There are processes in IT that have been running manually for ten years.

Not because there is no better way. But because the better way has never been given priority.

Access reviews are a good example. Every quarter, or perhaps once a year, someone sends an Excel export round to all managers. Who still has which entitlements? Is that still correct? Please confirm by Friday.

Half do not respond. A quarter respond with looks fine without looking. A small minority makes a real effort. And the outcome? A document that is sufficient for the auditor, but says little about the actual risks in the environment.

This is the reality of identity governance in many organisations. And it is also exactly the area where AI can make the biggest difference.

Why IAM and AI fit together so well

Identity management runs on data. Enormous amounts of data: who has which access, when that access was granted, how often it is used, when someone changed role, when someone left.

That data is already there. But it is hardly used.

An IAM system records that an employee was given entitlements for an application three years ago. The system also records that the employee has never logged in to that application since. But those same entitlements are still active, and they are carried into the next access review as a row in an Excel sheet that nobody recognises.

AI is good at exactly this kind of pattern recognition. It can flag anomalies. It can identify unused entitlements. It can mark deviations that a human reviewer would never notice in a list of a thousand lines.

That is not futurism. It is already possible today.

Three areas where it already works

1. Access reviews that go beyond confirming

Instead of asking a manager "is this still correct?", an AI-driven system can make a preselection: these are the accounts that have not been used for six months. These are the entitlements that fall outside the standard role set. These are the combinations of access that carry an increased risk.

The manager no longer has to go through a thousand lines, only through the exceptions that really deserve attention.

The result: faster reviews, better quality, less risk that dangerous combinations go unnoticed.

2. Joiner-mover-leaver without manual steps

The classic problem: someone moves to another department and gets new entitlements. The old entitlements are forgotten. After a year that same person has entitlements that belong to three different roles, and none of the combinations has ever been explicitly approved.

With AI-driven lifecycle management this pattern is detected automatically. Roles that no longer fit the current job are flagged. Provisioning requests are checked against the standard role set. Deviations go automatically to the right approver, instead of disappearing into the administration.

3. Risk analysis on access requests

Not every access request is the same. A request for read access to a project document is different from a request for administrator rights on a production system.

AI can support that assessment: based on the role of the requester, the requested entitlements, the combination with existing access and historical patterns, a risk level can be determined. Low risk goes through automatically. High risk goes to a human.

That is not replacing the human. It is using automation for the cases that can handle it, so that the human can focus on the cases that require it.

But there is a precondition

AI speeds up what is already there. It does not repair chaos.

If your identity data is not correct, if accounts have been created carelessly, if roles are not properly defined, if you have no clear role model, then AI makes that chaos visible faster and on a larger scale. Not smaller.

The organisations that are now using AI successfully in their IAM environment have one thing in common: they got their foundation in order first.

Clean data. Clear governance. Documented processes. A role model that reflects reality.

That is the work that comes first. It is also the work that is the least glamorous, and the most often postponed.

Looking ahead

The integration of IAM and AI is not hype. It is a logical next step for a domain that has struggled for years with scale, manual processes and the impossibility of seeing everything you should be seeing.

The tools are there. The platforms are maturing. The use cases are proven.

So the question I ask organisations is not "Do you want to do something with this?". That question answers itself.

The question is: "Is your foundation strong enough to put AI on top of it?"

If the answer is yes, the possibilities are greater than most organisations currently realise.

If the answer is no, that is good news too, because it tells you exactly where to start.