The use of artificial intelligence (AI) is fundamentally transforming business processes, decision-making and the way data is handled. As a result, questions regarding authorisations, responsibilities and control mechanisms are coming increasingly into focus. Identity & Access Management (IAM) plays a key role in ensuring the secure and trustworthy use of AI.
Curious?
What role does IAM play in IT governance?
Identity & Access Management is a key component of modern IT governance. It ensures that employees, partners and external service providers can only access the systems, applications and data they need to carry out their respective tasks. This reduces security risks whilst ensuring compliance with legal and regulatory requirements.
Within the framework of IT governance, IAM establishes clear rules for the management of digital identities and access rights throughout their entire lifecycle. This begins, for example, with the automated provision of user accounts when an employee joins the organisation, encompasses adjustments following changes in roles or responsibilities, and ends with the revocation of access rights upon leaving. In this way, IAM enables consistent and traceable control of access rights.
This provides organisations with transparency regarding who is authorised to access which resources and when. At the same time, IAM supports compliance with regulatory requirements. Regular recertifications, audit logs and role-based access policies help to demonstrate that sensitive information is adequately protected.
IAM thus links security requirements with governance and compliance processes, laying the foundation for a controlled and traceable digital corporate environment.
Benefits of a well-structured IAM system
A well-structured IAM system offers far more than just protection against unauthorised access. One of its key benefits lies in improving IT security. Measures such as multi-factor authentication, role-based authorisation models and automated access checks help to reduce the risk of data loss, unauthorised access and cyber-attacks.
At the same time, IAM boosts the efficiency of the IT department. Automated processes for creating, amending and deactivating user accounts reduce manual effort and minimise sources of error. New staff members are granted the necessary access rights more quickly, whilst permissions that are no longer required or have become obsolete can be consistently revoked.
Users also benefit from a modern IAM system. Single sign-on, for example, enables access to various applications with a single login, thereby improving both user-friendliness and productivity.
Furthermore, IAM provides transparency regarding existing permissions and responsibilities. As a result, organisations benefit from better control over their digital resources, reduced administrative workload and greater compliance assurance.
Challenges for IAM posed by new technologies
As digitalisation progresses, the demands placed on modern IAM solutions are also increasing. Cloud platforms, hybrid IT landscapes and Software-as-a-Service applications mean that identities and access rights must be managed across numerous systems and platforms. Centralised and consistent control of these heterogeneous environments requires powerful integrations and flexible governance models.
The increasing use of artificial intelligence is also fundamentally changing the requirements for IAM. Whilst IAM systems traditionally manage primarily human users and technical accounts, AI agents are increasingly giving rise to autonomous, non-human identities. These can independently access applications, data and APIs and carry out actions on behalf of users or other systems. This not only increases the number of identities to be managed, but also the complexity of their permissions and dependencies.
A key challenge lies in consistently applying principles such as least privilege and zero trust to AI agents as well. Agents should only be able to access those resources they actually require for their specific task; otherwise, existing access rights may be indirectly passed on, or information from different systems may be consolidated. Without clear rules and sufficient transparency, there is a risk that AI applications will gain access to information that is not required for the specific use case. Furthermore, their identities must be uniquely identifiable and their activities traceable. If, instead, shared service accounts or far-reaching permissions are used, compromised or malfunctioning AI systems can pose significant security risks.
IAM must therefore be more closely integrated with the governance of AI systems. The aim is to ensure that both the use of AI applications and their access to data and systems are transparent, controllable and traceable.
This also means that identity governance is becoming increasingly important. Organisations must define who is responsible for an AI identity, how permissions are granted and regularly reviewed, and when an identity is deactivated. To this end, some traditional IAM controls will need to be further developed.
Regulatory requirements for a secure use of AI
For banks in particular, it is therefore not enough simply to select a technically suitable AI tool. Even before the tool is put into production, it must be clarified how it will be integrated into existing governance, security and risk management processes.
In this context, the Federal Financial Supervisory Authority (BaFin) emphasises, amongst other things, the importance of clear lines of responsibility, appropriate risk assessments, controlled data processing and suitable security mechanisms. Existing dependencies and risks must also be taken into account when using external providers.
During operation, usage, access and relevant decisions must be documented in a traceable manner. At the same time, risks should be reviewed regularly and authorisations monitored on an ongoing basis.
IAM thus becomes an essential component of secure AI governance.
The following questions, amongst others, are crucial:
- Who is permitted to use which AI system?
- Which data and systems is it permitted to access?
- Which actions is an AI system or AI agent permitted to carry out independently?
- How are permissions granted and revoked?
- And how can access and actions carried out be traced retrospectively?
These questions demonstrate that traditional IAM principles must also be applied to AI systems and technical identities. At the same time, existing IAM concepts must be expanded to accommodate the increasing use, interconnectivity and automation of such systems.
Banks, in particular, should therefore take these requirements into account before introducing an AI application. To this end, we at msg for banking have drawn up a special AI checklist to provide structured support in assessing the key regulatory, organisational and technical requirements. The checklist guides users step by step through the relevant topics and helps to identify at an early stage which prerequisites must be met before an AI tool can be deployed.
Conclusion
Artificial intelligence offers businesses significant potential for improving efficiency and automating processes. However, in order to capitalise on these opportunities in the long term, risks, access rights and regulatory requirements must be continuously monitored. A robust IAM system forms the central foundation for achieving the transparency and control required for the secure and trustworthy use of AI.
