AI Agents in Business: What They Can Do and How to Start Safely

AI agents are the next big topic after the chatbot: instead of just answering questions, they work through tasks. They read an email, look up the customer in the CRM, draft a quote and submit it for approval. This guide explains what an AI agent is technically, where it pays off, how much autonomy you should give it and how to get started without nasty surprises.

In short: An AI agent is a language model that is given a goal and decides for itself which steps and tools to use to reach it. It pays off for recurring, multi-step knowledge work with clear quality criteria. What makes it safe is tightly limited permissions, graduated autonomy and approval gates at which a human decides before anything leaves the company or moves money.

What is an AI agent?

An AI agent combines three building blocks: a language model as the "reasoning engine", tools such as database queries, sending email or API calls, and a control loop that keeps planning, acting and checking until the goal is reached or a stop condition kicks in.

In its guide Building effective agents, Anthropic distinguishes two architectures: workflows, in which language models and tools follow predefined code paths, and agents, in which the model directs its own process and tool use. This distinction matters in practice. Many tasks sold as "agents" are really workflows, and that is often a good thing: they are more predictable, cheaper and easier to verify. The same guide explicitly recommends starting with the simplest solution and adding complexity only when it demonstrably improves results.

For an overview of related terms such as language model, prompt or RAG, see the glossary (in German).

Agent, chatbot or RPA: the difference

The three approaches are often confused. The table below shows the key differences:

Feature	Chatbot	RPA bot	AI agent
Basic principle	answers questions in a dialogue	repeats hard-coded click sequences	pursues a goal and plans the steps itself
Handling variation	good with language, no actions	breaks on unexpected screens	adapts to unstructured input
Tools	usually none, or knowledge lookup only	user interfaces, macros	APIs, databases, email, files
Typical task	FAQs, first-line information	moving data between legacy systems	assess an enquiry, draft a quote, create a case
Main risk	wrong information	silent errors when layouts change	wrong action with real consequences
Control	response rules	scripts	permissions, autonomy levels, approvals

The decisive point is in the second-to-last row: a chatbot can be wrong; an agent can be wrong and act on it. That is why it needs a different kind of control.

Where AI agents pay off today

You can spot good candidates by three characteristics: the task occurs frequently, it consists of several steps across different systems, and there is a clear criterion for when the result is good. Typical areas:

Sales and customer service

Agents qualify incoming enquiries, research company data, prioritise leads and prepare quotes. On the phone, voice agents handle call answering and appointment booking. Handing over to humans remains part of the design, not the emergency plan.

Back office and finance

Incoming invoices, receipt checks, dunning and master data maintenance are classic fields: many variants, clear rules, easily measurable error rates. Here, agents often replace RPA pipelines that break every time a form changes.

Marketing and content

Agents create drafts for campaigns, posts and ads, test variants and evaluate results. Nothing is published until it has been approved, because every publication affects the brand.

Software development and IT operations

Coding agents implement clearly described tickets, write tests and document changes. The human remains responsible for review and merge.

Knowledge work

Agents search contracts, manuals and policies and prepare answers with source references. The foundation for this is usually knowledge AI with RAG.

How to select the right candidates from such ideas is covered in the article Identifying AI use cases (in German).

Autonomy levels: how much may the agent decide on its own?

Autonomy is not a switch but a scale. A four-level model has proven useful; you set the level per task, not per agent:

Level	What the agent does	What the human does	Suitable for
1 – Suggest	creates drafts and analyses	decides and executes	new tasks, sensitive topics
2 – Prepare with approval	fully prepares the action	reviews and approves	quotes, customer emails, bookings
3 – Execute with sampling	acts on its own within fixed limits	checks samples and exceptions	internal routine with low potential damage
4 – Autonomous with monitoring	acts on its own, reports anomalies	monitors metrics, steps in on alerts	well-proven, reversible processes

New agents start at level 1 or 2. Only when the error rate has remained consistently low over a defined period does the level go up. Conversely, every level must be reversible immediately.

Approval gates and human-in-the-loop

An approval gate is a fixed point in the process at which the agent stops and a human decides. Gates make sense wherever an action is hard to reverse:

• External communication: emails to customers, publications, ads
• Money movements: orders, payments, credit notes
• Contracts and commitments: quotes, prices, deadlines
• Decisions about people: anything that directly affects applicants, employees or customers
• Changes to production systems: code merges, configurations, deletions

The OWASP project on generative AI security describes this risk as Excessive Agency: too much functionality, too many permissions and too much autonomy. Among the countermeasures it lists are human approval for high-impact actions, minimal permissions for every tool and authorisation checks in the target system rather than in the language model. For me, these three points are the core of any agent architecture.

Equally important is a kill switch: every agent must be able to be stopped immediately without leaving half-finished operations stuck in the system. How to design thresholds, sampling and escalation in detail, and how to stop approvals from becoming a rubber stamp, is covered in Human in the loop: approval gates for AI agents.

