As companies deploy more autonomous AI tools, a new cybersecurity and governance issue is emerging: AI agents are not just software features, but operational actors that may access systems, trigger workflows and handle business data. A new SecurityWeek commentary frames this as the problem of agentic identities — effectively treating AI agents as proxy identities operating within an organisation’s digital environment.

What happened

The source article, published by SecurityWeek, argues that each autonomous AI agent introduced into an enterprise can function like a new internal identity. In practice, that means an AI agent may be able to log into services, retrieve information, initiate actions or interact with applications on behalf of users or teams.

The article is a commentary rather than a regulatory announcement or incident report. It does not by itself create new legal obligations. However, it highlights a real security and governance concern for organisations adopting agent-based AI and workflow automation.

Why it matters for European businesses

For European businesses, especially SMEs adopting AI assistants, workflow automation and LLM-based tools, this matters because identity sprawl is already a common security problem. If AI agents are given broad permissions across CRM systems, email, document platforms, finance tools or cloud environments, they can become a new source of operational and compliance risk.

Unlike a conventional software integration, an autonomous agent may make decisions, chain actions across multiple systems and operate with limited human intervention. That increases the importance of knowing what the agent can access, what actions it is allowed to perform and how those actions are logged and reviewed.

This has several practical implications:

• Access control: Agents should not automatically inherit broad user permissions without clear limits.
• Auditability: Businesses need records showing what an AI agent did, when it acted and under whose authority.
• Data protection: Agents interacting with customer, employee or commercially sensitive data may raise GDPR and internal governance questions.
• Security exposure: A compromised or poorly configured agent could become a path into multiple connected systems.
• Vendor risk: Third-party AI platforms may introduce additional identity, API and data handling dependencies.

For regulated sectors and companies preparing for stricter cybersecurity expectations under frameworks such as NIS2, identity governance around AI-enabled automation is likely to become more important, even where the legal details depend on the business’s sector and role.

Who may be affected

The issue is most relevant to organisations that are already connecting AI tools to operational systems rather than using AI only for isolated content generation.

• SMEs deploying AI copilots or internal assistants connected to business data
• E-commerce companies automating support, product operations or marketing workflows
• IT teams managing SaaS integrations, cloud identities and API permissions
• Marketing teams using AI tools with access to CRM, analytics or campaign platforms
• Founders and operations leaders introducing automation to reduce manual work

It may be less urgent for businesses using AI only in limited, offline or non-integrated ways, but the relevance increases quickly once an AI system can take actions across multiple business platforms.

What companies should consider

Businesses do not need to wait for a specific regulation to start governing AI agents more carefully. Practical steps include:

• Inventory AI agents and automations: Identify which tools can access systems, data or workflows on the company’s behalf.
• Apply least-privilege access: Give agents only the permissions needed for defined tasks, not broad account-level access.
• Separate human and agent identities: Avoid sharing employee credentials with autonomous tools where possible.
• Review logging and monitoring: Ensure agent actions can be traced, investigated and, where necessary, rolled back.
• Check vendor controls: Assess how external AI providers handle authentication, security, audit logs and data processing.
• Set approval thresholds: Require human review for higher-risk actions such as financial changes, customer record updates or security-sensitive operations.
• Update internal policies: Make sure AI governance, identity management and incident response processes reflect the use of autonomous agents.

The broader takeaway is straightforward: when AI tools move from assisting employees to acting inside business systems, they should be governed more like identities with permissions than like ordinary software features. For European companies increasing their use of AI automation, that shift has direct implications for cybersecurity, compliance and operational control.