Recertification is a scheduled review that confirms an AI system still has a valid owner, a defined scope, and a real business need. In security programs, it works like access revalidation for non-human identities: the team checks whether an agent, connector, or model integration should still exist, what data it can reach, and whether its permissions remain appropriate.
This matters because AI systems often accumulate privilege over time. A forgotten chatbot or workflow agent can keep access to tickets, documents, APIs, or databases long after the original project changes. Without recertification, that stale access becomes an attack surface for abuse, misuse, or lateral movement. Defenders use recertification to remove dead integrations, shrink permissions, force ownership, and prove that every active AI capability is still justified and logged.