An AI agent is a system that uses a language model to decide which steps to take, with tools that let it act in your software: read an email, check the CRM or draft a reply. It follows instructions and a memory of the context. A chatbot only talks; a fixed automation always follows the same path. An agent pays off when the work brings variable text and exceptions, and only with limits and human approval.
What an AI agent is
OpenAI, in its practical guide to building agents, defines them as "systems that independently accomplish tasks on your behalf". The same guide boils them down to three parts: the model, the tools and the instructions. Anthropic, in Building effective agents, adds memory: the basic building block is a language model augmented with retrieval, tools and memory.
Put the two sources together and an agent has four parts:
| Part | What it is | Example in a small business |
|---|---|---|
| Model | The language model that interprets and decides | Claude, GPT or Gemini |
| Tools | Functions or connections (APIs) it uses to read and act | Find a customer in the CRM, create a draft in the mailbox |
| Instructions | Goals, steps and rules it cannot skip | "Never confirm a delivery date without checking the warehouse" |
| Memory | The context it keeps or looks up | The customer's history, your terms of sale, the FAQs |
The key word is "decides". According to the OpenAI guide, an agent uses the model to manage how the work gets done, recognises when it has finished and, if it fails, can stop and hand control back to a person.
Agent, chatbot and fixed automation
People mix these up all the time. The OpenAI guide is clear: applications that use a language model but do not let it control the workflow, such as simple chatbots, are not agents. Anthropic draws a line between workflows, where the model and tools follow predefined code paths, and agents, where the model directs its own steps and its use of tools.
| Chatbot | Fixed automation | AI agent | |
|---|---|---|---|
| What it does | Answers questions | Runs the same steps every time | Chooses the steps case by case |
| Who decides the path | Nobody: it only talks | Whoever programmed it | The model, within its limits |
| Acts in your systems | Usually not | Yes | Yes |
| Predictability | Medium | High | Lower: it needs watching |
| When it fits | Frequent questions | Clear, stable rules | Variable text and exceptions |
In practice many solutions are a mix: a fixed automation that, at one specific step, asks the model to classify or summarise a piece of text. That is usually cheaper and easier to control than a full agent.
When it is worth it and when it is not
The OpenAI guide keeps agents for three situations: complex decisions with exceptions, rules that are already hard to maintain, and processes that depend on unstructured text, such as documents or customer messages. If your case does not fit, the guide says, a deterministic solution may be enough. Anthropic says much the same: find the simplest solution possible and add complexity only when it is needed.
Before you ask for an agent, ask yourself four questions:
- Does the next step depend on what a piece of text says (an email, a PDF, a message)?
- Are there frequent exceptions that a person handles today using judgement?
- Can a mistake be undone, or does it have financial or legal consequences?
- Is there enough volume to justify building it and keeping an eye on it?
If the answer to the first two is "no", what you need is a normal automation. One of ours as an example: Unanswered-mail alerts sends a daily summary of customer emails still waiting for a reply in each Microsoft 365 mailbox. It is not an agent. It follows fixed rules, never moves or deletes an email and only stores the sender, the subject and the date.
Four realistic uses in a small business
1. Sorting incoming email
The agent reads what arrives in the shared inbox, decides whether it is an order, a complaint, an invoice or a query, pulls out the key details and drafts a reply or creates a task for the right person. At first, it should not send anything: it should leave drafts. Watch out for one specific risk: an email can carry hidden instructions aimed at the model. Anthropic calls this indirect prompt injection and gives the body of an incoming email as an example.
2. Pulling data out of documents
Supplier invoices, delivery notes or purchase orders in PDF. The agent extracts the fields (supplier, tax ID, date, net amount, VAT, total) and moves them into a spreadsheet or your ERP. It pays to combine the model with fixed rules that check whatever can be checked, for example that the net amount plus VAT equals the total. And give it permission to say it does not know: according to Anthropic, allowing the model to admit uncertainty reduces false information, although these techniques do not remove it completely. If the documents are scans, you first need text recognition (OCR).
3. Follow-ups
Quotes sent that nobody has answered, orders waiting for confirmation, missing paperwork. The agent checks the CRM, spots what has been sitting still for days and drafts a reminder tailored to each customer. A person reviews it and sends it.
4. First reply to customers
In the chat on your website or by email, the agent replies using your policies and FAQs, and passes the case to a person when it is unsure or when the customer asks for one. The OpenAI guide recommends setting a threshold: if the agent fails to understand the customer after several attempts, it escalates to a person. On top of that, the EU AI Act requires people to know they are talking to an AI (more on that below). If you want to know what something like this costs, we break it down in how much an AI chatbot costs.
The risks
- It gets things wrong and sometimes makes things up. Anthropic admits that even the most advanced models can generate text that is factually incorrect or inconsistent with the context. This is called hallucination. It can be reduced but it does not go away, so every important piece of data needs a check.
