AI agents for business are software systems that use a large language model (LLM) to reason through a goal and then act on it, using the tools and data sources you give them access to. A chatbot answers questions. An agent does things in your systems, which is the whole difference and potentially the whole problem.
Most owners meet their first AI agent in a demonstration. Somebody shows you software that reads an incoming email, finds the customer in your system, drafts a reply and books the job, in less time than it takes to explain what it just did. It is impressive, and it is meant to be. The question that turns up a few minutes later, usually once the laptop is closed, is the one this article is about: what else can it reach, and who is answerable if it gets something wrong?
Most Australian small businesses have not reached this point. The National AI Centre’s SME AI Pulse, a monthly survey of at least 400 small and medium business decision-makers run by Fifth Quadrant, put overall AI adoption at 44% in February 2026 and reported that agentic AI in particular remains largely untapped. Around 65% of businesses not using AI said they distrust AI decision-making or prefer to keep people in control (National AI Centre, May 2026).
That is a reasonable position, and we wouldn’t argue with that. But, if you’re thinking about AI in your business, this article covers what an agent is, where to use it, what it needs access to, and who is responsible when it gets something wrong. If you are still working out where AI fits at all, you could start with our guide to AI for small business.
An AI agent is software that is given a goal, works out the steps needed to reach it, and carries out those steps using tools it has been connected to. A chatbot is built to answer questions inside a conversation. An agent acts beyond the conversation.
Three things make up an agent, and together they explain how AI agents work in practice. It uses a large language model as its reasoning engine, which is the part that interprets your special requests and decides what to do next. It has tool access, meaning permission to read from and write to real systems such as your inbox, your CRM or your accounting file. And it works across multi-step tasks rather than a single exchange, keeping track of what it has already done.
The practical consequence is that an agent can be wrong in ways a chatbot cannot. A chatbot that answers badly has given someone bad information. An agent that reasons badly has already sent the email, issued the credit or updated the record.
|
Chatbot |
Automation rule |
AI assistant |
AI agent |
|
|
What it does |
Answer questions in a conversation |
Runs fixed steps you defined |
Helps you inside an app you are already using |
Pursues a goal across several steps |
|
Acts on its own |
No |
Only the steps you wrote |
Only when you ask, in front of you |
Yes, within limits you set |
|
What it needs |
A knowledge base answer |
A connection between two systems |
Access to your files and mail |
Access to every system in the task |
|
Best for |
Common questions with settled answers |
Predictable, repeatable transfers |
Drafting, summarising, finding things |
Work where the exceptions are the job |
The difference is who decides the order. A rules-based automation does what you told it, in the sequence you told it, and stops when it meets something you did not anticipate. An agent works out the sequence itself and attempts the thing you did not anticipate.
That is why agents are pitched at complex workflows rather than tidy ones, and the flexibility is the benefit and the risk in a single feature. When a rule breaks, it breaks visibly and somebody gets an error. When an agent handles an edge case badly, it usually looks like it worked, and you find out from the customer.
So the test is not which is more advanced, but whether your exceptions are listable. If you can write down every step and every exception in advance, you want automation, which is cheaper and easier to check. Our guide to AI automation for small business covers choosing a process and deciding which steps a person keeps. Agents earn their keep on the work where the exceptions are the job.
Vendors sort agents by function: customer service agents, sales agents, research agents. That tells you what the agent is pointed at, not how much it decides alone, and the second question is the one that changes your exposure. A more useful way to read the types of AI agents on the market is by how far each one goes before it asks.
| Rung |
What the agent does |
What a person still does |
Where it suits a small business |
|
1. Suggests
|
Proposes an approach or finds information | Everything else | Almost any task, including sensitive ones |
|
2. Drafts |
Produces the reply, quote or document | Reads it, changes it, sends it | The sensible default for a first agent |
|
3. Acts with approval |
Proposes a specific action and waits | Says yes or no, in seconds | Repetitive actions with a clear right answer |
|
4. Acts alone |
Completes the task and reports afterwards | Reviews a sample later | Low stakes, reversible, well understood work |
The National AI Centre makes the same point in its practice on maintaining human control: oversight should be proportionate to how much autonomy a system has and how high the stakes are (Guidance for AI adoption: foundations). Its risk practice also asks organisations to treat agentic systems differently from ordinary AI models, because the risk comes from what the system does, not only from what it says. Start at rung two and stay there until you have evidence to move.
Agents can handle work that is varied, text-heavy and bounded by rules somebody could explain out loud. The three scenarios below are illustrative rather than customer examples, and each names the rung it belongs on.
One example from our own operations rather than an illustration. We run an agent that produces our weekly performance figures from two systems never designed to talk to each other, our ticketing system and our phone system. It reports how quickly calls are answered, which missed calls were never returned, and which calls never became a ticket. Assembling that by hand took so long that we set it aside as too hard. It now arrives weekly for a few dollars in running costs. The pattern matters more than the systems: two sources that don’t talk, a report nobody had time to build, and nothing that goes to a customer.
Qualifying inbound leads is the use most vendors lead with. It suits agents well, because the criteria can be written down, but it is also where a mistake reaches a customer fastest and where sales teams are least likely to notice a confident wrong answer. The same caution applies to customer support queues, where the agent sees every ticket and nobody sees every reply. Start both at rung two.
Where an agent is usually the wrong tool: stable, high-volume work with no exceptions, which an ordinary automation does more cheaply and more predictably; any task where nobody has time to check the output, because an unchecked agent is an unsupervised one; and anything involving customer data where the vendor will not tell you plainly where processing happens.
An agent is only as useful as the systems it can reach, which is also what makes it harder to govern than a chatbot. Connecting it to your mail, your CRM and your file store is the point. Those credentials then exist whether or not anyone is thinking about them.
