”|600|||||||” header_3_text_color=”#E62E3B” background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”]<\/p>\n The AI Act rightly addresses human oversight, system traceability, and transparency for end users<\/strong>. These are essential safeguards. However, it does not answer the questions that matter most to security, compliance, and IT leaders once AI agents begin operating within enterprise environments<\/a>:<\/p>\n Today, many organizations still perceive AI primarily as an advisory tool. But once AI agents begin acting autonomously on behalf of the business, these questions become far more than theoretical.<\/p>\n Recent identity governance research highlights<\/a> the scale of the challenge. By 2026, non-human identities, including service accounts, API keys, machine credentials, and AI agent tokens, already outnumber human identities by a significant margin within most enterprises. At the same time, more than half of organizations acknowledge that ownership of these identities is unclear, with no defined accountability for reviewing or revoking privileges when they are no longer needed.<\/p>\n The AI Act governs how AI systems should behave. It does not govern, with the same level of clarity, the technical identity those systems use to operate.<\/p>\n The regulation answers the question: “What decisions may an AI system make?”<\/p>\n It does not yet answer another, equally important question: “Who is this AI agent, and who is accountable for its digital identity?”<\/p>\n Questions that still need answers<\/strong><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.7″ header_2_font=”|600|||||||” header_2_text_color=”#E62E3B” header_3_font=”|600|||||||” header_3_text_color=”#E62E3B” background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”]<\/p>\n This is not the first time organizations have faced a challenge like this. When businesses began digitizing employee access, Identity and Access Management (IAM) emerged. When implicit trust in corporate networks was no longer sufficient, Zero Trust became the new security model. And when organizations needed a reliable way to verify the identities of people and entities across digital environments, digital certificates became a standard mechanism for strong authentication.<\/p>\n Now, with autonomous AI agents operating across enterprise infrastructure, the next step is becoming clear: AI Identity Governance.\u00a0<\/strong><\/p>\n AI Identity Governance is the discipline of managing the entire lifecycle of an AI agent’s digital identity, including secure authentication, authorization, traceability, auditing, and credential revocation.<\/p>\n It is not intended to replace the AI Act. Rather, it is the discipline most likely to complement the regulation as future legislation evolves to address the questions that remain unanswered today.<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.7″ header_2_font=”|600|||||||” header_2_text_color=”#E62E3B” header_3_font=”|600|||||||” header_3_text_color=”#E62E3B” background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”]<\/p>\n Every AI agent should have its own unique, verifiable, and non-transferable digital identity rather than relying on shared credentials or identities inherited from other systems.\u00a0<\/span><\/span><\/p>\n AI agents should never rely on shared user accounts. If an AI agent can perform actions with the same business impact as a human employee, it requires an authentication mechanism of equal or greater strength. Digital certificates provide a cryptographically strong way to verify an agent’s identity whenever it interacts with enterprise systems.<\/p>\n An AI agent’s identity should follow the same lifecycle principles already applied to employees:<\/p>\n Every AI agent should be created with a clearly defined purpose and scope. Its permissions should be reviewed whenever its responsibilities change, suspended when it is no longer in use, and permanently revoked when it is decommissioned. Without proper lifecycle management, organizations inevitably accumulate orphaned AI identities: active accounts with privileged access but no owner, oversight, or accountability.<\/p>\n Organizations need complete visibility into every action performed by an AI agent:<\/p>\n Without a complete and verifiable audit trail, investigating incidents or demonstrating compliance to regulators and auditors, becomes extremely difficult.