[{"data":1,"prerenderedAt":644},["ShallowReactive",2],{"uc-identity-and-access-review-agent":3,"uc-regulations":423},{"useCase":4,"evidence":184,"blitsAiDeployments":317,"benchmarks":318,"indicative":326,"related":329,"indexability":421,"includeUnpublished":190},{"title":5,"shortTitle":6,"seoTitle":7,"metaDescription":8,"status":9,"definition":10,"aliases":11,"industries":17,"functions":21,"patterns":24,"channels":29,"audience":32,"autonomy":33,"adoptionStage":34,"problem":35,"problemStats":36,"howItWorks":37,"valueDrivers":38,"kpis":43,"indicativeValue":45,"macroEstimates":91,"feasibility":92,"implementation":105,"risk":148,"blitsAi":165,"faq":167,"related":177,"datePublished":179,"dateModified":179,"lastVerified":179,"changelog":180,"slug":183},"AI agent for identity and access review and certification","Identity and access review agent","AI agent for identity and access reviews","An AI agent compares each access grant with peers and flags outliers for a human reviewer. How AmeriGas and Netskope use AI in access reviews.","published","An AI agent that runs user access reviews, flags entitlements that differ from peers in similar roles, and leaves only the exceptions for a human reviewer. It pulls entitlement data from every connected application, scores each grant against the peer profile, groups or pre approves low risk, expected access, and keeps an audit ready record of every decision.",[12,13,14,15,16],"AI access certification","user access review automation","identity governance AI agent","access recertification agent","entitlement review AI",[18,19,20],"cross-industry","technology","energy-and-utilities",[22,23],"security-operations","it-and-engineering",[25,26,27,28],"prediction-and-scoring","classification-and-routing","anomaly-detection","agentic-workflow",[30,31],"internal-tools","api","employee-facing","supervised-agent","emerging","Access reviews exist because entitlements drift: people change roles, contractors leave,\ntemporary access becomes permanent because revoking it is nobody's job. SOX drives periodic\ncertification as part of its IT general control audit expectations, and SOC 2, an attestation\nmany SaaS and cloud vendors pursue rather than a legal requirement, expects the same discipline\n(editorial framing, not drawn from the evidence on this page). So a manager or application owner\nends up having to look at every entitlement and decide.\n\nThis usually becomes a spreadsheet or ticketing exercise across dozens of applications, sent\nto reviewers who do not know what most of the access they are certifying actually does.\nReviewers rubber stamp long lists to get through the campaign, which satisfies the audit\nrequirement without reducing the access risk, and the process can stretch over weeks for a large\norganization.",[],"1. **Collect entitlements continuously.** The agent syncs identities and their access grants from\n   every connected application, including ones without a native governance integration, instead\n   of a manual export per system.\n2. **Learn what normal access looks like.** Using department, title, group and prior grants, the\n   agent builds a profile of the access someone in a given role typically holds.\n3. **Score every grant.** Each entitlement gets a risk or trust score based on how well it fits\n   the peer profile, prior review decisions and how sensitive the resource is.\n4. **Pre approve or group the routine.** Low risk, expected access is grouped or pre approved for\n   a one click decision; only access that deviates from the profile needs individual judgement.\n5. **Route exceptions with context.** Each exception goes to the right business owner with the\n   score, the reason it was flagged and the peer comparison, not a bare entitlement name.\n6. **Record and revoke.** Every decision, approve or revoke, is logged with who decided and why,\n   and revocations are pushed back to the source application automatically where integrated.\n\nPublic evidence covers the steps unevenly. AmeriGas uses SailPoint's AI recommendations inside\nits certifications: the system shows what share of a department holds an entitlement, and a\nperson decides whether the user is a real outlier (steps 2 and 3). SailPoint reports the same\nkind of use in its own campaigns. Netskope uses Lumos, whose LLM powered analytics flag\nanomalies and toxic combinations of access and route prioritized items to owners (steps 3 and\n5). Step 1 and the audit reporting part of step 6 are documented by the data automation\ndeployments at Sprout Social and Hippo Insurance Services, whose sources describe no AI. No\nnamed organization's public source describes pre approval of low risk access (step 4) or\nautomated revocation, so treat those as the part of the design not yet shown in production. All\nof this evidence is published by vendors. The cycle time benchmark on this page pools two vendor\nclaims: Netskope's up to 70% (AI) and Sprout Social's 75% (data automation, no AI described), so\nread it as the range reported for access review programs, not as the effect of AI scoring alone.",[39,40,41,42],"risk-reduction","employee-productivity","compliance","speed",[44],"processing-time-reduction",{"referenceOrg":46,"inputs":47,"formula":86,"currency":87,"period":88,"resultLabel":89,"caveat":90},"A company running quarterly access reviews for 3,000 employees across 50 applications",[48,53,60,66,72,79],{"key":49,"label":50,"low":51,"high":51,"unit":49,"note":52},"employees","Employees in scope",3000,"The reference