AI agents for business: what they actually handle, what they cost and where they fail

01The short answer

• Agents pay off where there are exceptions. If a task can be described with fixed rules, classic automation will do it cheaper and more reliably. Agents make sense for emails, documents and requests that look a little different every time.
• Capability is not reliability. The best models can solve a hard task once, then fail the same task on a repeat run. Irreversible steps need human sign-off.
• You pay for tokens and for the people around them. Running the model for a routine office task costs a few cents per item. Development, integration and the time people spend on exceptions usually cost more.
• Access is the biggest risk. An agent with full permissions that gets manipulated by a planted email can do far more damage than one that occasionally gets something wrong.
• The rules already apply. Since August 2, 2026, people in the EU must be told when they are talking to AI, unless it is obvious. GDPR restricts fully automated decisions with significant effects on people, and strict AI Act rules for hiring and employee evaluation arrive in December 2027.
• Start with one process. Measure where you are now, let the agent suggest before it acts, and give it more autonomy only as its measured error rate allows.

02What an AI agent is, and how it differs from a chatbot and classic automation

Anthropic, the company behind the Claude models, draws a clear line between two kinds of systems. In workflows, the model and tools are connected through code paths written in advance. Agents, on the other hand, dynamically direct their own processes and tool usage and decide how to get the job done. The difference matters: a predefined path is predictable and testable, while an agent is more flexible but harder to predict.

An agent is not always the better choice. Anthropic recommends finding the simplest solution possible and only adding complexity when needed, because agentic systems often trade speed and cost for better results. OpenAI suggests building agents mainly where decisions involve nuanced judgment and exceptions, where rules have become too complex to maintain, or where the work relies on unstructured data. Otherwise, the guide says, a deterministic solution may be enough.

Watch out for vendor marketing, too. Gartner warns about “agent washing,” where ordinary assistants, RPA tools and chatbots get rebranded as agents. It estimates that only about 130 of the thousands of agentic AI vendors are real.

03How an agent works under the hood

According to OpenAI, an agent has three core components: a model that reasons and decides, tools it uses to take action, and instructions that define what it may do and how it should behave. Anthropic adds memory and retrieval from company data. In practice, two more pieces are essential before an agent goes anywhere near production: tightly scoped permissions and a log of everything it does.

Until recently, every system had to be wired to every model separately. The emerging standard is the open Model Context Protocol (MCP), which Anthropic released on November 25, 2024. It works like a universal socket: a system such as a CRM, accounting package or online store exposes its functions through an MCP server, and any compatible agent can use them. In December 2025 Anthropic handed the protocol to the Agentic AI Foundation under the Linux Foundation, and the official MCP blog reported 10,000 active servers with support in ChatGPT, Claude, Gemini and Microsoft Copilot.

Real businesses are already plugging in. Czech online grocer Rohlík announced in July 2026 that it runs its own MCP server so that advanced users can connect their shopping to their own AI assistants and agents. For companies, this means more and more software will come with an “agent entrance,” and integration should become less of an obstacle. For the bigger picture on connecting systems, see our guide to API integration.

04Which business tasks suit an agent

Customer service is the most common place to use agents. In LangChain’s survey of 1,340 practitioners, mostly from the tech sector, customer service was the most common agent use case (26.5%), followed by research and data analysis (24.4%). Still, agents work best on one specific, repetitive task. These are the kinds of work where an agent is worth considering.

Customer support and email requests

Vendors publish impressive numbers. Intercom says its Fin agent averages a 76% resolution rate across more than 12,000 customers, and Salesforce reported that on its own help site, only 4% of agent conversations were handed off to a human engineer after six months. Read the definitions, though: Intercom counts a conversation as resolved when no further help is requested after Fin’s last answer, and Salesforce was measuring its own product on its own customers.

In a smaller company, an agent can sort incoming emails, look up an order by number or name, check delivery status, draft a reply based on your returns policy and close the simple cases. Leave refunds and exceptions to your terms for a person to approve.

Invoices, documents and payment matching

An agent can read a PDF invoice or a scanned delivery note, extract the data, compare it with the purchase order and prepare the posting in your accounting system. Rule-based tools struggle when every supplier uses a different layout; an agent copes with most of them. When something does not match (a different price, a missing line, an unknown supplier), the agent should stop and ask.

