39% of organizations now use mobile credentials, and access control is moving to IT

Mobile credentials have crossed the line from “innovation project” to planning assumption. HID’s 2024 State of Physical Access Control Report, based on a survey of more than 1,200 security professionals conducted from November 2023 to January 2024, found 39% of organizations actively using mobile identities, according to Security Systems News.

That single number changes how enterprise operators should frame the next badge, reader, or PACS refresh. When four in ten peers have already moved identity onto phones, access control stops behaving like a door-hardware lifecycle and starts behaving like an IT-managed identity program, complete with platform choices, integrations, and operating costs.

The new baseline: mobile IDs and touchless are winning budget share

In HID’s survey, respondents pointed to touchless and contactless solutions (48%) along with mobile access (44%) as the top two trends influencing the access control industry, Security Systems News reported. In practice, that means the choice of a “credential” has become as much about user experience as it is about security, pulling HR, IT, and workplace teams into what used to be a security-only buying motion.

SDM Magazine’s April 2026 “State of the Market: Access Control” story puts language around what many enterprises are already experiencing: access control is increasingly treated as a foundational operational platform rather than a standalone security subsystem. In SDM’s 2026 Industry Forecast results cited in the piece, 60% of respondents said they expect revenue to increase, while 37% expect it to remain the same and 3% expect it to decrease.

For operators, that confidence matters less as “market sentiment” and more as a supply-side signal: more vendor roadmaps, more integration services, and more feature differentiation aimed at software value, not just reader counts. That is good news if an enterprise wants options. It also means RFPs that read like 2016, card formats, door schedules, panel counts, will miss what vendors are building for 2026 buying committees.

Open standards and “smart building” uses are turning PACS data into enterprise data

HID’s report also links access control with smart building operations. Security Systems News reported that nearly half of organizations (48%) have some level of access control or badge scanning systems used to track building usage during the day. Another 43% named smart buildings and flexible workspaces as a top-three trend, and 32% cited integration with other business functions as a top trend.

Read operationally, those figures suggest that a growing share of deployments are being justified, and measured, on outcomes beyond entry. Occupancy management, space utilization, visitor flow, and audit readiness all depend on data quality and integration discipline. That pushes enterprises toward open standards and clean interfaces because the “value” of the system increasingly sits in how reliably events land in other systems.

This is where procurement teams can inadvertently lock in future costs. If a platform’s integrations require proprietary connectors, every new workflow becomes a professional services line item. If the platform is built for common identity and building-management integrations, the cost moves from bespoke work to repeatable configuration.

AI and biometrics are moving into mainstream evaluations, with costs now on the checklist

HID’s survey found 38% of respondents are looking to incorporate AI or machine learning into their access control solutions, though the same share said they were unsure of the benefits, Security Systems News reported. That split is an operator’s reality: teams are being asked to pay for analytics without always having a clean success metric.

At the same time, vendor roadmaps are arriving as products, not slideware. SecurityInfoWatch reported in August 2026 that HID integrated document reading and facial verification technologies with Soloinsight’s CloudGate platform as part of a CTS visitor check-in kiosk, positioning identity verification and auditability as a front-desk workflow rather than a separate system. SecurityInfoWatch also reported in July 2026 that HID introduced its Amico facial recognition readers across North America, offering multi-modal biometric access control in 3.5-inch and 7-inch touchscreen models.

Security Systems News separately reported in July 2026 on HID’s North American availability of Amico facial recognition readers, describing the company’s intent to broaden biometric access across more deployment sizes and price points. Taken together, trade coverage suggests biometric access is being packaged for mainstream procurement cycles, with fewer “custom integration” hurdles than earlier facial recognition rollouts.

The other AI issue is cost, and enterprise surveys are now putting numbers on it. McKinsey & Company’s “State of AI in 2026” survey reported that about 20% of respondents said AI-related operating costs constrained AI use. The same report found 32% of respondents said their organizations chose not to purchase one or more software products or features, since agentic coding tools could enable internal teams to build them in-house.

That McKinsey data is not access-control-specific, but it belongs in security program budgeting because PACS roadmaps increasingly include AI-driven video and access analytics, identity verification modules, and automation features that are priced and consumed like software. If AI operating costs are already constraining adoption elsewhere in the enterprise, security leaders should expect harder questions about analytics subscriptions, cloud processing fees, and “per-event” pricing models as they standardize on touchless and biometric workflows.

Where this lands in 2027 refresh planning for facilities, IT, and security

HID’s report also highlights sustainability as an explicit stakeholder in access control upgrades: 63% of respondents said those responsible for sustainability have some influence or are fully consulted in upgrade decisions, according to Security Systems News. That widens governance even further and reinforces the need for a program-style approach: business case, lifecycle plan, and a defensible data and privacy posture.

For enterprises with hybrid workforces, multi-tenant facilities, or high visitor volume, the combination of mobile credentials, usage monitoring, and stronger ID verification is pushing access control into the same portfolio as IAM, workplace experience apps, and building operations platforms. SDM’s framing of access control as a matured integration layer matches that reality, and recent HID product moves reported by SecurityInfoWatch show vendors building toward it.

Questions to bake into access control RFPs this quarter

• Mobile credential operations: Who owns credential issuance and revocation, security or IT, and what are the exact admin workflows for lost phones, device upgrades, and contractor offboarding? HID’s survey benchmark of 39% active mobile identity use is a useful peer reference for “how normal this is.”
• Integration scope and standards: Which systems will consume access events in the next 24 months, space management, visitor management, HR, incident management, and what APIs or standard interfaces are supported without custom middleware? HID’s survey puts monitoring building usage at 48% adoption, so this is already a mainstream use case.
• AI and biometrics cost model: For analytics, identity verification, and facial recognition, what are the recurring fees, cloud processing assumptions, and scaling thresholds? McKinsey’s finding that AI operating costs constrained usage for about 20% of organizations is a reminder to model run-rate, not just project cost.
• Visitor identity proofing: If the enterprise wants higher-assurance visitor check-in, can the vendor support document authentication and facial verification in workflow tools that facilities already run? SecurityInfoWatch’s reporting on HID’s integration into a visitor check-in kiosk shows what “productized” looks like in 2026.