Australia’s lead cyber agency has published guidance on exactly this. Careful adoption of agentic AI services, led by the Australian Signals Directorate’s Australian Cyber Security Centre with the United States, Canadian, New Zealand and United Kingdom cyber agencies, groups the risks into five areas: privilege, design and configuration, behaviour, structural and accountability (ASD’s ACSC). Most of it is written for larger organisations. Five points translate directly.
For most Australian small businesses the agent will be connected to Microsoft 365, which is where the access control work actually happens rather than in the agent’s own settings. If that tenancy has grown without much tidying, that is the job to do first. Our managed Microsoft 365 page covers what that involves. Staff also need to know what they can and cannot paste into these tools, which is ordinary security awareness training rather than anything specific to agents.
Answer these six before the agent goes live. None of them is technical. If you cannot answer one, that gap is the thing to fix first. This is general guidance rather than legal advice, and the split below depends on the agreements you actually sign, because AI vendor terms and IT service agreements vary considerably.
1. What can the agent reach? List the accounts, systems and files, not the tool names. The answer is usually broader than expected, because access is granted once and rarely narrowed.
2. Where does the data go? The OAIC’s guidance on commercially available AI products says entering personal information into an AI system can be a use or disclosure under the Australian Privacy Principles, and recommends not entering personal information, and particularly sensitive information, into publicly available generative AI tools. Two questions settle most of this with a vendor: is our data used to train anyone’s model, answered in writing rather than as a setting somebody can toggle, and where is it physically stored. If processing happens overseas, cross-border disclosure obligations apply (OAIC).
3. Who checks the output before it reaches a customer? Name the person, not the team. Checking outputs before they affect customers is the most common safeguard among Australian small and medium businesses using AI, and about half of them do it (National AI Centre, May 2026). It is also the first thing to lapse once the agent looks reliable.
4. Who carries an error? Wrong advice to a customer, a wrong payment, an exposed record. The National AI Centre’s guidance asks for a named person accountable for each AI system and clear responsibilities across the supply chain, including vendors and integrators. From 10 December 2026, Australian Privacy Principles 1.7 to 1.9 will also require a privacy policy to disclose where personal information is used in a computer program making decisions that could significantly affect someone, which an agent can easily be doing.
5. Who removes access, and when? When a staff member leaves, when you change tools, when the agent is retired. The same guidance asks for alternative pathways so the work continues if an AI system is withdrawn, which is worth settling while you still like the vendor.
6. Who watches it after launch? Agent behaviour changes as the underlying AI models are updated beneath it, without anyone on your side doing anything. The OAIC puts this plainly: due diligence is not set and forget. Ask as well whether you could reconstruct what the agent looked at, and when, months later. That is an audit question and a good one to put to a vendor.
Read down the first column. The business owns all six, whatever anyone sells you. A vendor and an IT provider can help with four of them: the vendor supplies the connectors and discloses where data is processed, and an IT provider can set up least-privilege access, prove access was removed, and run logging and review. The other two, checking outputs and carrying errors, sit with you alone unless a contract term says otherwise. If nobody owns the shared four yet, a managed IT arrangement is one way to give them an owner, and doing nothing yet is another.
Pick one task that is reversible, low stakes and well understood, and run it at rung two for a fixed period. Reversible matters most. If the worst outcome is a draft nobody sends, you can afford to be wrong while you learn.
Write down the number you expect to move before you start, and the date you will check it. Minutes per enquiry, replies sent the same day, invoices matched without a person. Without a baseline you will be judging the agent on how impressive it feels, which is what it is designed to feel.
Spend the time on the brief rather than the shortlist. Four things decide it: the outcome you want and how often, what the agent must not do, which systems it may read and which it may change, and what lands on your desk. Most disappointment with agents traces back to a brief written in ten minutes after a platform chosen over three weeks.
A free trial tells you about the interface. It tells you almost nothing about accuracy on your own customer data, so run the trial against real work and count the corrections. Widen access only once the correction rate has been stable for long enough to be boring. The ASD guidance recommends deploying agentic AI incrementally and reassessing as you go, which is the same advice at a larger scale.
AI agents for business are worth understanding now even if you deploy nothing this year, because the access and accountability questions they raise are the ones you will answer either way. A first step costs nothing: write down the systems an agent would need to touch, and who would own each line of the Responsibility Test. That list will tell you more than any product demonstration. For a second opinion on it, our IT consulting team is happy to look.
An AI agent is software that is given a goal and works out how to reach it, then carries out the steps using systems it has been connected to. It can read, decide and act, rather than only answering questions. The amount it does without asking is set by you.
A chatbot answers questions inside a conversation. An AI agent takes actions in your systems. A chatbot that is wrong has given bad information. An agent that is wrong has already done something, which is why agents need access limits and a person checking outputs.
They can be, at the right level of autonomy. The risk is not the technology itself but what it is allowed to reach and whether anyone checks its work. Starting with an agent that drafts rather than acts removes most of the exposure while you learn how accurate it is on your own data.
In practice the business is, unless a specific contract term says otherwise, and most AI vendor terms limit the vendor’s liability heavily. Australian government guidance asks organisations to name a person accountable for each AI system. An IT provider can configure access, logging and review, but accountability for the decision to use the agent stays with the business.
Pricing is usually a monthly subscription per user, a charge per action or credit, or both, plus setup if the agent needs connecting to your systems. The cost most businesses miss is staff time spent checking outputs, which is highest in the first month and never reaches zero.
There is no general law requiring it today, and the OAIC recommends clearly labelling public-facing AI tools as good practice. From 10 December 2026, privacy policies will have to disclose where personal information is used in computer programs making decisions that could significantly affect someone. Telling customers plainly is also what most people expect.