<\/p>\n The Zero Trust principle is simple: Never trust. Always verify.<\/p>\n The same approach already applied to users and devices should also extend to AI agents and every other non-human identity. No identity, human or machine\u00a0 should receive implicit trust simply because it exists within the corporate network.<\/p>\n Organizations must be able to demonstrate:<\/p>\n Security incidents documented throughout 2026 demonstrate that this is far more than a compliance requirement. It is often the difference between containing a security incident and losing control of it altogether.<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.7″ header_2_font=”|600|||||||” header_2_text_color=”#E62E3B” header_3_font=”|600|||||||” header_3_text_color=”#E62E3B” background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”]<\/p>\n At Redtrust, we have spent years helping organizations govern one of their most valuable assets: corporate digital identity.<\/p>\n Today, organizations primarily manage the digital identities of employees and legal representatives, along with corporate digital certificates.<\/p>\n Tomorrow, autonomous AI agents will join that list.<\/p>\n Trust will depend on more than whether an AI agent makes the right decisions.<\/p>\n It will also depend on our ability to identify it, authenticate it, govern its permissions, and provide verifiable evidence of every action it performs.<\/p>\n Conclusion<\/strong><\/p>\n Artificial Intelligence will transform how organizations operate.<\/p>\n But trust will continue to be built on identity.<\/p>\n Today, we govern the identities of people. Tomorrow, we will also need to govern the identities of AI agents.<\/p>\n <\/p>\n [\/et_pb_text][et_pb_button button_url=”https:\/\/redtrust.com\/en\/request-demo\/” button_text=”Talk to our specialists” button_alignment=”center” _builder_version=”4.27.7″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_button][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” collapsed=”on” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.7″ _module_preset=”default” header_2_text_color=”#E62E3B” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_toggle title=”What is the AI Act? ” _builder_version=”4.27.7″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n The AI Act is the European Union’s Artificial Intelligence Regulation and the world’s first comprehensive legal framework governing the development, deployment, and use of AI systems. It establishes obligations based on the level of risk posed by each system.<\/p>\n [\/et_pb_toggle][et_pb_toggle title=”How does the AI Act affect organizations? ” _builder_version=”4.27.7″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Organizations that develop, deploy, or use AI systems must comply with requirements related to risk management, transparency, human oversight, cybersecurity, and traceability, particularly when operating AI systems classified as high risk.<\/p>\n [\/et_pb_toggle][et_pb_toggle title=”What is an AI agent? ” _builder_version=”4.27.7″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n An AI agent is a software system capable of carrying out tasks autonomously, interacting with applications, making decisions within predefined objectives, and operating across enterprise systems with an increasing degree of independence.<\/p>\n [\/et_pb_toggle][et_pb_toggle title=”Why does an AI agent need a digital identity? ” _builder_version=”4.27.7″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n An AI agent needs to authenticate itself to applications, access enterprise resources, use credentials securely, and perform actions on behalf of an organization. A verifiable digital identity enables organizations to control the agent’s permissions, audit its activities, and ensure complete traceability for every operation it performs.<\/p>\n [\/et_pb_toggle][et_pb_toggle title=”What are non-human identities? ” _builder_version=”4.27.7″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Non-human identities (NHIs) are digital identities assigned to entities other than people, including applications, services, devices, APIs, workloads, and AI agents. Managing these identities effectively is essential to reducing cybersecurity risk and meeting compliance and audit requirements.