What Is an AI Agent? A Plain English Guide for Small Businesses

You have probably seen the phrase "AI agent" in software updates, sales emails and news stories. It gets used loosely, and sometimes it is just a new label on an old product. But there is a real idea underneath it, and it helps to understand that idea before anyone tries to sell you one.

This guide explains what an AI agent is, what it can sensibly do for a small business, where you might find one, and what to watch out for.

Chatbot or agent: what is the difference?

Most people have now used a chatbot. You type a question and it types an answer. A basic chatbot mainly responds to messages, so if it tells you how to reschedule a meeting, you may still have to go and do it yourself.

An agent can also use connected tools to carry out a task, sometimes over several steps. Instead of a question, you give it a goal, such as "reply to new enquiries and book a call with anyone who looks like a genuine customer". The tools it is connected to might include:

• your email inbox
• your calendar
• your CRM or customer list
• your phone system
• spreadsheets and accounting software
• the web, for looking things up

Within the boundaries you set, an agent can choose which tools and steps to use. It might read an email, check your diary, send a reply offering times, log the enquiry in your CRM and then tell you what it has done. A well set up agent reports back like this, so you can step in if something looks wrong.

In practice the line is blurring. ChatGPT and Copilot can now use tools and take some actions, and a chat window can be the front of an agent. Many products now do both, so judge a tool by what it can actually do rather than what it is called.

What jobs can an agent do?

Agents suit work that is repetitive, follows a fairly predictable pattern and uses information you already hold. Typical jobs include:

• Answering and routing phone calls: greeting callers, finding out what they need, then taking a message or putting them through.
• Replying to routine emails about opening hours, delivery or how to book.
• Booking appointments by checking availability and sending confirmations and reminders.
• Chasing unpaid invoices with reminders that follow your usual wording and timing.
• Qualifying enquiries by asking a few set questions and passing on the promising ones.
• Drafting quotes from your price list and a customer's requirements, ready for you to check.

For higher-risk tasks, keep a person checking the result. That is not a weakness of the idea. It is usually the right way to use it.

Where do AI agents come from?

You may already have access to one without realising. There are broadly three routes.

Built into products you already use. Microsoft is adding agent features to Copilot across Microsoft 365. Some business phone systems, such as 3CX, offer AI agents that can answer calls. CRM platforms including HubSpot and Salesforce have their own agent tools for sales and customer service. This is often the easiest starting point, because the agent already sits inside the system it works on.

No-code automation tools. Services such as Zapier, Make and Microsoft Power Automate link different apps together, and most now include AI steps. A workflow can read an incoming email, decide what kind of request it is and take a different action for each. Not every automation containing AI is an agent, though: some simply follow a fixed sequence.

Custom built. A developer can build an agent using AI models from OpenAI, Anthropic or Google through their APIs, the connections that let other software use their models. This can give you more control, but also more responsibility for security, testing and maintenance.

Features and terms change quickly across all three routes, so check the provider's own website for what is currently available.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

Limits, risks and safeguards

AI agents are useful, but they are not dependable in the way a calculator is.

• They make mistakes confidently. An agent can misread an email, invent a detail or book the wrong slot, and its report will still sound sure of itself. Its summary is no substitute for checking the actual bookings, messages or transactions.
• They need clear instructions and boundaries. Spell out what it may do, what it must never do and when to hand over to a person.
• Keep a human approving payments, contractual commitments, sensitive information and consequential customer decisions. Let the agent draft the reminder, quote or refund, but have someone sign it off.
• Costs vary. You may pay a subscription, a licence per user, usage charges or a mix, plus setup, integration and the time spent reviewing its work. Check the provider's pricing page, and compare the cost per correctly completed task with how you do it now.

There is also a security risk called prompt injection. An email, document or web page can contain instructions designed to trick an agent into revealing information or taking an unauthorised action. Written rules alone will not stop this, so restrict permissions, require approval for anything consequential and test with suspicious inputs. The NCSC website has guidance on AI security, including prompt injection.

For phone calls, tell callers they are speaking to an automated assistant, offer a way to reach a person and explain any recording and how it is used. If you ever use an agent for outbound marketing calls, check the ICO's guidance on PECR first: automated marketing calls need specific consent.

If you want to try one, start small:

1. Pick one repetitive job with a clear outcome, such as booking appointments.
2. Write down how you do it now, including the exceptions and what a good result looks like.
3. Give the agent only the access it needs for that job.
4. Test it with realistic exceptions and awkward inputs before it goes live.
5. Run it in draft or approval mode first, so nothing goes out without your say so.
6. Keep a record of its actions, provide a handover to a person and know how to reverse mistakes.
7. Review its work against the underlying records, and widen access only once you trust the results.

Data protection: what can the agent see?

Limiting access is one important safeguard. If an agent is connected to your whole inbox, it can read your whole inbox. Security also depends on the provider, how the agent is configured and the systems it connects to. Before you switch one on, ask:

• What data can it reach, and does it really need all of it?
• Where is the data processed and stored, and is it used to train the provider's models?
• Who at the provider can see it, and how long is it kept?
• Can you switch the agent off and remove its access quickly?

The answers should be in the provider's terms, privacy notice and data processing agreement. Ask for them if they are hard to find. Business versions of AI tools often come with different terms from free consumer versions.

If the agent handles personal information about customers, staff or suppliers, UK GDPR applies, and you remain responsible for that data even when someone else's software processes it. You need a lawful basis for the processing, your privacy information should explain it, and you should check the processor contract, retention and deletion arrangements and any safeguards for transfers outside the UK. If the processing is likely to pose a high risk to people, you need a data protection impact assessment (DPIA). The ICO's guidance on AI and data protection and its DPIA guidance cover this, and both are updated as things change, so check the ICO website rather than relying on older summaries.

Used carefully, an AI agent can handle some routine work well. Give it a narrow job, clear rules and limited access, keep a person in charge of money, commitments and sensitive decisions, and judge it on what it actually does rather than what it promises.