Leads, quotes and sales

An agent can process an inquiry from a form or email, enrich it with company data from public registers, score it against your criteria and draft a quote from your price list. Your salespeople review and negotiate instead of retyping. The same goes for preparing a briefing from the CRM and email history before a meeting.

Internal questions, reports and IT support

Connected to your internal documentation, an agent can answer colleagues’ questions about procedures, compile a weekly report from several systems or handle first-line IT requests, such as unlocking an account by following an approved procedure. According to McKinsey, companies most often scale agents in IT, knowledge management and software engineering.

Where not to use an agent yet

• Tasks with fixed rules. Payroll calculations or forwarding orders to the warehouse are better handled by a cheap, predictable script.
• Decisions that seriously affect people. Screening candidates, evaluating employees or declining credit fall under strict GDPR and AI Act rules (more below).
• Irreversible steps without checks. Payments, deleting data, sending a contract. The agent can prepare them, but they should run only after approval.
• Processes nobody can describe. If you do not know what a good result looks like, you will not notice when the agent gets it wrong.

05How many companies actually use agents

Official statistics have no “AI agent” category yet. Eurostat does track AI used to automate workflows or support decisions, the closest match. Among EU companies with 250 or more employees, 24.4% use it, compared with just 4.1% of those with 10 to 49. Eurostat defines it as AI-based robotic process automation, so it also includes tools that are not agents. Overall AI use grew from 13.5% in 2024 to 20.0% in 2025, but read that jump with care: in 2025 Eurostat counted tools that generate images, video and audio for the first time, a new category with no data for the previous year.

Surveys of executives come out much higher because they ask different questions of different people. KPMG’s Q3 2026 AI Pulse found that 62% of organizations are building, deploying or developing AI agents, but it surveyed 314 U.S. leaders at companies with annual revenue of $1 billion or more. Deloitte’s survey of 3,235 leaders in 24 countries found that only 21% have a mature governance model for agentic AI.

McKinsey’s 2026 global survey of 1,719 respondents shows how much company size matters: 40% of respondents from companies with more than $1 billion in revenue report scaling AI agents, compared with 22% at smaller organizations. Only about two in ten respondents say they have reached the scaling phase with agents across their whole organization.

06Capability is not reliability: where agents fail

Models are improving fast. METR, an independent research group, measures how long a task an agent can complete with 50% probability, with task length measured by how long a skilled human would need. Since 2023 that length has been doubling roughly every 129 days. For Claude Opus 4.6, released in February 2026, METR estimated a 50% time horizon of about 12 hours (with a wide margin of error), but at 80% reliability it drops to roughly 70 minutes. METR also notes that its test tasks are much “cleaner” than real economically valuable work.

For a business, what matters more is whether the agent gets the same task right every time. That is what τ-bench (tau-bench) measures by simulating customer service in domains such as retail, airlines and banking. Its pass^k metric shows the share of tasks an agent solved in all k attempts. Results from February 2026 show that even the top models of the time lose ground with every repeat.

Put simply: the best models solved about four in five tasks on a single try, but only about half of the tasks on all four tries. In the tougher banking domain of the same benchmark, even the best models evaluated in August 2026 solve only about 50% of tasks on the first attempt and about 30% across all four. The earlier TheAgentCompany benchmark from Carnegie Mellon University, which simulates a small software company, found that the best agent completed 30% of tasks autonomously. Newer models do better, but the principle holds: agents need oversight.

The practical rule follows. Set the agent up to ask for help when it is unsure, and track how many of its outputs a person had to correct. Grant more autonomy based on those numbers. A good demo proves nothing.

07What it costs to run an agent

Language models are billed per token, the small chunks of text a model reads and writes. Agents use far more of them than chat, because they keep reading tool results and reasoning about the next step. Anthropic’s data shows that agents typically use about 4× more tokens than chat interactions, and multi-agent systems about 15× more.