organization.",{"key":54,"label":55,"low":56,"high":57,"unit":58,"note":59},"grantsPerEmployee","Access grants reviewed per employee per cycle",8,15,"access grants per employee","Editorial assumption across core systems and SaaS applications. Replace with your own entitlement count.",{"key":61,"label":62,"low":63,"high":63,"unit":64,"note":65},"cyclesPerYear","Access review cycles per year",4,"cycles per year","Editorial assumption. Quarterly is a common review cadence; replace with your own.",{"key":67,"label":68,"low":69,"high":63,"unit":70,"note":71},"minutesPerGrant","Minutes a reviewer spends per grant without AI support",2,"minutes per grant","Editorial assumption. Replace with your own campaign timing data.",{"key":73,"label":74,"low":75,"high":76,"unit":77,"note":78},"automationShare","Share of review effort the agent removes",0.3,0.5,"fraction of review effort","Editorial assumption. Lumos reports that access reviews at Netskope are accelerated by up to 70%, a vendor claim and an upper bound (the same page also gives 77%), so a range of 0.3 to 0.5 stays well below it. No source measures the share of review effort an AI agent removes. The Sprout Social and Hippo Insurance Services figures describe data automation, not AI, so they are not used. Replace with your own reviewer time study.",{"key":80,"label":81,"low":82,"high":83,"unit":84,"note":85},"hourlyCost","Fully loaded cost of a reviewer or GRC analyst",50,80,"USD per hour","Editorial assumption. Replace with your own rate.","employees * grantsPerEmployee * cyclesPerYear * minutesPerGrant \u002F 60 * automationShare * hourlyCost","USD","per year","Reviewer time released across annual access review cycles","Reviewer time only. It leaves out the platform cost, the integration work per connected application, and the audit and breach risk reduced by faster, more consistent reviews, which is harder to price but is often the larger benefit.",[],{"complexity":93,"complexityNote":94,"dataPrerequisites":95,"integrations":100},"medium","Reading entitlements from well integrated systems (identity provider, core HR, major SaaS) is fast. Coverage of applications without an API, and getting business owners to actually review rather than rubber stamp, take longer and depend on executive sponsorship.",[96,97,98,99],"Identity and role or department data from HR, kept current","Entitlement data from every application in scope, including ones without a native connector","History of prior review decisions, to train the peer comparison","A defined owner for every application and resource in scope",[101,102,103,104],"Identity provider or directory (for identity and group membership)","HR system, for role, department and employment status","Target applications and their entitlement or role model, including ones synced without a native API","Ticketing or GRC platform, for exception routing and audit evidence",{"steps":106,"guardrails":122,"humanInTheLoop":128,"kpisToInstrument":129,"failureModes":135},[107,110,113,116,119],{"title":108,"detail":109},"Start with the systems that hurt the most","Pick the applications with the largest, messiest entitlement lists and the most reviewer complaints first; that is where automation saves the most time and builds the most trust.",{"title":111,"detail":112},"Feed it clean identity data","The peer comparison is only as good as role and department data from HR. Fix known gaps before turning on scoring, or the agent will learn from a wrong baseline.",{"title":114,"detail":115},"Calibrate on one cycle before trusting the scores","Run the first campaign with the agent's recommendations visible but not acted on automatically, and compare its flags against what reviewers actually decided.",{"title":117,"detail":118},"Pre approve narrowly, expand carefully","Start pre approval with the lowest risk, best understood access only, and widen the scope as false positive and false negative rates on real campaigns prove out.",{"title":120,"detail":121},"Close the loop on revocations","A review that flags excess access but does not remove it has not reduced risk. Automate the revocation step back to the source system wherever an integration allows it.",[123,124,125,126,127],"Every revocation and every exception decision is made or confirmed by a named human owner","Pre approval applies only to access below a defined risk threshold, reviewed and set by security","Every score shows the peer comparison and the reason behind it, so a reviewer can check it in seconds","Full audit log of every decision, the reviewer, and the score the agent presented","Privileged and administrative access is always routed for individual review, never pre approved","A named business or application owner decides every exception and every revocation of access above the pre approval threshold. Security or GRC teams set and periodically review the threshold, and internal audit samples decisions to check reviewers are not rubber stamping the agent's recommendations.",[130,131,132,133,134],"Project duration per review cycle, before and after","Share of grants pre approved versus individually reviewed","Reviewer decisions that overturn the agent's recommendation, to catch drift or miscalibration","Time from a flagged exception to a recorded decision","Access actually revoked as a share of access flagged as excessive",[136,139,142,145],{"title":137,"detail":138},"Automated rubber stamping","Pre approval becomes the new rubber stamp if the threshold is set too wide. Keep the threshold narrow and sample decisions