What Are AI Agents and How Do They Work in a Business?

The back office of an installation business runs on handoffs. An enquiry arrives, a survey is booked, a quote goes out, an engineer is scheduled, the completion paperwork is gathered, an invoice is raised and someone chases payment. Each step waits for a person to notice that it is their turn.

AI agents are software that can be given a goal and then work out, and carry out, the steps towards it with limited human direction. That is different from the AI tools many people will have used so far, which answer a question or draft some text and then stop. This post looks at AI agents for business from the point of view of an installation or contracting firm: what an agent is, how it differs from chatbots and automation, where it could fit in the back office, why the state of a process matters before an agent touches it, and the risks that UK guidance sets out.

It explains how these systems work in general terms. It is not legal, data protection or cyber security advice, and the rules and guidance it refers to are changing, so the position needs checking at the time of any project.

What is an AI agent?

The UK government’s Artificial Intelligence Playbook describes agentic AI as autonomous systems that can make decisions and perform actions with minimal human intervention. An agent works out which tools and functions it has available and uses them to pursue its objective. The National Cyber Security Centre (NCSC) describes it in similar terms in its blog on adopting agentic AI: agentic systems can access data sources, remember context, make decisions, use tools and take actions towards a goal, without a person directing every step.

An agent can be described as having four parts.

• A model. Usually a large language model (LLM), the technology behind tools such as ChatGPT, Claude and Gemini. It interprets the goal and decides what to do next.
• Tools. Connections to other systems, such as an email account, a job management system, a calendar or the accounts package. These are what let an agent act rather than only write.
• Memory and context. Information the agent carries from one step to the next, such as what it has already done.
• Instructions and limits. The goal it has been given, the systems it may use and the actions it is permitted to take.

These parts work as a loop. The agent reads the goal, plans a step, takes it, checks the result and decides the next step, until the goal is met or it reaches a limit.

An illustration shows the difference. A traditional system needs each step spelt out: send a confirmation text to every customer with an install booked next week, then mark each job as confirmed. Instead, an agent could be given the goal “get next week’s installs confirmed”, together with limits set by the business. It can offer only the appointment slots the scheduler has approved. It passes unusual requests, such as a change to the scope of the job or a complaint, to a named person. Any change to a date already agreed with the customer needs a person’s approval before it goes out. Within those limits, the agent decides which jobs need confirming, how to contact each customer and when to hand a problem over.

How does an AI agent differ from a chatbot or an automation?

Three kinds of software often get grouped together as “AI”. The clearest difference between them is who decides the steps.

	Rule-based automation	AI assistant or chatbot	AI agent
What it does	Runs fixed steps when a trigger happens	Answers a question or drafts content when asked	Works towards a goal by choosing and taking steps
Who decides the steps	Whoever set it up, in advance	The user, each time	The agent, within the limits it is given
How predictable it is	The same input gives the same result	Can vary, even for the same request	Can vary, and the variation shows up as actions
Back-office example	Send a reminder when an invoice reaches a set age	Draft a reply to a customer for someone to edit and send	Work through overdue invoices, check each job record and send the right follow-up

Rule-based automation has been part of accounts packages and job management software for years. It is predictable, which is its strength, and it breaks when the input does not match what it was built for. An assistant typically responds to each request and leaves the next step to a person, although many chat-based tools can now also run tools and take actions. These categories overlap. The useful distinction is how much freedom the system has to choose and carry out steps, rather than whether it has a chat interface. An agent combines the flexibility of the model with the ability to act, which is what makes it useful and also what makes it harder to control. The post on AI workflow automation covers the wider set of automation tools these sit alongside.

The difference in predictability matters. The AI Playbook explains that LLMs generate content by returning the most likely output based on patterns in their training data, so they can produce content that looks plausible but is wrong, and it notes that AI systems are not guaranteed to be accurate. When the output is a draft, a person can catch the error. When the output is an action, such as an email sent or a record changed, the error has already happened. The NCSC lists unpredictable behaviour, and actions that happen faster than a person can meaningfully review them, among the risks that agents add.