The main risks

Wrong actions caused by hallucination. A language model can make plausible but false assumptions. With an agent, that becomes a wrong booking or a wrong email. Remedy: approval gates and grounding in sources.

Prompt injection. An agent that reads emails or web pages may mistake hidden instructions in them for commands. Remedy: treat inputs as data, keep tool permissions minimal, never execute critical actions based solely on external content. More on this in the article Prompt engineering in business (in German).

Error cascades. Small errors in early steps carry through. Anthropic points out that autonomous agents can bring higher costs and compounding errors, and recommends extensive testing in sandboxed environments.

Unclear accountability. If nobody is responsible for the agent, an error is only noticed when it reaches the customer. Every agent needs a human who owns it from a business perspective. How to organise these responsibilities cleanly across many agents is shown in the guide to the AI department with roles and responsibilities.

Cost explosion. Agents call models in loops. Without budget caps and iteration limits, costs rise unnoticed.

What the EU AI Act means for AI agents

The EU AI Act does not regulate "agents" as a category of their own, but AI systems according to their risk. Three points are particularly relevant for agents:

• AI literacy: Under Article 4, providers and deployers must take measures to support the AI literacy of their staff, tailored to prior knowledge and context of use; following the Digital Omnibus Regulation (EU) 2026/1744, they are not required to guarantee a specific level of literacy.
• Transparency: Agents that communicate directly with people, for example by email, chat or phone, must be recognisable as AI unless this is obvious.
• High-risk areas: If an agent decides on job applications or loans, for example, the high-risk obligations apply. These include human oversight under Article 14: humans must be able to override the outputs and safely interrupt the system through a "stop" button or a similar procedure.

Even outside the high-risk area, it is worth adopting these principles. A clean log of who approved what and when is also your best evidence towards customers, auditors and the Betriebsrat (works council). The legal framework is explained in detail in the guide EU AI Act in Germany (in German), the organisational side in the article on AI governance (in German).

Getting started in four steps

Step 1: Choose a task, not a department

Pick a concrete process with high repetition and a clear definition of quality, such as "qualify incoming enquiries and draft a reply". Before you start, measure how long the process takes today and how many errors occur.

Step 2: Define permissions and gates

Decide which systems the agent may read and which it may write to, keeping both to a minimum. Define the approval gates and the starting autonomy level, usually level 1 or 2. Name the responsible human.

Step 3: Test in shadow mode

Run the agent in parallel with the existing process for two to four weeks, without any of its results leaving the company. Compare quality, lead time and cost with the status quo. Only then does it go live.

Step 4: Measure, promote, expand

Log every action and every approval. If quality is consistently good, raise the autonomy level for individual sub-tasks. Only when the first agent holds up in day-to-day operations does the second one follow. How to prove the benefit properly is covered in the article Calculating AI ROI (in German).

From my own products

I have built my own company AI-first since 2021; today it is run roughly 80 % by AI agents. The most important lesson: it is not the intelligence of the model that determines success, but the control framework around it. In the company cockpit I built for this purpose, 51 AI specialists work according to job profiles. Every task has one of four autonomy levels, there is a kill switch, and every action is recorded in an AI Act log. The rule I never relax: an approval gate is always held by a human. At ultimate-marketing.io, that means no ad goes live without traffic-light approval. At anitask, an agent worker implements development tasks on its own, but a human does the review and merge. This separation between "the agent works" and "the human decides" is the reason operations run smoothly.

If you want to introduce AI agents in your company, you will find my approach under AI department. How individual agents become a complete operating model with roles, responsibilities and control is described in the guide The AI department: organising agents in operations.

Frequently asked questions

What is the difference between an AI agent and a chatbot?

A chatbot answers questions in a dialogue. An AI agent pursues a goal, plans the necessary steps itself and uses tools such as a CRM, email or databases to do so. As a result, it can trigger real actions and needs correspondingly stricter controls.

Are AI agents allowed under the EU AI Act?

Yes. The EU AI Act only prohibits certain practices and regulates AI systems according to their risk. For most agents in the back office, sales or marketing, the main obligations are to take measures to promote AI literacy (Art. 4) and the transparency obligations. If an agent makes decisions in high-risk areas such as HR or lending, stricter requirements such as human oversight apply.

Which tasks are suitable for a first AI agent?

The best fit is frequent, multi-step tasks with a clear definition of quality and low damage if something goes wrong, for example qualifying incoming enquiries or pre-checking receipts. Rare special cases and decisions with major consequences for individuals are less suitable.

What is an approval gate?

An approval gate is a fixed point in the process at which the agent stops and a human reviews and decides. It belongs in front of every action that is hard to reverse, such as customer communication, payments, contractual commitments or changes to production systems. This keeps responsibility clearly with the human.

How long does it take to introduce an AI agent?

For a clearly defined process, expect a few weeks: selecting the process and measuring the current state, defining permissions and approvals, two to four weeks of shadow operation and then a gradual go-live. It usually takes longer if data first has to be cleaned up or interfaces have to be built.