for quality.",{"title":140,"detail":141},"Peer groups built on bad role data","A wrong or stale department or title field makes the agent's normal look abnormal, or the reverse. Fix identity data quality before trusting the scores.",{"title":143,"detail":144},"Coverage gaps outside the connected applications","Access in systems without an integration never gets reviewed at all, but the campaign looks complete. Track and report coverage explicitly, including what is out of scope.",{"title":146,"detail":147},"Flags without revocation","Exceptions get flagged and discussed but access is never actually removed. Instrument revocation completion as well as review completion.",{"euAiAct":149,"regulations":152,"guidance":158,"controls":159,"incidents":164},{"tier":150,"basis":151},"context-dependent","A tool that only certifies IT system access and revokes over provisioned entitlements is not itself a use listed in Annex III, and makes no decision about a natural person's employment, benefits or creditworthiness. But scoring how an employee's access compares to their peers sits close to Annex III's category on monitoring and evaluating the performance and behaviour of workers: if the score is used, or could be read, to judge conduct or performance rather than only system entitlements, treat it as high risk and run the full assessment. Keep the scoring scoped to entitlement risk, documented and reviewed, to stay on the lower risk side of that line.",[153,154,155,156,157],"eu-ai-act","gdpr","nis2","iso-42001","nist-ai-rmf",[],[160,161,162,163],"Inventory entry for the agent with an owner, its scoring logic and the applications in scope","Documented pre approval threshold, reviewed and signed off by security or GRC","Full audit log of every review decision, retained for the compliance period required","Periodic sampling of pre approved decisions by internal audit to check for rubber stamping",[],{"howToBuild":166},"On Blits.ai this is an **agentic workflow** triggered on a review campaign schedule or through\nthe API. **Custom functions** (REST calls) pull entitlements from\nconnected applications and identity and role data from HR, and an **AI agent** with\n**structured output** scores each grant against its peer profile, governed by a **tool\nexecution policy** that controls which tools it may use, including the revocation action.\n\nExceptions route to the named application owner through the outbound **email** channel, the\n**REST API channel**, or a custom function REST call into an existing GRC tool, with the score\nand the reason attached, and **human in the loop confirmation** lets a named owner approve or reject\nthe agent's revocation actions above a configurable threshold. **Run history with a full audit\ntrail** keeps the full campaign record for compliance, **PII masking** limits what identity\ndetail reaches the model, and run history **analytics** show review campaign trends over time. The\nplatform is model agnostic, with EU and UAE data residency for the identity data the agent\nprocesses.",[168,171,174],{"question":169,"answer":170},"Does an AI agent decide who keeps access?","No. The agent scores and groups entitlements so a named business or application owner spends time on the exceptions, and that owner confirms every revocation or exception decision. At AmeriGas, the AI recommendations in SailPoint show what share of a department holds an entitlement, and a person decides whether the user is a real outlier. The Lumos case study for Netskope also describes keeping humans in the loop for high risk scenarios.",{"question":172,"answer":173},"How much time does this actually save on access reviews?","Every figure found is a vendor claim, not an independent measurement. Lumos reports that access reviews at Netskope are accelerated by up to 70%, and gives 77% for its LLM powered analytics elsewhere on the same page. Zilla Security, now part of CyberArk, reports a 75% cut in the project duration of access reviews at Sprout Social, and Hippo Insurance Services' CISO says review time per application fell from about two weeks to around two days, but both of those cases are data collection and workflow automation with no AI described. SailPoint says AI recommendations and automated revocation doubled the effectiveness of its own certification campaigns, with no baseline.",{"question":175,"answer":176},"Is this only relevant to regulated industries?","Regulation is often what sets the review cadence: SOX and SOC 2 are common drivers, though SOC 2 is an attestation many SaaS vendors pursue rather than a legal requirement. Any organization with SaaS sprawl and entitlement drift has the same underlying problem of reviewers certifying access they do not understand.",[178],"continuous-controls-testing","2026-10-13",[181],{"date":179,"note":182},"First published","identity-and-access-review-agent",[185,212,239,256,290],{"title":186,"useCases":187,"organization":188,"vendors":193,"summary":197,"stage":198,"year":199,"channels":200,"languages":201,"metrics":202,"outcomeDisclosed":190,"sources":203,"verification":207,"grade":209,"id":210,"organizationSlug":211},"AmeriGas: AI recommendations inside access certifications",[183],{"name":189,"anonymized":190,"country":191,"region":192,"industry":20},"AmeriGas",false,"US","north-america",[194],{"name":195,"role":196},"SailPoint","platform","AmeriGas, the largest propane company in the United States, governs more than 7,000 identities and 600 plus roles with SailPoint. Certifications used to run on