Where could AI agents fit in an installation business?

This post focuses on back-office tasks, not work on site. In an installation or contracting business they include:

• Enquiries and quotes. Sorting incoming enquiries, asking customers for missing details and following up quotes that have had no reply.
• Scheduling. Confirming appointments, offering new slots when someone cancels and flagging clashes.
• Job paperwork. Checking that the completion photos, commissioning records and certificates already produced for a job are in the handover or certification pack, organising them and listing what is missing. This is a check of what is on file, not a judgement on whether the work is technically compliant.
• Invoicing and collection. Preparing invoices from completed job records and sending reminders on overdue ones. These are steps in the quote to cash process, where delays can add up across many jobs.
• Records. Keeping customer and job records up to date as emails and messages arrive.

The NCSC’s view is that agentic AI is likely to offer significant benefits, particularly where tasks are repetitive, well understood and low risk. The AI Playbook gives an example from order processing, where agents capture pricing and market data, and another agent fetches the latest price when the stored prices have not been updated recently.

For a sense of scale, the Office for National Statistics (ONS) analysis Artificial intelligence in UK businesses: 2023 to 2026 found that around 35% of UK businesses with 10 or more employees reported using at least one AI technology in June 2026, up from around 12% in late 2023. For construction, the ONS reported 13% in June 2026. Construction is a broad sector, spanning building, civil engineering and specialist trades, so this is a sector comparison rather than a measure of installation businesses specifically. The ONS describes adoption so far as relatively shallow, with the average adopting business using fewer than two AI technologies, and its survey does not measure agents specifically.

Why does process clarity come before an AI agent?

An agent works with the process and the information it is given. If the status of a quote is recorded in a job system, an agent can read it and act on it. If it lives in an estimator’s head or a personal inbox, there is nothing for the agent to work from, and it may act on whatever partial information it can find.

The AI Playbook makes the same point about data: AI systems rely on the quality and quantity of their data for accuracy, and poor quality or incomplete data can lead to inaccurate results. The NCSC asks organisations to consider, before deploying an agent, whether AI is needed at all or whether the process could be simplified, removed or automated in a lower-risk way. Earlier ONS analysis, cited in the same 2026 article, found that firms with stronger management practices are more likely to adopt advanced technologies, including AI.

The signs that a process may not be ready for an agent are ordinary ones, and they are about the process rather than the people involved. A workflow audit, which maps how work actually moves through a business, is designed to surface them:

• The same question gets different answers depending on who is asked.
• Finding out where a job has got to means phoning someone.
• The documents for a job are spread across personal inboxes, phones and folders.
• There is no shared definition of when a job is complete and ready to invoice.
• Exceptions are handled from memory rather than from a written rule.

An agent working from a process like this would be likely to inherit these problems rather than solve them. Written standard operating procedures set out how each task is done, and a business management system ties the processes, records and tools together. Those are the records and routines an agent would work from.

What are the risks of using AI agents?

Many of the risks are familiar from any IT system: who has access to what, how suppliers are managed, how problems are spotted and who is responsible. The NCSC’s blog explains that the extra autonomy and complexity of agents can increase the attack surface, and lists additional risks including:

• Broader access. Agents can be allowed into external systems, data and tools in ways that other AI tools are not.
• Unpredictable behaviour. Especially when a goal can be interpreted in a way a person would not expect.
• Problems that are harder to spot. Actions can happen faster than anyone can meaningfully review them.
• Actions that are harder to explain. The range of tools and behaviours available to an agent makes it difficult to say why it took a particular course.

