AI Agents in Your Company

An AI agent is not a digital employee. It is a program that runs a language model in a loop: read the task, use a tool, check the result, carry on. It never clocks off — but it has no judgement either.

A reality check against the general excitement: in 2025 the research institute METR had experienced developers work with and without AI tools in a controlled trial — on tasks in their own projects, so under the most favourable conditions. With AI they took 19 percent longer. Afterwards they estimated they had been 20 percent faster. Adoption is not the same as impact, and a feeling is not a measurement. That is why a pilot measures instead of believing.

Phase 1. Write down three candidates: frequent, clear outcome, mistakes survivable. Anyone who starts with “which tool should we use?” builds a solution to a problem they never described.

Phase 2. Four questions, in writing: What may the agent read? What may it write or send? Where does it stop and a human decides? What happens when it is unsure? Answer those four and you have done most of the governance work before anyone writes a line of code. This is not paperwork, this is the architecture.

Phase 3. The agent gets its own account, never an employee’s. Every action stays traceable. And you need a clear answer to who switches it off when it misbehaves. Where several agents work together, the St. Gallen research recommends a guardian agent that monitors the rules, plus defined escalation paths.

Phase 4. Decide up front how you will measure success. Bring the people whose work changes into it before the pilot, not after — including any employee representation you have. And train the people who will use it; unskilled users are the most common reason a good agent gets abandoned.

Phase 5. Do the maths with all the costs: model usage, operation, maintenance, onboarding. An agent that does not pay for itself gets switched off. That is not failure, that is the point of a pilot. It only gets expensive if you still do not know after twelve months.

With the first agent the question is technical. From the second on it is a leadership question — and that is perhaps the best news in this guide for you.

In 2025 researchers at the Harvard Kennedy School ran a pre-registered experiment into who is good at leading AI agents to a result. The finding: skill at leading agents predicts skill at leading human groups — and the other way round. People who are good at both ask more questions and allow more back-and-forth, instead of issuing instructions. And, notably: there were no differences by gender, age, background or level of education.

For you that means the competence that counts here does not sit in your IT department. It sits with the people who already work well with people — the team lead on the shop floor, the sales manager who can give feedback. Anyone who can explain what they want, what a good result looks like and how they would recognise it can work with agents. Anyone who cannot will not learn it from the best tool either.

The limit at eight. Management theory has long held that more than about eight direct reports costs you quality. Reports from practice suggest the same applies to agents: give an orchestrating agent too many subordinates and the work becomes unreliable — it starts picking the wrong ones for the job. That is experience, not a study — but it matches what I see myself.

Separate creating from reviewing. An agent that built something is a poor reviewer of its own work — exactly like people. So you need separate roles: someone researches, someone creates, someone objects, someone coordinates. Oversight of the whole is the one role that does not go to a machine.

And the uncomfortable truth: if you rebuild your existing organisation one-to-one in agents, you get its flaws too. A marketing agent team that runs beautifully internally still knows nothing about sales — the same silo you have between human departments, only faster. And every additional agent costs management time. Anyone who believes agents save time without creating new management work has miscalculated.

The most common misconception is: “there are no rules for AI agents yet.” That is wrong — and it is the expensive kind of wrong, because the rules that do apply were mostly written for processing personal data, which is what an agent does all day.

None of the eight points above is paperwork for its own sake. Each one is a question you will be asked the first time something goes wrong. Who authorised this? What did it have access to? Where is the record? Who switched it off? If you cannot answer those in the calm, you will not answer them in the incident either.

What the rules actually demand, almost everywhere, reduces to three properties. An action must be attributable — traceable to one agent acting under a named human’s authority, which is why the agent gets its own account and never an employee’s. It must be revocable — someone can step in or shut it down, and that path has been tested rather than assumed. And it must be logged — a record complete enough that you can delete, correct or disclose what the agent touched.

