AI agents change the picture because they are built to act as well as answer. Gartner expects task-specific agents to appear in 40% of enterprise applications by the end of 2026, up from less than 5% in 2025, and predicts that by 2028 networks of specialized agents will collaborate across multiple applications and business functions. Business processes rarely stop at the edge of a single company, so those agents will eventually need data that other organizations hold.
That raises a question the readiness conversation mostly skips. What happens when the data an agent needs belongs to another company?
Business processes already cross company lines
Consider an agent that plans and buys a media campaign for an advertiser. It needs the advertiser’s customer data and a publisher’s audience data, and measuring the result may also depend on a retailer’s sales data. Each of those datasets sits with a different owner who has its own policies and contracts. None of them was designed to be queried by an autonomous system acting on someone else’s behalf.
Human-run versions of this process rely on judgment and relationships. A media planner calls a publisher, the publisher decides what to reveal about its audience, and both sides understand the purpose of the conversation. An agent can issue far more requests at far greater speed, and it may lack the context that tells a person when to stop asking.
Access rules were built for people
Most access controls inside a company are built around roles, and a role belongs to a person who can be held accountable. An agent buying media for an advertiser breaks that assumption. The publisher receiving its request has to decide whether the agent is authorized, by whom, for which campaign, and until when, and none of those facts sit in a user account.
Open protocols are making agent-to-agent communication easier. The Linux Foundation’s A2A project reported more than 150 supporting organizations at its one-year mark in April 2026, and describes the protocol as a way for agents to coordinate across organizational boundaries, while the Model Context Protocol covers how an agent connects to internal tools and data sources. Those standards govern how agents talk to each other. What an agent may ask for, and what the other side may release, remains a matter for each organization’s own policy, which has to be written before the first request arrives.
Sovereignty complicates every hop
Data is subject to the rules of the places where it is stored and processed. A single cross-company task can touch several jurisdictions, and an agent that moves information to complete it may create a transfer that nobody planned.
Regulation is also moving toward more structured data access between businesses. The EU Data Act, which has applied since September 12, 2025, sets conditions for business-to-business sharing and protects companies from unfair contractual terms in data-sharing arrangements. It also includes safeguards against unlawful international transfers of non-personal data. An organization deploying agents in Europe will want to know which provisions apply before an agent acts, because a compliance review after the fact comes too late.
Commercial sensitivity limits what partners will disclose
Even where the law permits sharing, commercial logic often forbids it. Pricing, margins, audience segments, and customer lists are valuable precisely because competitors cannot see them. A publisher may be willing to confirm that a campaign can reach a given audience while refusing to expose the user-level records behind the answer.
The Data Act acknowledges this tension. Its sharing obligations allow manufacturers to refuse to share data when doing so risks exposing trade secrets.
Agents sharpen the concern, because the counterparty is now software whose behavior and training may be opaque. A company may reasonably ask what the other party’s agent will retain, who can inspect its outputs, and whether the information could be used to improve a model that also serves a competitor.
Collaborating without centralizing the data
Sharing data means handing over a copy. Collaborating around data means each party keeps its records and receives answers computed on them.
Two familiar patterns both strain under these conditions. Pooling everyone’s data in one place concentrates risk and rarely survives legal and commercial review. Granting each agent direct access to another company’s records exposes far more than most tasks require.
A third approach is to let computation travel to the data, or to let several parties compute a joint result without any of them seeing the others’ inputs. The UK Information Commissioner’s Office, in its guidance on privacy-enhancing technologies, introduces eight types of these tools and explains the risks and benefits of each. Among them are federated learning and secure multi-party computation.
In advertising and media, one version of this idea is already in daily use: the data clean room. The IAB Tech Lab’s clean room guidance describes it as a secure collaboration environment in which two or more participants use data for specific, mutually agreed purposes, with strict limits on what each can see. Implementations differ in the technology they use and in who operates the environment, which can be an independent provider or one of the participants. Agents add a new test, because the same guidance lists limits on the number and type of queries among the controls a clean room should apply, and software can issue far more queries than a human analyst.
None of these is a complete answer. The OECD has cautioned that federated and distributed analytics can still leak information. Each method carries different trade-offs in performance and in the level of assurance it provides, so the choice should follow the sensitivity of the data and the nature of the task.
What businesses should consider
Organizations can start preparing before agents reach cross-company workflows at scale. A useful first step is to map which processes already depend on outside data, since those are the first places agents will need it. The next is to decide which questions a partner’s agent may ask and which answers should never leave the building. Four considerations help to frame that work:
- Authority and purpose. Define who or what can authorize an agent to request data from another company, for which purposes, and for how long.
- Location and jurisdiction. Know where data will be processed during a task and which legal regimes apply along the way.
- Disclosure limits. Agree in advance which outputs each party may receive, so that raw records stay with their owner.
- Evidence. Keep logs that both parties can inspect, since accountability for an agent’s actions will be shared across companies.
An infrastructure question
Preparing internal data for AI was the first stage of the work. Making agents useful across organizational boundaries is the second, and it calls for different tools and different agreements. Companies that settle who may ask for what, and under which jurisdiction, will find it easier to let agents act on their behalf. Agents will cross organizational lines whether or not the supporting infrastructure is ready. The organizations that prepare now will have more say in the terms on which that happens.