manual provisioning, spreadsheets and screenshots. Its Identity and Access Security Manager says the AI features inside SailPoint certifications now give reviewers recommendations: the system shows what share of a department holds an entitlement, so the reviewer can tell whether a user is an outlier who really needs the access. This matches the peer comparison step of an AI assisted access review. The case study is SailPoint's own and reports no figure for time saved on certifications, so no metric is recorded.","production",2026,[30],[],[],[204],{"url":205,"title":206,"publisher":195},"https:\u002F\u002Fwww.sailpoint.com\u002Fcustomers\u002Famerigas","AmeriGas embraces automation and moves to the cloud",{"level":208,"checkedAt":179},"source-verified","C","amerigas-sailpoint-ai-certification-recommendations",null,{"title":213,"useCases":214,"organization":215,"vendors":217,"summary":220,"stage":198,"year":199,"channels":221,"languages":222,"metrics":223,"outcomeDisclosed":232,"sources":233,"verification":237,"grade":209,"id":238,"organizationSlug":211},"Netskope: LLM powered risk flags for access reviews",[183],{"name":216,"anonymized":190,"country":191,"region":192,"industry":19},"Netskope",[218],{"name":219,"role":196},"Lumos","Netskope, a cloud security vendor, replaced a patchwork of identity tools with the Lumos Autonomous Identity Platform. Lumos describes LLM powered analytics that monitor risk, flag anomalies and toxic combinations of access, and route prioritized items to owners, with an AI agent that mines roles from assignment, usage and business context and keeps a human in the loop for high risk decisions. Lumos reports that access reviews at Netskope are accelerated by up to 70% and standing access is reduced by 80%. The figures come from the vendor's case study, not from Netskope.",[30],[],[224],{"kpi":44,"value":225,"unit":226,"qualifier":227,"period":228,"claimant":229,"quote":230,"sourceUrl":231},70,"percent","up-to","per access review","vendor","Automated role mining and policy management are driving security and efficiency where access reviews are accelerated by up to 70%, standing access reduced by 80%, and fewer managed roles reduces IT tickets and lowers costs.","https:\u002F\u002Fwww.lumos.com\u002Fstories\u002Fnetskope",true,[234],{"url":231,"title":235,"publisher":219,"date":236},"How Netskope Automates & Optimizes Access Governance with Lumos","2026-04-23",{"level":208,"checkedAt":179},"netskope-lumos-llm-access-review-prioritization",{"title":240,"useCases":241,"organization":242,"vendors":243,"summary":246,"stage":198,"year":199,"channels":247,"languages":248,"metrics":249,"outcomeDisclosed":190,"sources":250,"verification":254,"grade":209,"id":255,"organizationSlug":211},"SailPoint: AI recommendations in its own access certification campaigns",[183],{"name":195,"anonymized":190,"country":191,"region":192,"industry":19},[244],{"name":195,"role":245},"in-house","SailPoint runs its own identity governance product, SailPoint Identity Security Cloud, to manage its employees' access, a program it calls Customer Zero. Its case study says AI recommendations help managers see what they are approving and judge whether access is warranted during certification campaigns, and that automated revocation of risky entitlements doubled the effectiveness of those campaigns. The deployment is the vendor using its own product and the claims are the vendor's own, with no figure that maps to a taxonomy KPI, so no metric is recorded.",[30],[],[],[251],{"url":252,"title":253,"publisher":195},"https:\u002F\u002Fwww.sailpoint.com\u002Fcustomers\u002Fsailpoint-customer-zero-case-study","Customer Zero: How SailPoint advances identity security with its own solutions",{"level":208,"checkedAt":179},"sailpoint-customer-zero-ai-certification-recommendations",{"title":257,"useCases":258,"organization":259,"vendors":262,"summary":267,"stage":198,"year":268,"channels":269,"languages":270,"metrics":271,"outcomeDisclosed":232,"sources":279,"verification":287,"grade":209,"id":289,"organizationSlug":211},"Sprout Social: access review campaign time cut 75%",[183],{"name":260,"anonymized":190,"country":191,"region":192,"industry":19,"wikidata":261},"Sprout Social","Q17082977",[263,265],{"name":264,"role":196},"Zilla Security",{"name":266,"role":196},"CyberArk","Sprout Social's GRC team ran access reviews through a ticketing based, manual process to meet SOX and SOC 2 requirements, which grew harder to scale as the range of applications in scope expanded. It adopted Zilla Security (now CyberArk Comply, part of CyberArk) to sync access data directly from cloud applications, including ones without an API, and automate the review campaign instead of manual data pulls. Zilla Security, now CyberArk Comply, part of CyberArk, reports a large reduction for Sprout Social in how long each review campaign takes, alongside better communication with reviewers and easier scaling to new systems. The gain is data sync and workflow automation; neither source describes AI or machine learning anywhere in the deployment.",2024,[30],[],[272],{"kpi":44,"value":273,"unit":226,"qualifier":274,"period":275,"baseline":276,"claimant":229,"quote":277,"sourceUrl":278},75,"exact","per review campaign","Access review campaigns took up to five weeks before Zilla Security","After quickly deploying Zilla Security, Sprout Social saw a 75% reduction in project duration of access reviews, improved communication with reviewers, and enhanced scalability to support a growing range of