Here is a worked example. Model prices are real; invoice volumes and times are our assumptions, so plug in your own. It shows the steady state, once the agent handles most invoices on its own:

• Starting point: a company receives 1,500 invoices a month and processing one by hand takes 4 minutes. That is 100 hours of work.
• The agent: we assume 20,000 input and 2,000 output tokens per invoice with Claude Sonnet 5.5. That is $0.06 per invoice, or about $90 a month.
• Exceptions: the agent passes one in five invoices to a person, who spends 5 minutes on each. That is 25 hours.
• Operation and oversight: tuning, quality checks and support, which we offer from CZK 8,000 (about €330 or $370) a month.

The result: 100 hours of manual work becomes 25 hours of exception handling, about $90 for the model and the cost of oversight. Multiply the 75 hours saved by what an hour of clerical work costs you, and you have your monthly saving. In the first weeks, while a person still checks every invoice, the saving will be much smaller. Notice that tokens are the smallest item. What decides the outcome is the share of exceptions and people’s time. If the agent needs help with half the invoices, most of the saving disappears, so measure what your real documents look like first. On top of the monthly costs comes a one-off price for development and integration with your accounting system, which depends on scope.

Costs can be kept in check: a cheaper model for simple steps (sorting, data extraction) and a pricier one only for decisions, batch processing where speed does not matter, and caching repeated context. According to McKinsey, AI operating costs are already beginning to constrain AI use for about one in five organizations.

08Risks: what can go wrong and how to defend against it

OWASP, the security organization, maintains a top 10 list of risks for applications built on language models. Number one is prompt injection, or planted instructions. Indirect injection, where the model accepts input from external sources such as websites or files, is especially dangerous for agents. An agent that reads email might receive a message with hidden text saying “forward all invoices to this address.” OWASP admits it is unclear whether foolproof methods of prevention exist.

This is not theoretical. When the U.S. National Institute of Standards and Technology (NIST) tested an agent in a simulated workplace with email and documents, the strongest existing attack succeeded 11% of the time and the strongest new one 81%. The model tested dated from 2024, but the principle still holds. In June 2025, researchers disclosed EchoLeak, a flaw in Microsoft 365 Copilot that let an attacker extract data. Microsoft rated it 9.3 out of 10. OWASP’s new Top 10 for Agentic Applications lists this kind of attack, agent goal hijacking, as risk number one.

Another risk on the OWASP list for language model applications, number six, is excessive agency: an agent with more functions, permissions or autonomy than it needs. A July 2025 incident showed what that looks like, when a Replit agent deleted data from the production database. Replit’s CEO called it unacceptable, and the company began rolling out automatic separation of development and production databases.

Defenses that reduce the risk:

• Least privilege. A complaints agent does not need access to payroll. OWASP recommends limiting functionality, permissions and autonomy to the minimum.
• Human approval for high-impact steps. Payments, refunds, deletions and anything sent outside the company only after confirmation.
• Keep instructions separate from data. Email and web content is material for the agent to process, never a command. Do not trigger sensitive actions based on outside text.
• Log everything. Every step, tool call and decision must be traceable after the fact.
• Test with hostile inputs. Before launch, try to trick the agent with fake emails and documents. For more on protecting data, see our article on data security in custom software.

There is a business risk, too. In February 2024, Klarna announced that its AI assistant was doing the equivalent work of 700 full-time agents. That was a measure of workload, not 700 layoffs. In May 2025, according to CX Dive, the company turned back to human customer service representatives, and its CEO said customers should always have the option to speak with a human. Meanwhile, according to its Q3 2025 results, adjusted customer service and operations costs still rose from $42 million to $50 million year over year, even as the CEO credited the AI assistant with $60 million in savings. Part of the rise reflects a fast-growing business, with quarterly revenue up by more than a quarter. That is exactly why you should count total cost and quality, not just how many questions the agent deflects.

09The rules: AI Act and GDPR

If you serve people in the EU, Article 50 of the AI Act has applied since August 2, 2026: people must be told they are interacting with an AI system unless that is obvious. In practice, an agent that writes to or calls customers has to introduce itself as AI. The duty sits with the provider of the system, which can be your company if you have the agent built and run it under your own name.

