AI agent

What it means

An AI agent is software built on a large language model that is given a goal and works out for itself which steps to take. Unlike a chatbot, which only answers questions, an agent can use tools: search documents, call another system’s API, fill in a form, send an email or run a calculation.

It differs from classic automation such as RPA in that it does not follow a fixed script. When it meets something unexpected, such as missing data on an invoice, it can change its plan, look the information up elsewhere or ask a person. That is both its strength and its risk.

An agent is only as reliable as its tools, data and permissions. It can make mistakes just like the generative AI it runs on, with the difference that its mistake is not merely a wrong answer but an action taken, such as an email sent or a record changed.

How it works in practice

In accounting and administration agents are used for tasks with a clear input and a checkable output: extracting data from incoming invoices, pre-coding documents, matching payments, preparing VAT inputs or answering routine client questions. A person always checks the result before it is posted or sent.

When deploying one we recommend starting narrow: one task, limited permissions and every step recorded in an audit log. An agent that reads invoices need not be able to send payments. Under the least-privilege principle of access control it gets only what its task really requires.

Before deployment, clarify where the data goes. If the agent processes personal data of employees or clients, the AI provider is a processor under the GDPR and you need a contract with it. Some uses, such as selecting staff, also bring obligations under the AI Act.

What to watch out for

The biggest risk is letting an agent take an irreversible step without approval, such as sending a payment or deleting records. Even with high accuracy, across hundreds of operations an error will eventually occur, and if nobody catches it the fix costs more than the automation saved.

The second risk is planted content. An agent that reads emails or documents may encounter hidden instructions that manipulate it, for example to change a supplier’s bank account. Changes to master data and payments should therefore always be verified by a person through another channel, as with BEC fraud.