applications and systems.","https:\u002F\u002Fzillasecurity.com\u002Fcase-studies\u002Fsprout-social-cuts-access-review-times\u002F",[280,283],{"url":278,"title":281,"publisher":264,"archivedUrl":282,"offline":232},"Zilla Helps Sprout Social Slash Access Review Times By 75%","https:\u002F\u002Fweb.archive.org\u002Fweb\u002F20250718173553\u002Fhttps:\u002F\u002Fzillasecurity.com\u002Fcase-studies\u002Fsprout-social-cuts-access-review-times\u002F",{"url":284,"title":285,"publisher":266,"archivedUrl":286},"https:\u002F\u002Fwww.cyberark.com\u002Fcustomer-stories\u002Fsprout-social\u002F","Sprout Social Cuts Access Review Campaign Times by 75% with CyberArk Modern IGA","https:\u002F\u002Fweb.archive.org\u002Fweb\u002F20260615042923\u002Fhttps:\u002F\u002Fwww.cyberark.com\u002Fcustomer-stories\u002Fsprout-social\u002F",{"level":208,"checkedAt":288},"2026-09-28","sprout-social-access-review-automation",{"title":291,"useCases":292,"organization":293,"vendors":296,"summary":298,"stage":198,"year":299,"channels":300,"languages":301,"metrics":302,"outcomeDisclosed":232,"sources":311,"verification":315,"grade":209,"id":316,"organizationSlug":211},"Hippo Insurance Services: access reviews cut from two weeks to two days per application",[183],{"name":294,"anonymized":190,"country":191,"region":192,"industry":295},"Hippo Insurance Services","insurance",[297],{"name":264,"role":196},"Hippo Insurance Services, a licensed property casualty insurance agent, ran user access reviews across dozens of SaaS and cloud applications holding sensitive financial information, ahead of quarterly compliance certifications by external auditors. The access reviews, taking up to two weeks per application, were a team effort across InfoSec, HR and legal, and preparing the audit materials was 100% manual: checking access rights, cross referencing job roles and validating changes by hand. Its InfoSec team adopted Zilla Security (now part of CyberArk) to automate the data collection and mapping across those applications. Hippo's CISO reports the process per application went from about two weeks to around two days, and most certifications could now be completed by two InfoSec team members alone, down from that cross team effort. Zilla's case study narration says over 90% of the previously manual tasks became automated. The gain is data collection and mapping automation; the source does not describe AI or machine learning.",2023,[30],[],[303],{"kpi":304,"value":69,"unit":305,"qualifier":306,"baseline":307,"claimant":308,"quote":309,"sourceUrl":310},"cycle-time-days","days","approximately","The access review process per application, previously a team effort across InfoSec, HR and legal, took up to two weeks to complete.","organization","The process that used to take two weeks per application was reduced to just around two days, and most of the certifications could now be completed by two members of the InfoSec team.","https:\u002F\u002Fzillasecurity.com\u002Fcase-studies\u002Fhippo-insurance-services-streamlines-user-access-reviews-with-zilla-security\u002F",[312],{"url":310,"title":313,"publisher":264,"archivedUrl":314,"offline":232},"Hippo Insurance Services Streamlines User Access Reviews with Zilla Security","https:\u002F\u002Fweb.archive.org\u002Fweb\u002F20250422094043\u002Fhttps:\u002F\u002Fzillasecurity.com\u002Fcase-studies\u002Fhippo-insurance-services-streamlines-user-access-reviews-with-zilla-security\u002F",{"level":208,"checkedAt":288},"hippo-insurance-access-review-automation",0,[319],{"kpi":44,"label":320,"unit":226,"aggregate":232,"higherIsBetter":232,"n":321,"nUpTo":321,"median":273,"min":273,"max":273,"byClaimant":322,"vendorOnly":232,"points":323},"Cycle time reduction",1,{"organization":317,"vendor":321,"regulator":317,"independent":317},[324,325],{"evidenceId":289,"organization":260,"value":273,"qualifier":274,"claimant":229,"grade":209,"pooled":232},{"evidenceId":238,"organization":216,"value":225,"qualifier":227,"claimant":229,"grade":209,"pooled":190},{"low":327,"high":328},48000,480000,[330,353,380,401],{"slug":178,"title":331,"shortTitle":332,"definition":333,"status":9,"industries":334,"functions":338,"patterns":342,"audience":344,"autonomy":33,"adoptionStage":34,"segment":345,"evidenceCount":346,"publicEvidenceCount":346,"organizations":347,"bestGrade":351,"headline":211,"lastVerified":352,"indexable":232},"AI for continuous controls testing and control self assessment","Continuous controls testing","AI continuous controls testing checks every transaction or record against a control's rule  instead of a periodic sample, giving continuous, full population assurance. It collects evidence from source systems, maps each artefact to the control it supports, flags exceptions for a human to judge, and prepares the risk and control self assessment from incident and loss data for the business to review.",[18,335,295,336,337],"banking","capital-markets","government",[339,340,341],"risk-management","regulatory-compliance","operations",[28,343,27,26],"document-processing","back-office","second-line",3,[348,349,350],"Federal Deposit Insurance Corporation","U.S. Department of the Interior","Pension Benefit Guaranty Corporation","B","2026-09-27",{"slug":354,"title":355,"shortTitle":356,"definition":357,"status":9,"industries":358,"functions":361,"patterns":362,"audience":32,"autonomy":33,"adoptionStage":365,"evidenceCount":366,"publicEvidenceCount":366,"organizations":367,"bestGrade":351,"headline":375,"lastVerified":352,"indexable":232},"security-alert-triage-and-investigation","AI