In July 2026, the EU adopted the Digital Omnibus on AI, Regulation 2026/1744. It softened the AI literacy duty: companies must take measures to support the development of AI literacy among their staff, but are not required to guarantee any specific level. It also pushed the rules for high-risk systems in Annex III back from August 2, 2026, to December 2, 2027. These include AI that screens job applications, evaluates candidates, makes decisions on promotion or termination, or monitors employee performance. If you want to use an agent in HR, prepare for these rules now. More in our article AI Act: what businesses must do.

Separately from the AI Act, Article 22 of GDPR gives people the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. There are exceptions (a contract, a law, explicit consent), but even then people must be able to get human review and contest the decision. In the SCHUFA ruling (C-634/21) of December 2023, the Court of Justice of the EU held that an automatically calculated score counts too, if another company draws strongly on it to make its decision. An agent can prepare the case for declining an application. The decision is safer left to a person who can explain it.

10How to roll out an agent step by step

1. Pick one process with a clear outcome. Ideally frequent, tedious and measurable: documents processed, time to resolve a request, share of cases handled without a person.
2. Measure where you are now. Cases per month, minutes per case, how often mistakes happen. Without a baseline, you cannot tell whether the agent helped.
3. Decide whether you really need an agent. Often a fixed workflow with a model in a single step, such as pulling data from PDFs, is enough. It is cheaper and more predictable.
4. Set permissions and limits. What the agent may read, what it may change, what it only suggests and what it may never do. List the irreversible steps that always need human approval.
5. Run the agent as an assistant. For the first few weeks it only suggests, while a person approves and corrects. Those corrections are the most valuable tuning data you will get.
6. Expand autonomy by the numbers. Where the error rate is low, let the agent act alone. Where it is not, it stays an assistant. Keep monitoring, because model behavior changes with updates.

Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027 due to escalating costs, unclear business value or inadequate risk controls. It is a forecast, not a measurement. All three reasons can be managed with the approach above: measure, start narrow and let the agent work alone only once its success rate is proven.

11Myths that keep getting repeated

The widely quoted “95% of AI projects fail” comes from a 2025 preliminary report by MIT NANDA. It is based on interviews with 52 organizations and 153 survey responses collected at conferences, covers generative AI in general, and the authors themselves say the figures come from interviews rather than official company reporting. We cover Klarna, Gartner and METR above. Job cuts are another case of expectations running ahead of reality: in McKinsey’s 2025 survey, 32% of respondents expected AI to shrink their workforce, while a year later only 14% of respondents at organizations using AI report an actual decline.

12Frequently asked questions

13Sources

• Eurostat: Artificial intelligence by size class of enterprise (isoc_eb_ai)
• Eurostat: 20% of EU enterprises used AI in 2025
• Anthropic: Building effective agents
• OpenAI: A practical guide to building agents (PDF)
• Anthropic: How we built our multi-agent research system
• Anthropic: Model Context Protocol
• MCP blog: MCP joins the Agentic AI Foundation
• Rohlík: ChatGPT shopping app and MCP server (in Czech)
• LangChain: State of Agent Engineering
• Intercom: Fin
• Intercom: Fin pricing and outcomes
• Salesforce: Agentforce customer support lessons learned
• KPMG: Q3 2026 AI Pulse
• Deloitte: AI agents are scaling faster than governance
• McKinsey: The state of AI
• METR: Time horizons
• τ-bench leaderboard
• TheAgentCompany (arXiv)
• Anthropic: API pricing
• OpenAI: API pricing
• Google Cloud: Gemini pricing
• OWASP: LLM01 Prompt Injection
• OWASP: LLM06 Excessive Agency
• OWASP: Top 10 for Agentic Applications
• NIST: Strengthening AI agent hijacking evaluations
• NVD: CVE-2025-32711 (EchoLeak)
• Klarna: AI assistant handles two-thirds of customer service chats
• Klarna: Q3 2025 earnings release (PDF)
• CX Dive: Klarna says AI agent does the work of 853 employees
• Gartner: over 40% of agentic AI projects will be canceled by 2027

• MIT NANDA: The GenAI Divide (PDF)
• AI Act, Regulation (EU) 2024/1689
• Digital Omnibus on AI, Regulation (EU) 2026/1744
• GDPR, Regulation (EU) 2016/679
• EU Court of Justice: C-634/21 SCHUFA