The use of AI agents and agentic systems is rising quickly across industries. In a highly regulated environment like insurance, it is critical to maintain regulatory compliance, and that applies to the use of AI agents.
At two recent meetings, I was asked about use of AI agents. One was with the New York Department of Financial Services (DFS), and the second was at a PIA NY/NJ conference. Unfortunately, in both instances, I did not have a good answer, as the industry is still struggling with authentication efficiency and broadening the scope to add authentication of AI agents was uncharted territory at that moment. However, these questions made it clear that the increased use of AI agents that have the ability to access information and transact business is a growing concern in the insurance industry.
In a LinkedIn article I read, the author discussed how she used AI agents to do more than 200 hours of work in a single week. She stated these agents access information to execute tasks by themselves, provide reporting, and contribute to the company knowledge base. What she did not mention but I would infer is that the AI agents used her credentials to complete this work.
Regulations, and often carrier contracts, stipulate rules for the use of issued credentials. DFS’s cybersecurity compliance extends to “any individual or organization operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law.” Specific requirements defined in 23 NYCRR Part 500.12 require the use of multifactor authentication (MFA) for access to any information system by any user.
There were questions regarding compliance for entities not regulated by DFS. To clarify expectations, DFS issued industry guidance in October 2025 related to third-party providers. The letter indicated third-party service providers are expected to adhere to existing regulations and that “covered Entities may not delegate responsibility for compliance with the Cybersecurity Regulation.” The guidance—which says a regulated firm remains responsible for the cyber risk posed by its third-party vendors and cannot delegate its compliance obligations—is likely to extend to agentic commerce.
ID Federation’s goal is to maintain security and improve efficiency across the independent agent channel. With a single ID, password, and MFA, agents can access carrier systems in a secure manner. The Trust Framework was updated two years ago to improve MFA transparency. The next step will be to evaluate how the Trust Framework supports the use of AI agents and agentic systems.
Use of standards makes the industry stronger. Leading carriers, including The Hartford and Nationwide Insurance, currently support SignOn Once from ID Federation. Ask your carriers to join ID Federation using this link https://idfederation.org/engage-your-carriers/.
