AI agents in business: which processes are ready for them

A language assistant answers questions and drafts text. What happens with the answer is decided by the person using it. An agent goes one step further: it receives a goal, breaks it into work steps and carries them out itself through connected systems. The German digital association Bitkom describes the difference this way: unlike a chatbot that answers questions, an agent acts on its own, for example by running price comparisons, obtaining quotes and working out decision options (Bitkom).

That shifts the question a company has to ask. With an assistant, the issue is whether the answer is correct. With an agent, the issue is what it may touch, which data it relies on and who notices when it gets something wrong. An agent reads an email, looks up a delivery date in the supplier portal, creates a purchase proposal in the ERP system and prepares a posting in accounting. Each of these steps touches a different system, and each has different consequences if it is carried out incorrectly. A misread email costs a follow-up question; an incorrect posting costs a documented correction.

For the business, an agent is therefore less a tool than a new member of staff without experience: fast, tireless and without a feel for when a case differs from the previous ones. Anyone hiring such a person describes the task first, grants only the access that is needed and has the first weeks countersigned. This groundwork is exactly what many workflows lack, regardless of whether an agent ever arrives.

When the survey was presented, Bitkom president Ralf Wintergerst summed up the prerequisites in a single sentence. At its core, it contains the entire list this article is about:

Figures from the same survey show where the effort actually arises. As a major cost item, 51 percent (Bitkom) of AI users name infrastructure such as cloud and computing power, 50 percent (Bitkom) data preparation and 41 percent (Bitkom) integration into existing systems. Subscriptions and licenses for AI software, by contrast, are a major cost item for only 21 percent (Bitkom). The model license is rarely the expensive part; besides computing power, the main cost lies in everything that connects the model to the company's data and systems.

Official statistics confirm this from the other side. Among companies that had considered using AI but had not yet done so by 2025, 45 percent (Destatis) cite incompatibility with existing equipment, software and systems as a reason and 44 percent (Destatis) difficulties with the availability or quality of the required data. Neither is an AI problem. Both are problems of workflows and the system landscape that cost time before. They were simply less visible because a person quietly filled the gaps.

That is precisely what an agent cannot do. An experienced clerk knows that the delivery address in the customer master is outdated and the correct one is in the customer's last email. An agent takes what the system gives it and carries on with it. Anyone who wants to use agents therefore has to translate the staff's tacit knowledge into data, rules and interfaces beforehand. A process analysis makes this part visible long before the first line of an agent is written.

Many workflows exist only in the heads of the people who carry them out. The process description in the quality manual often shows a target state from several years ago. For an agent, the as-is workflow is what counts: what triggers the case? Which information is needed, in which order? Where do people ask for clarification, and whom do they ask? When is the case considered done? Anyone who cannot answer these questions for a workflow without lengthy thought does not have a candidate for an agent but a candidate for a stocktake. How to set the order of such projects is described in our article on which processes to tackle first.

Some tools operate programs the way a person would: they read the screen, click fields and type in values. That is quick to set up but fragile in operation. A shifted input field after an update, an extra notification window or a changed column order, and the agent enters values in the wrong field without anyone noticing. An interface, by contrast, delivers records with fixed field names, reports errors with a code and can be restricted to its own technical account with narrowly scoped permissions. For an agent, it is the prerequisite for its rights to be enforced in the target system at all.

Without a baseline, there is no way to tell whether an agent helps. Before deployment, the workflow therefore needs one or two metrics that can already be collected today: lead time from receipt to completion, share of cases with follow-up questions, corrections per hundred postings. The same figures later show whether the agent works better than, as well as or worse than the previous workflow. In the Bitkom survey, 48 percent (Bitkom) of AI-using companies say AI has significantly sped up their internal processes. Whether that holds for a specific workflow in your own company only your own measurement can show.

Rights and approvals are a topic of their own; for getting started, one principle is enough. Each connection between the agent and a system gets exactly one right, namely the smallest one that suffices for the workflow. Three levels cover most cases:

What matters is where these rights are enforced. The Open Worldwide Application Security Project (OWASP) lists excessive agency as a risk of its own in its risk list for applications built on language models and recommends implementing authorization in the downstream systems rather than relying on the language model to decide whether an action is allowed (OWASP). In practice, this means the agent's technical account in accounting simply cannot post as long as no approval exists, no matter what the agent's instructions say or what a manipulated email tries to talk it into.

In the survey by TÜV-Verband and BSI, 64 percent (TÜV-Verband/BSI) of AI-using companies have restricted access rights and 67 percent (TÜV-Verband/BSI) rely on quality assurance and human review of critical AI results. For agents, both belong to the minimum, because their results are not just texts but postings, purchase orders and messages to customers. What approvals with deputies, deadlines and value limits look like in digital form is described in our article on approvals, deputies and audit trail.

The six criteria lead to a simple classification. Well suited are workflows with high repetition, clear data and limited consequences of an error. Less suited are workflows in which judgment, liability or rare exceptions determine the outcome. The table shows typical examples from trade, manufacturing and services with the level at which an agent can start.

Decisions about people are a special case. Under Art. 22(1) GDPR, a data subject has the right not to be subject to a decision based solely on automated processing which produces legal effects concerning them or similarly significantly affects them. The regulation provides for exceptions, for example where the decision is necessary for a contract, but then requires suitable safeguards. For getting started with agents, the simple line is the better one: where a decision affects a person legally or similarly significantly, the agent prepares and a human decides.

The survey results also argue for a step-by-step start. Among the obstacles, AI-using companies most often name data protection requirements, at 66 percent (Bitkom); 26 percent (Bitkom) complain about poor quality of results and 25 percent (Bitkom) about their lack of traceability. An agent that initially only reads and proposes delivers exactly the experience needed to test these concerns against your own workflow. An overview of the routine work AI can already take over is given in the article on AI in back-office work.

Most of the work before an agent is classic process work. As part of process automation, we map the workflow, collect the exceptions, set the metric and define the leading system for every data item. We clarify which steps a fixed rule handles more reliably than an agent and where an agent should work with proposals, and we set up approvals, logging and a manual fallback. Every automation can be paused, and the affected step can then be carried out by hand.

The technical foundation is interfaces with their own access and narrowly scoped permissions that report errors and whose runs are logged. It often turns out that part of the workflow needs no agent at all: matching purchase order, goods receipt and invoice follows fixed rules, and a programmed check usually handles it more reliably than a language model. How such a match is set up is shown in the article on the three-way match. The agent is then left with what rules handle poorly: reading free text, assigning inquiries, drafting replies. The result is a workflow in which an agent can take part without carrying it alone.