For a long time, AI systems mainly answered questions. Today they increasingly take on entire work packages. That is the step from chatbot to AI agents. For small and medium-sized enterprises it opens up major opportunities. But it also brings risks you should know about.
This article is aimed at decision-makers and technically interested readers. The key message: AI agents can take over a considerable amount of routine work. That only works in the long run with clear limits, verified results and human responsibility.
What is an AI agent?
A chatbot answers a question and returns text. An agent pursues a goal. It breaks the task down into steps, uses tools and checks whether it worked. If not, it corrects the plan and tries again.
This becomes particularly clear in software development. There are agents that work in the terminal or in the development environment. They read existing code, write new code, run tests and read the error messages. Then they make improvements.
A whole software company made of roles
It gets interesting when several agents work together. A higher-level agent, the orchestrator, plans the work. It assigns tasks to specialized sub-agents and merges their results.
In doing so, you can recreate the roles of a software company:
- Requirements and architecture define what is built and how.
- Database, backend and frontend implement it.
- Testing, security review and code review check the results.
- Documentation and release complete the work.
Each role has a clearly defined area of responsibility. A reviewer does not write code but evaluates it. This is a proven idea from the human division of labor, applied here to agents.
What AI agents can do today
Such teams can work on tasks independently for hours. You give them a time budget. They work step by step, partly in parallel on separate files. That is the state of the art today, and it is improving quickly. For every interim stage, they record what has been done and what remains open.
Questions go to a human only for important decisions, such as security issues, costs or a change of scope. The agents decide everything else themselves and log it with a justification. At the end there is a handover report: What was done, what is open, how do we proceed?
For companies, this can change a lot:
- Prototypes and internal tools are created in a short time.
- Tests and documentation, often neglected, are created along the way.
- Experts are relieved of routine work and have more time for decisions.
- Work continues even when nobody is sitting at the screen.
A sober assessment is important: how much time a team actually saves depends on the task, the quality of the specifications and the review. Blanket figures should therefore be read with caution. We deliberately do not give any here.
An everyday example
Imagine your business department needs a small tool for analyzing order data. In the past, that meant gathering requirements, obtaining a quote and waiting for weeks. With an agent team, the process looks different. A human describes the goal. The agent clarifies open points, designs a solution, builds it and tests it. At the end, there is code, tests and a description.
That does not mean the tool is finished. A human checks it and tries it out. The gain: the first version is available sooner, and the experts concentrate on evaluation and decisions.
Taking the risks of AI agents seriously
Agents are not infallible employees. Their strength is also their risk, because they really act.
Errors stated with confidence
Language models can phrase false statements very convincingly. An agent may overlook an error or claim something that was never tested. Anyone who adopts results without checking them also adopts the errors.
Excessive permissions and loss of control
The more an agent is allowed to do, the greater the potential damage. The OWASP project, which collects security risks of AI applications, lists this problem in the same list under the heading “Excessive Agency”: the agent is given more autonomy, permissions or system access than necessary.
Prompt injection
Agents read texts: websites, emails, documents. These can contain hidden instructions that the agent takes for genuine tasks. Prompt injection ranks first in the OWASP Top 10 for LLM Applications 2025. The more permissions the agent has, the more dangerous such an attack becomes.
Data protection and secrets
What the agent reads may reach the provider of the model. Personal data falls under the GDPR. Credentials, keys and confidential project details do not belong within its reach. Before deployment, you should clarify where data is processed and what the contract says.
Costs, dependency, skills and liability
Long agent runs consume computing power, and that costs money. Without a budget limit, this can get out of hand. Anyone who relies entirely on one provider becomes dependent on its prices and terms. There is also a risk of gradual loss of skills if nobody on the team understands what the agent is doing anymore. And responsibility remains with the company: errors cannot be delegated to the AI.
The legal framework
The EU AI Act applies in stages. According to the European Commission (page as of August 3, 2026), the bans on certain practices have been in effect since February 2025 and the rules for general-purpose AI models since August 2025. According to the Commission, the transparency rules apply from August 2026. The high-risk obligations were postponed by the AI omnibus package, to December 2027 for use cases under Annex III and to August 2028 for AI in regulated products (Annex I).
Whether a specific agent use case falls under this depends on how it is used. An agent that writes code is something different from a system that evaluates job applications. Have your case checked by experts. This article is not legal advice.
Levels of autonomy
You do not have to start with full autonomy. A step-by-step approach makes sense. First, the agent only makes suggestions. Then it makes changes after approval. Later, it works independently within fixed limits. Only at the end do several agents run for long periods.
At each level there is a fixed point at which a human steps in. Anyone who only moves to the next level after good experiences stays in control. System1 models such as Jev should be taken into account accordingly.
Safeguards that have proven effective
The good news: the most important risks can be reduced significantly with well-known means.
- Minimal permissions: the agent only gets what the task requires.
- Human approval for anything that cannot be undone, such as deleting, publishing or paying.
- Separate workspaces: the agent works on a copy so that changes never land directly in the original.
- Tests and reviews, ideally by separate, independent roles and by humans.
- Logging of all steps so that it is possible to trace later what happened.
- Drafts only instead of direct publication: the agent prepares, the human approves.
- Keep secrets away: credentials and personal data are outside its reach.
- Set limits: time and cost budgets that the agent cannot exceed.
These measures are nothing specific to AI. They correspond to what you do with new employees: grant access step by step, review their work, make important decisions together. The difference is speed. An agent can cause a lot of damage in minutes if nothing slows it down. That is why the limits should be enforced technically and not just written in an instruction.
How to get started
- Choose a low-risk task, for example internal documentation or test cases.
- Define which data is off-limits and keep it away from the agent.
- Decide who checks and approves results.
- Evaluate after the first runs: What went well, where were there errors, what did it cost?
- Only then expand permissions and scope.
Conclusion
AI agents are more than a better chatbot. They plan, act, check and work as a team. This opens up new possibilities for SMEs, especially for routine work, tests and documentation. It takes discipline: tight permissions, clear approvals, clean logs and a watchful eye on data protection and costs.
Start small and expand autonomy step by step. That way you seize the opportunities without giving up control.
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
