Short answer. The Agent-to-Agent (A2A) protocol is an open standard, released by Google in April 2025 with more than 50 industry partners and donated to the Linux Foundation in June 2025, that lets autonomous AI agents built on different frameworks and run by different vendors discover each other and delegate tasks. An agent uses one protocol to reach its own tools, and it uses A2A to reach a peer agent it does not control. A2A runs on HTTP, JSON-RPC, and Server-Sent Events, so it fits existing enterprise infrastructure without new plumbing.
A2A defines a shared language for AI agents to collaborate across organizational and vendor boundaries. Three parts carry most of the design. Agent Cards are machine-readable JSON descriptors that each agent publishes, listing its name, version, skills, input and output formats, and the security schemes it requires. Tasks are units of work with a defined lifecycle that moves through submitted, working, input-required, completed, canceled, and failed, each carrying structured payloads that can hold text, files, and data. The transport layer uses HTTP, JSON-RPC requests, and Server-Sent Events for streaming updates.
Consider a mortgage application handled by a multi-agent system. An orchestrator agent delegates the work to specialists:
Each specialist can be built by a different team or a different vendor. A2A is the wire between them, and none of them needs custom integration code written for the others. In production multi-agent systems built in 2026, teams commonly pair A2A with the Model Context Protocol: A2A connects agents to each other, and MCP connects each agent to its own tools and data.
For banks and insurers, a multi-agent system crosses trust boundaries that regulators already govern. When one agent delegates a task to another agent owned by a third party, that delegation is an ICT service dependency. Under DORA, in force since 17 January 2025, financial entities must manage ICT third-party risk, keep a register of information on their ICT service providers, and hold contractual and monitoring controls over them. An A2A link to an external agent is exactly the kind of dependency DORA expects a financial entity to inventory and control.
The EU AI Act adds a second layer. Its obligations attach to the provider and the deployer of an AI system, with full compliance for high-risk systems due by 2 August 2026. When agents chain decisions across a credit or claims workflow, a bank has to show which agent made which decision and on what basis. A2A’s task lifecycle and structured payloads can supply that audit trail, but only when the bank logs and retains them.
A2A is an open protocol, released by Google in April 2025 and donated to the Linux Foundation in June 2025, that lets AI agents discover each other and delegate tasks across vendor and organizational boundaries.
MCP and A2A solve different problems and work together. MCP standardizes how a single agent reaches its own tools, such as databases, APIs, and file systems. A2A standardizes how one agent reaches a peer agent it does not control. One is vertical, agent to tool. The other is horizontal, agent to agent. Most non-trivial multi-agent systems use both at once: A2A stitches a mesh of specialist agents across teams and vendors, and MCP wires each agent in that mesh to the data and tools it needs. If you have read our explainer on the Model Context Protocol (MCP), A2A is the layer that sits above it and lets those tool-equipped agents talk to one another.
An Agent Card is a JSON document that an agent publishes so other agents can find it and evaluate it. It declares the agent’s name, version, supported interfaces, capability flags such as streaming and push notifications, a list of skills with identifiers and examples, and the security schemes the agent requires. In version 1.0 of the protocol, a card can carry an AgentCardSignature that uses JSON Web Signature (RFC 7515) over a canonicalized copy of the card, so a client can detect tampering before it trusts the agent. The card is the discovery and trust anchor of A2A. Its quality decides whether a calling agent picks the right partner and can verify that the partner is genuine.
A2A specifies how agents advertise authentication schemes, but it does not mandate how Agent Cards are verified. That gap opens three concrete risks: agent impersonation, card tampering, and replay attacks. If the backend logic behind an agent skips authorization checks on roles and scopes, a caller can trigger actions it should not be allowed to perform. The protocol has no built-in requirement for strong authentication on high-value actions such as payments, and on its own it does not satisfy PSD2 strong customer authentication. A trusted third-party agent can also be compromised through a breach in its own environment, which turns a legitimate A2A link into an attack path. The mitigations are known: verify signed Agent Cards, enforce authorization at the backend, sanitize inputs, log every task, and monitor agent behavior continuously.
Start with an inventory. List every agent, internal and external, that will participate, and record each external one as an ICT dependency in the DORA register. Require signed Agent Cards and reject unsigned ones. Put an authorization gateway in front of each agent so identity, roles, and scopes are checked on every task rather than assumed from the card. Log the full task lifecycle with immutable records for audit. Define which decisions an agent may take autonomously and which need human oversight, in line with the EU AI Act. Run adversarial testing against impersonation and replay before the first production workload. These controls sit outside the protocol, so the bank owns them.
Ableneo shipped 34 production AI projects across four countries in 2025, and 94% of them use large language models, so agent architecture is daily engineering work here, not a slide. Multi-agent systems in banking and insurance hold up when the connections between agents are governed as strictly as the models themselves. We design the identity, authorization, and audit layers around protocols like A2A and MCP so a mesh of agents stays observable and accountable inside a regulated environment. See our approach to AI transformation for how we take agent systems from pilot to production.
Key takeaways
Planning AI in a regulated business? Ableneo takes systems from classification to governed production.