- Errors compound. According to Anthropic, the autonomy of agents means higher costs and errors that build up from one step to the next.
- It obeys the wrong people. A document, a website or an email can contain orders aimed at the model. Anthropic recommends treating that content as untrusted data and giving the agent the least access possible, so that a trick that works does as little damage as possible.
- Personal data. The model provider processes data on your behalf. The GDPR (the EU's General Data Protection Regulation) requires you to choose a processor that offers sufficient guarantees and to govern the relationship with a contract (Article 28). If the data leaves the European Economic Area, the transfer conditions in Chapter V apply (Article 44). Check where everything is processed. As of October 2026, Anthropic's direct API only offers global or US-only inference, and OpenAI offers processing in Europe only with certain data retention controls and prior approval.
- Decisions about people. Article 22 of the GDPR gives people the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects, with some exceptions. If an agent is going to decide something about a customer or an employee, put a person in the loop.
The controls that actually work
| Control | What it involves | Source |
|---|---|---|
| Human approval | Sensitive, irreversible or high-impact actions (cancelling orders, issuing refunds, making payments) wait until someone approves them | OpenAI |
| Tools rated by risk | Each tool gets a low, medium or high rating depending on whether it only reads or also writes, whether it can be undone and its financial impact | OpenAI |
| Least privilege | The agent only reaches what it needs, with permissions as narrow as possible | Anthropic |
| Limits on steps and retries | A maximum number of iterations and attempts; past that, it stops and hands the case to a person | Anthropic and OpenAI |
| Logging and review | Record what it read, what it decided and what it did, and review the results regularly | Anthropic |
| Testing before going live | Test in an isolated environment, including with emails and documents that try to trick it | Anthropic and Anthropic |
The tools already support this. In n8n, for example, you can require human approval for a specific agent tool: the workflow pauses until a person approves or denies the action. We cover it in what is n8n and what is it for.
What the EU AI Act asks of an ordinary business
If you use an agent in your business, the AI Act treats you as a "deployer": anyone using an AI system under their own authority (Article 3, point 4). If you develop it, or have it developed, and put it into service under your own name or trademark, you can also be a "provider" (Article 3, point 3). What affects you today:
- Staff training (Article 4). This has applied since 2 February 2025, according to Article 113. Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026, rewrote it: providers and deployers must take measures to support the AI literacy of their staff, with no obligation to guarantee a set level for each person. In practice: whoever uses the agent should know what it does, where it fails and when not to trust it.
- Transparency (Article 50). This has applied since 2 August 2026, the general date in Article 113. A system meant to interact with people must be designed so they know they are talking to an AI, unless it is obvious, and they must be told at the latest at the first interaction. If you publish AI-generated text to inform the public on matters of public interest, you have to say so, unless a person reviews it and takes editorial responsibility.
- High risk. Using AI to recruit staff, for example to filter applications, is listed in Annex III of the regulation. After Regulation 2026/1744, those obligations apply from 2 December 2027. If you are thinking of an agent for this, look at it separately.
How to start small
The OpenAI guide sums it up: start small, validate with real users and grow over time. It also recommends starting with a single agent and measuring before you optimise. A sensible plan:
- Pick one process. Just one, with volume and with an owner. For example, sorting the orders inbox.
- Measure how it works today. How long it takes and how many errors there are. Without that baseline you will not know if it improves.
- Start in read-only mode. The agent reads and suggests; it writes to no system.
- Move on to drafts. It prepares replies or records that a person approves.
- Test with hard cases. Ambiguous emails, badly scanned documents, attempts to trick it.
- Remove approval step by step. Only for low-risk actions and when the logs show it gets them right.
- Review every month. Models change and some are retired: Anthropic warns that requests to a retired model fail.
If you would rather have help, at Quantum Nova, based in Alicante and working across Spain, we design and build agents connected to the tools you already use. We give a fixed price after a free 2 to 5 day assessment: an AI MVP is in our published range of €4,000 to €12,000 ex VAT, a typical automation is up and running in 2 to 4 weeks, and the data is hosted in the EU. See our AI solutions service, or how we apply it for advisory firms and property managers.
Sources
- OpenAI: A practical guide to building agents (PDF)
- Anthropic: Building effective agents
- Anthropic: Reduce hallucinations
- Anthropic: Mitigate jailbreaks and prompt injections
- Anthropic: Data residency
- Anthropic: Model deprecations
- OpenAI: Data controls in the OpenAI platform (Your data)
- n8n: Human-in-the-loop for tools
- Regulation (EU) 2024/1689, the Artificial Intelligence Act (EUR-Lex)
- Regulation (EU) 2026/1744, the digital omnibus on AI (EUR-Lex)
- Regulation (EU) 2016/679, the General Data Protection Regulation (BOE, in Spanish)