for security alert triage and investigation in the SOC","Security alert triage","Security alert triage and investigation is an AI agent in the security operations centre that picks up each new alert or user reported phishing email. It gathers the evidence from the SIEM, endpoint, identity and threat intelligence tools, gives a verdict with its reasoning and a draft incident summary, and closes clear false positives while an analyst approves every containment action.",[18,359,19,337,360],"healthcare","professional-services",[22,23],[28,26,363,364],"summarization","rag-knowledge-assistant","early-adopters",7,[368,369,370,371,372,373,374],"Avanade","Federal Housing Finance Agency","Human Managed","SEP2","St. Luke's University Health Network","TÜV SÜD","U.S. Immigration and Customs Enforcement",{"kpi":376,"label":377,"unit":226,"n":346,"nUpTo":317,"kind":378,"value":379,"qualifier":274,"claimant":211,"organization":211,"vendorReported":190},"productivity-gain","Productivity gain","median",60,{"slug":381,"title":382,"shortTitle":383,"definition":384,"status":9,"industries":385,"functions":386,"patterns":387,"audience":32,"autonomy":389,"adoptionStage":365,"evidenceCount":390,"publicEvidenceCount":390,"organizations":391,"bestGrade":351,"headline":397,"lastVerified":352,"indexable":232},"software-vulnerability-remediation","AI for software vulnerability triage and remediation","Vulnerability remediation","AI vulnerability remediation is AI that takes security findings from scanners, fuzzers and bug reports and turns the real ones into a drafted code fix for developers. It filters out duplicates and false positives, reproduces and ranks the findings, and drafts a fix with a test for each, which a developer reviews and merges through the normal change process.",[18,19,359],[22,23],[388,28,26],"code-generation","copilot",6,[392,393,394,395,396],"AMD","Cathay Pacific","Google","Labelbox","PatientPoint",{"kpi":398,"label":399,"unit":226,"n":321,"nUpTo":317,"kind":400,"value":225,"qualifier":306,"claimant":229,"organization":392,"vendorReported":232},"automation-rate","Automation rate","reported",{"slug":402,"title":403,"shortTitle":404,"definition":405,"status":9,"industries":406,"functions":407,"patterns":408,"audience":32,"autonomy":33,"adoptionStage":365,"evidenceCount":366,"publicEvidenceCount":366,"organizations":409,"bestGrade":209,"headline":417,"lastVerified":288,"indexable":232},"cloud-cost-optimization-agent","AI agent for cloud cost optimization and FinOps","Cloud cost optimization agent","An AI agent that continuously manages an organization's cloud spending to cut waste. It reads usage and billing data, uses machine learning to separate normal spend from waste, and either rightsizes resources and buys a mix of committed capacity matched to forecast usage on its own within set limits, or proposes higher risk changes for an engineer to approve.",[18,19],[23],[27,25,28],[410,411,412,413,414,415,416],"Akamai Technologies","Banking Circle","Iterable","NielsenIQ","VERMEG","Wio Bank","Yotpo",{"kpi":418,"label":419,"unit":226,"n":420,"nUpTo":321,"kind":378,"value":82,"qualifier":274,"claimant":211,"organization":211,"vendorReported":190},"cost-reduction","Cost reduction",5,{"indexable":232,"reasons":422},[],[424,431,436,443,449,456,462,469,477,484,491,496,502,509,516,522,528,534,541,546,551,558,564,571,576,581,587,592,598,603,610,615,621,627,633,638],{"id":153,"label":425,"issuer":426,"region":427,"url":428,"description":429,"useCases":430,"indexable":232},"EU AI Act","European Union","europe","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1689\u002Foj","Regulation (EU) 2024\u002F1689: risk based rules for AI systems, with obligations for high risk systems listed in Annex III and transparency duties under Article 50.",275,{"id":154,"label":432,"issuer":426,"region":427,"url":433,"description":434,"useCases":435,"indexable":232},"GDPR","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj","General Data Protection Regulation, including Article 22 on decisions based solely on automated processing.",246,{"id":156,"label":437,"issuer":438,"region":439,"url":440,"description":441,"useCases":442,"indexable":232},"ISO\u002FIEC 42001","ISO and IEC","global","https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F81230.html","The international management system standard for AI.",143,{"id":157,"label":444,"issuer":445,"region":192,"url":446,"description":447,"useCases":448,"indexable":232},"NIST AI Risk Management Framework","NIST","https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework","Voluntary US framework to map, measure, manage and govern AI risk, with a generative AI profile.",110,{"id":450,"label":451,"issuer":452,"region":427,"url":453,"description":454,"useCases":455,"indexable":232},"uk-gdpr","UK GDPR","Information Commissioner's Office","https:\u002F\u002Fico.org.uk\u002Ffor-organisations\u002Fuk-gdpr-guidance-and-resources\u002F","The UK's version of the GDPR, including rules on solely automated decisions.",81,{"id":457,"label":458,"issuer":426,"region":427,"url":459,"description":460,"useCases":461,"indexable":232},"dora","DORA","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2022\u002F2554\u002Foj","Digital Operational Resilience Act for financial entities: ICT risk, incident reporting and third party risk, including AI providers.",72,{"id":463,"label":464,"issuer":465,"region":427,"url":466,"description":467,"useCases":468,"indexable":232},"uk-consumer-duty","FCA Consumer Duty","Financial