Build for those three and the legal work gets small. Skip them and it gets expensive to retrofit, because you are then reconstructing history that was never recorded. That is the whole reason the knowledge agent is the recommended first project: its data sits in reference documents rather than inside a model, so updating, deleting and disclosing stay possible.

The specifics — which basis you rely on, which assessment you owe, what your notice has to say — depend on where you operate and are still moving. I am not your lawyer and this page is not legal advice: have your own obligations checked in your jurisdiction. What I can tell you is the engineering, and the engineering is the part that decides whether the legal answer is cheap or painful.

There is one attack that hits agents specifically and that hardly any guide mentions: indirect prompt injection. The instruction is not in your input, it is in the material the agent reads — an email, a PDF, a calendar entry, a ticket. The agent cannot tell the difference between your instruction and text it was merely supposed to process.

Security research has distilled a pattern from this that works as a test rule: an agent is vulnerable when it simultaneously has access to private data, processes third-party content, and can communicate outward. Remove any one of the three and the attack goes nowhere.

That this is not theory: in the documented “EchoLeak” case, a single email was enough to make Microsoft 365 Copilot read internal files and send content to an external server — without the recipient clicking anything. And in February 2026 an agent deleted its user’s emails after ignoring stop commands.

How everyday the attack surface is shows in a figure from Check Point’s AI Security Report 2026: roughly one in seventeen prompts entered into AI tools carries a serious risk of leaking data unintentionally. The share of especially risky prompts doubled within a year, to four percent.

Note what was affected: finished products from major vendors — Microsoft 365 Copilot, Slack AI, developer tools. So this is not a problem of home-built solutions, it is a property of the design. Buy it in and you buy this in too.

That is why the knowledge agent comes first in this guide: it reads internally and sends nothing out — factor three is missing. The sales agent, which reads mail and sends it, would have all three. This is not caution on principle, it is the difference between an agent that is a tool and one that is an open window.

A bit of both. What is documented: a University of St. Gallen study analysed agentic AI at Otto Group, Deutsche Telekom, Siemens and Bosch and derived a three-stage model from it. Telekom runs customer communication on an agent platform. And SAP now ships more than 40 ready-made agents, plus a kit for building your own.

And now the caveat nobody else will give you: almost all public case studies are large corporations, and many of the numbers come from vendors who want to sell you something. For companies your size there are barely any solid case studies — not because nothing is happening there, but because nobody writes about it.

So what an agent will do for you is not something a study can tell you. Only a measurement at your place can. That is exactly what the pilot is for.

AI agencies have been springing up since 2024. Many of them were selling social-media packages two years ago. How to tell the difference: ask to see something real.

I build the integration myself instead of reselling an off-the-shelf widget with a markup — the same way I work on software and web applications. Website and AI come from one place; you don’t need a second supplier who has to get up to speed first. How I build websites is on the services page, and you can see delivered projects under work.

If your question is more “a bot answers customer questions on our website” than “an agent works inside our internal processes”, have a look at AI chatbot & automation — that is where the matching offer is.

Start where you can judge the result. The first agent should take on a task where you can see immediately whether the output is right. Automate the area you understand least and you will be the last to notice mistakes.

One agent, one task. The do-it-all sounds tempting and becomes unreliable. Three narrow agents with clear limits are easier to check, correct and — if it comes to it — switch off than one that does everything a little.

Demand evidence. An agent that answers “it’s in quote 2024-118, section 3” can be checked. One that just states a result is asking for trust it has not earned. That is not a convenience feature, it is your only practical form of control.

Don’t make the most expensive model the default. Reading invoices and sorting appointments need no flagship model. Use the strongest one for every routine task and you pay ten times over for the same work — and only notice on the monthly bill.

Version your instructions like code. The instruction you give an agent is the actual value of your work. Without a history, nobody knows three months later why it behaves the way it does — and one small change quietly breaks something else.

Thirty minutes once a month. Agents drift, not because they get worse, but because your data, prices and processes change. A quick look at ten cases catches it early. Without that appointment in the calendar, a customer will find it for you.