Notifications
Clear all
Topic starter
19/08/2026 3:34 pm
TL;DR: EMA’s survey finds 79% of organisations still lack AI policies and more than 60% say their IAM stacks fall short in important areas, showing that financial-sector AI adoption is outrunning governance according to Ory. The real issue is not adoption speed but whether identity, compliance, and accountability can keep pace with agentic AI behaviour.
NHIMG editorial — based on content published by Ory: Agent IAM The AI Identity Crisis: Balancing Innovation with Strict Compliance in the Financial Sector
By the numbers:
- 79% of organisations still lack AI policies, according to Ory’s analysis of EMA survey results.
- More than 60% of respondents believe their IAM stacks fall short in many areas, according to Ory’s analysis of EMA survey results.
- AI systems with least-privileged access had a 17% incident rate versus 76% for over-privileged systems, according to Teleport’s 2026 Infrastructure Identity Survey.
Questions worth separating out
Q: How should financial institutions govern agent IAM before production rollout?
A: Start by treating the AI as a distinct identity subject with its own owner, approval path, and scope limits.
Q: Why do traditional IAM controls struggle with autonomous AI agents?
A: Traditional IAM assumes predictable users or static machine accounts, but AI agents can act independently, interact with multiple systems, and generate new access needs over time.
Q: What breaks when AI policies do not exist in regulated environments?
A: Without AI policies, the organisation cannot show who authorised use, what constraints applied, or how exceptions were managed.
Practitioner guidance
- Classify AI systems by actor type before production approval Decide whether each AI use case is governed as NHI, autonomous, or human-adjacent workflow, then assign identity ownership, review cadence, and approval authority accordingly.
- Require AI-specific policy evidence before expansion Do not move from pilot to production until the organisation can show an approved AI policy, a named owner, logging requirements, and exception handling for the relevant access paths.
- Separate authentication from delegated action control Test whether successful authentication still allows the AI to overreach through tool access, token scope, or workflow chaining.
What's in the full report
Ory's full analysis covers the operational detail this post intentionally leaves for the source:
- Survey methodology and respondent breakdown for financial-sector IAM and AI readiness
- Additional breakdown of where IAM stacks are failing across compliance, access control, and governance
- Practical discussion of how agent IAM affects regulated deployment decisions
- The article's full framing of AI policy maturity versus production readiness
👉 Read Ory's analysis of agent IAM and AI identity risk in finance →
Agent IAM in finance: are your IAM controls keeping up with AI?
Explore further
19/08/2026 4:16 pm
AI policy absence is now an identity governance failure, not a side issue. When 79% of organisations still lack AI policies, the gap is no longer about drafting statements of intent. It is about the inability to define who can authorise AI access, what the AI may touch, and which reviews apply when the actor is neither a person nor a static workload. Financial-sector IAM programmes should treat AI policy as part of identity governance, not as a separate AI document.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI, which shows the governance gap is already broader than policy alone.
A question worth separating out:
Q: Who should own accountability for AI data access risk?
A: Accountability should sit with the teams that own identity, data governance, and security operations together. If AI can access enterprise data, then ownership must cover entitlement design, monitoring, and incident response across the full workflow. The governance gap is not just technical, because without a named owner, no one can prove who approved or contained the access.
👉 Read our full editorial: Agent IAM in finance exposes the gap between AI speed and compliance