Conduct Authority","https:\u002F\u002Fwww.fca.org.uk\u002Ffirms\u002Fconsumer-duty","UK rules that require firms to deliver good outcomes for retail customers, including through automated channels.",51,{"id":470,"label":471,"issuer":472,"region":473,"url":474,"description":475,"useCases":476,"indexable":232},"mas-ai-risk-management","MAS AI risk management guidelines","Monetary Authority of Singapore","asia-pacific","https:\u002F\u002Fwww.mas.gov.sg\u002Fnews\u002Fmedia-releases\u002F2025\u002Fmas-guidelines-for-artificial-intelligence-risk-management","Singapore's supervisory expectations for AI risk management at financial institutions, building on the FEAT principles.",37,{"id":478,"label":479,"issuer":480,"region":473,"url":481,"description":482,"useCases":483,"indexable":232},"apra-cps-230","APRA CPS 230","Australian Prudential Regulation Authority","https:\u002F\u002Fwww.apra.gov.au\u002Foperational-risk-management","Australian operational risk standard covering critical operations and material service providers.",26,{"id":485,"label":486,"issuer":487,"region":192,"url":488,"description":489,"useCases":490,"indexable":232},"us-sr-11-7","SR 11-7 model risk management","Federal Reserve and OCC","https:\u002F\u002Fwww.federalreserve.gov\u002Fboarddocs\u002Fsrletters\u002F2011\u002Fsr1107.htm","US supervisory guidance on model risk management, applied by banks to AI and machine learning models.",23,{"id":155,"label":492,"issuer":426,"region":427,"url":493,"description":494,"useCases":495,"indexable":232},"NIS2 Directive","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2022\u002F2555\u002Foj","Directive (EU) 2022\u002F2555 on cybersecurity for essential and important entities, including telecom networks, energy and public administration.",22,{"id":497,"label":498,"issuer":499,"region":439,"url":500,"description":501,"useCases":495,"indexable":232},"pci-dss","PCI DSS","PCI Security Standards Council","https:\u002F\u002Fwww.pcisecuritystandards.org\u002F","Security standard for any system that stores, processes or transmits cardholder data.",{"id":503,"label":504,"issuer":505,"region":427,"url":506,"description":507,"useCases":508,"indexable":232},"uk-atrs","UK Algorithmic Transparency Recording Standard","UK Government","https:\u002F\u002Fwww.gov.uk\u002Fgovernment\u002Fcollections\u002Falgorithmic-transparency-recording-standard-hub","Mandatory transparency records for algorithmic tools used by UK central government.",18,{"id":510,"label":511,"issuer":512,"region":192,"url":513,"description":514,"useCases":515,"indexable":232},"hipaa","HIPAA","US Department of Health and Human Services","https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Findex.html","US rules for the privacy and security of protected health information.",17,{"id":517,"label":518,"issuer":519,"region":439,"url":520,"description":521,"useCases":57,"indexable":232},"fatf-recommendations","FATF Recommendations","Financial Action Task Force","https:\u002F\u002Fwww.fatf-gafi.org\u002Fen\u002Fpublications\u002FFatfrecommendations\u002FFatf-recommendations.html","Global standards for anti money laundering and counter terrorist financing that national rules implement.",{"id":523,"label":524,"issuer":426,"region":427,"url":525,"description":526,"useCases":527,"indexable":232},"eu-amlr","EU Anti Money Laundering Regulation","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2024\u002F1624\u002Foj","Regulation (EU) 2024\u002F1624: the single EU rulebook for customer due diligence, beneficial ownership and suspicious transaction reporting.",14,{"id":529,"label":530,"issuer":531,"region":192,"url":532,"description":533,"useCases":527,"indexable":232},"us-tcpa","Telephone Consumer Protection Act","Federal Communications Commission","https:\u002F\u002Fwww.fcc.gov\u002Fconsumers\u002Fguides\u002Fstop-unwanted-robocalls-and-texts","US consent rules for automated and prerecorded calls and texts; the FCC has confirmed AI generated voices count as artificial voices.",{"id":535,"label":536,"issuer":537,"region":192,"url":538,"description":539,"useCases":540,"indexable":232},"us-bsa","Bank Secrecy Act","FinCEN","https:\u002F\u002Fwww.fincen.gov\u002Fresources\u002Fstatutes-and-regulations\u002Fbank-secrecy-act","US anti money laundering law: customer due diligence, suspicious activity reports and record keeping.",13,{"id":542,"label":543,"issuer":426,"region":427,"url":544,"description":545,"useCases":540,"indexable":232},"eu-accessibility-act","European Accessibility Act","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2019\u002F882\u002Foj","Directive (EU) 2019\u002F882: accessibility requirements for banking services, ecommerce and other digital services, applicable since June 2025.",{"id":547,"label":548,"issuer":426,"region":427,"url":549,"description":550,"useCases":540,"indexable":232},"solvency-ii","Solvency II","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2009\u002F138\u002Foj","Directive 2009\u002F138\u002FEC: risk based capital, governance and model requirements for insurers.",{"id":552,"label":553,"issuer":554,"region":192,"url":555,"description":556,"useCases":557,"indexable":232},"us-ecoa-reg-b","ECOA and Regulation B","Consumer Financial Protection Bureau","https:\u002F\u002Fwww.consumerfinance.gov\u002Frules-policy\u002Fregulations\u002F1002\u002F9\u002F","US fair lending rules, including specific reasons in adverse action notices, which also apply when credit decisions use AI