Prompt injection. One risk comes from the way LLMs read text. The NCSC explains in Prompt injection is not SQL injection (it may be worse) that current LLMs do not enforce a boundary between the instructions they are given and the content they are processing. A document or message can therefore contain text that the model treats as an instruction. The NCSC’s example is a CV containing hidden text that tells a screening system to approve it for interview. It concludes that this kind of attack may never be fully mitigated, so the focus is on limiting what a manipulated system can do. One approach it suggests is that an LLM processing emails from unknown outside parties should not have access to privileged tools. That principle is relevant to any agent connected to an inbox that receives supplier invoices and customer messages.

Data protection. Where an agent handles the personal data of customers or staff, such as emails, job records or engineer schedules, the UK GDPR applies as it does to any other system. Further rules apply where a decision about a person is made solely by automated means, with no meaningful human involvement, and has a legal or similarly significant effect on them. The Data (Use and Access) Act 2025 changed those rules with effect from 5 February 2026. GOV.UK describes the new framework as more permissive: such decisions can be made in a wider range of circumstances, provided safeguards are in place. The safeguards are giving people information about significant decisions made about them, enabling them to make representations about and challenge those decisions, and enabling them to obtain human intervention. The ICO’s guidance on automated decision-making was being updated to reflect the changes and was still in draft when this post was written, so the position needs checking at the time any system is planned.

Instructions are not controls. The NCSC’s later blog on managing the cyber risk of agentic AI, published in August 2026 as interim advice, adds that instructions alone are not enough. It advises against relying on prompting alone, describes the safety features built into models as a baseline that can be bypassed, and says that where an agent needs to stop and seek human approval, those approvals need to be both guaranteed and gated, with human oversight alongside technically enforced controls in higher-risk settings. The difference is practical.

As an illustration, telling an agent not to send payments is an instruction; an accounts system that gives the agent’s login no permission to send payments is a control. Permissions and approval steps hold when the connected systems enforce them, not only when the agent follows its instructions.

Accountability. The NCSC is clear that a system may take an action, but people remain accountable for the decision to deploy it, the access it was given, the safeguards around it and the consequences of what it does. The AI Playbook’s principle of meaningful human control at the right stages makes a related point about oversight for government use of AI.

When is a task ready to hand to an AI agent?

There is no single test, but UK guidance sets out the factors that decide it. The NCSC’s blog describes starting small: tightly bounded pilots with clearly defined tasks, used for low-risk work, with confidence built before the scope widens. It also lists practical controls, including:

• Least privilege. An agent gets only the access it needs, for the shortest time needed.
• Limited scope. Constraints on what an agent can reach, what it can do and when it can do it.
• Temporary credentials. No long-lived passwords or keys, with elevated access removed when a task is complete.
• Monitoring. Watching for unusual activity across the tools and systems an agent touches.
• Incident planning. Response plans that cover an agent failing, being misused or acting outside its intended scope.
• Named ownership. Clarity, before an agent is connected to real systems or data, over who owns it, who approves its access, who monitors it and who can stop it.

The NCSC sums this up in a single test: if an agent’s actions cannot be understood, monitored or contained, it is not ready for deployment.

Taken together, the factors that decide whether a task suits an agent are how repetitive and well defined the task is, whether the process and data behind it are reliable, what harm a wrong action could cause (especially where money, personal data or compliance records are involved), how much access the agent would need, and whether someone in the business owns it and can intervene.

Frequently asked questions

Sources

• Office for National Statistics: Artificial intelligence in UK businesses: 2023 to 2026 (released 20 July 2026)
• Government Digital Service: Artificial Intelligence Playbook for the UK Government (published 10 February 2025)
• National Cyber Security Centre: Thinking carefully before adopting agentic AI (15 May 2026)
• National Cyber Security Centre: Prompt injection is not SQL injection (it may be worse) (8 December 2025)
• National Cyber Security Centre: Managing the cyber risk of agentic AI (20 August 2026)
• Information Commissioner’s Office: Automated decision-making, including profiling (draft guidance, updated 31 March 2026)
• GOV.UK: Data (Use and Access) Act 2025: data protection and privacy changes (published 27 June 2025)
• legislation.gov.uk: The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82)

Figures last checked: October 2026.