<\/p>\n [\/et_pb_toggle][et_pb_toggle title=”What role will digital certificates play for AI agents? ” _builder_version=”4.27.7″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Digital certificates can provide strong cryptographic authentication for AI agents, allowing them to prove their identity, establish trusted relationships with other systems, and securely authenticate each interaction.<\/p>\n [\/et_pb_toggle][et_pb_toggle title=”What is AI Identity Governance? ” _builder_version=”4.27.7″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Es el conjunto de pol\u00edticas, procesos y tecnolog\u00edas destinados a gestionar el ciclo de vida de la identidad digital de los agentes de IA, incluyendo su autenticaci\u00f3n, autorizaci\u00f3n, trazabilidad, auditor\u00eda y revocaci\u00f3n. A medida que estos agentes ganen autonom\u00eda, esta disciplina ser\u00e1 un pilar fundamental de la ciberseguridad y del cumplimiento normativo.<\/span><\/span><\/p>\n [\/et_pb_toggle][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ _builder_version=”4.27.7″ _module_preset=”default” custom_margin=”||-52px|||” global_colors_info=”{}”][et_pb_row _builder_version=”4.27.7″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.7″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.7″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n This<\/span>\u00a0<\/span>article<\/span>\u00a0<\/span>was<\/span>\u00a0<\/span>drafted<\/span>\u00a0<\/span>with<\/span>\u00a0<\/span>How <\/span>should<\/span>\u00a0<\/span>the<\/span>\u00a0digital\u00a0<\/span>identity<\/span>\u00a0<\/span>of<\/span>\u00a0<\/span>an<\/span>\u00a0AI\u00a0<\/span>agent<\/span>\u00a0be\u00a0<\/span>governed?<\/span><\/span><\/strong><\/h2>\n
What<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>the<\/span>\u00a0<\/span>European<\/span>\u00a0AI\u00a0<\/span>Act<\/span>\u00a0and\u00a0<\/span>why<\/span>\u00a0<\/span>does<\/span>\u00a0<\/span>it<\/span>\u00a0<\/span>change<\/span>\u00a0<\/span>the<\/span>\u00a0rules?<\/span><\/span>\u00a0<\/span><\/span><\/h2>\n
\n
AI\u00a0<\/span>is<\/span>\u00a0no\u00a0<\/span>longer<\/span>\u00a0<\/span>just<\/span>\u00a0<\/span>responding,<\/span>\u00a0<\/span>it<\/span>\u00a0<\/span>is<\/span>\u00a0<\/span>beginning<\/span>\u00a0<\/span>to<\/span>\u00a0<\/span>act<\/span><\/span>\u00a0<\/span><\/span><\/h2>\n
The AI\u00a0<\/span>Act’s<\/span>\u00a0<\/span>biggest<\/span>\u00a0<\/span>blind<\/span>\u00a0spot: AI\u00a0<\/span>agent<\/span>\u00a0<\/span>identity<\/span><\/span>\u00a0<\/span><\/span><\/h2>\n
\n
\n
T<\/span>he\u00a0<\/span>next<\/span>\u00a0<\/span>evolution<\/span>\u00a0<\/span>of<\/span>\u00a0<\/span>regulation<\/span>:\u00a0<\/span>governing<\/span>\u00a0AI\u00a0<\/span>identitie<\/span>s<\/span><\/span>\u00a0<\/span><\/span><\/h2>\n
What<\/span>\u00a0future AI\u00a0<\/span>regulation<\/span>\u00a0<\/span>should<\/span>\u00a0<\/span>include<\/span><\/span>\u00a0<\/span><\/span><\/span><\/h2>\n
1.\u00a0Verifiable<\/span>\u00a0digital\u00a0<\/span>identities<\/span>\u00a0<\/span>for<\/span>\u00a0AI\u00a0<\/span>agents<\/span><\/span><\/h3>\n
2. \u00a0<\/span><\/span>Strong\u00a0<\/span>authentication<\/span>\u00a0<\/span>based<\/span>\u00a0<\/span>on<\/span>\u00a0digital\u00a0<\/span>certificates<\/span><\/span><\/span><\/a><\/h3>\n
3. \u00a0<\/span><\/span>AI\u00a0<\/span>identity<\/span>\u00a0<\/span>lifecycle<\/span>\u00a0<\/span>management<\/span><\/span><\/span><\/a><\/h3>\n
\n
4. End-<\/span>to<\/span>–<\/span>end<\/span>\u00a0<\/span>traceability<\/span><\/span><\/span><\/h3>\n
\n
5. Zero Trust\u00a0<\/span>for<\/span>\u00a0non-human\u00a0<\/span>identities<\/span><\/span><\/span><\/h3>\n
6. Auditability<\/span>\u00a0and\u00a0<\/span>regulatory<\/span>\u00a0<\/span>compliance<\/span><\/span><\/span><\/h3>\n
\n
Redtrust’s<\/span>\u00a0role in AI\u00a0<\/span>identity<\/span>\u00a0<\/span>governance<\/span><\/span>\u00a0<\/span><\/span><\/h2>\n
Frequently<\/span>\u00a0<\/span>asked<\/span>\u00a0<\/span>questions<\/span>\u00a0<\/span>about<\/span>\u00a0<\/span>the<\/span>\u00a0AI\u00a0<\/span>Act<\/span>\u00a0and AI\u00a0<\/span>agent<\/span>\u00a0<\/span>identity<\/span><\/span>\u00a0<\/span><\/strong><\/h2>\n