models.",12,{"id":559,"label":560,"issuer":561,"region":439,"url":562,"description":563,"useCases":557,"indexable":232},"telecom-consumer-rules","Telecom consumer protection rules","National telecom regulators","https:\u002F\u002Fwww.berec.europa.eu\u002F","National rules on telecom contracts, switching, billing disputes and marketing consent.",{"id":565,"label":566,"issuer":567,"region":427,"url":568,"description":569,"useCases":570,"indexable":232},"eba-loan-origination","EBA Guidelines on loan origination and monitoring","European Banking Authority","https:\u002F\u002Fwww.eba.europa.eu\u002Fregulation-and-policy\u002Fcredit-risk\u002Fguidelines-on-loan-origination-and-monitoring","Expectations for credit decisioning, including the use of automated models.",11,{"id":572,"label":573,"issuer":426,"region":427,"url":574,"description":575,"useCases":570,"indexable":232},"eecc","European Electronic Communications Code","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2018\u002F1972\u002Foj","Directive (EU) 2018\u002F1972: consumer protection, contract, switching and security rules for telecom operators.",{"id":577,"label":578,"issuer":426,"region":427,"url":579,"description":580,"useCases":570,"indexable":232},"eu-psd2","PSD2","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2015\u002F2366\u002Foj","Payment Services Directive 2: strong customer authentication, transaction risk analysis exemptions and open banking access.",{"id":582,"label":583,"issuer":472,"region":473,"url":584,"description":585,"useCases":586,"indexable":232},"mas-notice-626","MAS Notice 626","https:\u002F\u002Fwww.mas.gov.sg\u002Fregulation\u002Fnotices\u002Fnotice-626","Singapore's anti money laundering and counter terrorism financing requirements for banks.",10,{"id":588,"label":589,"issuer":426,"region":427,"url":590,"description":591,"useCases":586,"indexable":232},"mifid-ii","MiFID II","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2014\u002F65\u002Foj","Directive 2014\u002F65\u002FEU on markets in financial instruments: suitability and appropriateness of advice, record keeping and product governance.",{"id":593,"label":594,"issuer":595,"region":192,"url":596,"description":597,"useCases":56,"indexable":232},"us-fcra","Fair Credit Reporting Act","Federal Trade Commission","https:\u002F\u002Fwww.ftc.gov\u002Flegal-library\u002Fbrowse\u002Fstatutes\u002Ffair-credit-reporting-act","US rules on consumer reports, their accuracy and permissible use, relevant to credit scoring and screening.",{"id":599,"label":600,"issuer":426,"region":427,"url":601,"description":602,"useCases":366,"indexable":232},"eu-idd","Insurance Distribution Directive","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2016\u002F97\u002Foj","Directive (EU) 2016\u002F97: conduct rules for selling insurance, including demands and needs testing and advice.",{"id":604,"label":605,"issuer":606,"region":607,"url":608,"description":609,"useCases":420,"indexable":232},"cbuae-ai-guidance","CBUAE guidance on AI and ML","Central Bank of the UAE","middle-east","https:\u002F\u002Fwww.centralbank.ae\u002F","UAE central bank expectations for the enabling technologies, AI and machine learning used by licensed financial institutions.",{"id":611,"label":612,"issuer":426,"region":427,"url":613,"description":614,"useCases":63,"indexable":232},"eu-mortgage-credit-directive","EU Mortgage Credit Directive","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2014\u002F17\u002Foj","Directive 2014\u002F17\u002FEU: creditworthiness assessment, disclosure and advice rules for residential mortgage lending.",{"id":616,"label":617,"issuer":618,"region":427,"url":619,"description":620,"useCases":63,"indexable":232},"pra-ss1-23","PRA SS1\u002F23 model risk management","Prudential Regulation Authority","https:\u002F\u002Fwww.bankofengland.co.uk\u002Fprudential-regulation\u002Fpublication\u002F2023\u002Fmay\u002Fmodel-risk-management-principles-for-banks-ss","UK model risk management principles for banks, covering AI and machine learning models.",{"id":622,"label":623,"issuer":624,"region":427,"url":625,"description":626,"useCases":63,"indexable":232},"uk-psr-app-reimbursement","UK APP scam reimbursement rules","Payment Systems Regulator","https:\u002F\u002Fwww.psr.org.uk\u002Four-work\u002Fapp-scams\u002F","Mandatory reimbursement of authorised push payment scam victims by UK payment firms, which shifts scam losses onto banks.",{"id":628,"label":629,"issuer":630,"region":473,"url":631,"description":632,"useCases":346,"indexable":232},"au-scams-prevention-framework","Australian Scams Prevention Framework","Australian Treasury","https:\u002F\u002Ftreasury.gov.au\u002Fconsultation\u002Fc2024-573813","Economy wide obligations for banks, telcos and digital platforms to prevent, detect, disrupt and respond to scams.",{"id":634,"label":635,"issuer":426,"region":427,"url":636,"description":637,"useCases":346,"indexable":232},"eu-mar","EU Market Abuse Regulation","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2014\u002F596\u002Foj","Regulation (EU) 596\u002F2014: insider dealing and market manipulation, including the duty to detect and report suspicious orders and transactions.",{"id":639,"label":640,"issuer":641,"region":192,"url":642,"description":643,"useCases":346,"indexable":232},"nyc-local-law-144","NYC Local Law 144","New York City","https:\u002F\u002Fwww.nyc.gov\u002Fsite\u002Fdca\u002Fabout\u002Fautomated-employment-decision-tools.page","Bias audits and notices for automated employment decision tools used in hiring and promotion in New York City.",1791904353794]