Agentic AI on one page.

The agent gathers what the case needs: the document, the ticket, the state in the ERP. It does not just read fields; it also notices what is missing or does not fit. How well this works depends on the quality of the inputs and on the systems the agent may read from.

From what it has perceived, the agent works out what the case means and where the missing information might be. This is where the language model makes its real contribution: recognising connections that no rule spells out. It is also exactly where plausible but wrong conclusions arise.

Before acting, the agent sets out the steps – and the criteria it will later use to check whether the result is right. A good plan only uses tools the agent actually has, and keeps actions that cannot be undone as late as possible.

The agent carries out the plan through tools: it queries, creates, proposes or posts – always within its permissions. At lower levels of autonomy it only prepares the action and a person confirms; later it may execute on its own in clearly defined cases.

After every step, the agent checks what its action achieved and adjusts the plan. Finally, it checks its result against the criteria from the plan and records why it decided as it did. If something does not fit, the loop starts again. If it remains unsure – for instance with two equally good candidates – it passes the case to a person, together with its reasoning.

When systems offer a stable interface and the rules can be fully described, a script is the best choice: fast, cheap, reliable and with almost no running cost per case. It decides nothing – it carries out what has been defined.

Software robots operate applications through their user interface, the way a person would. That pays off where there is no interface, screens are stable and exceptions are rare. Classic RPA is quick to introduce – but every changed screen and every unforeseen case stops the bot. New are agents that operate screens and browsers themselves (“computer use”): they help where screens change, but are slower, costlier and less predictable – with stable screens, the robot remains the first choice.

An agent pays off where cases have many variants, information sits in emails, PDFs or free text, and judgement is needed case by case. It costs more to run than a script and works with probabilities – which is why it needs test cases, limits and someone who owns the exceptions.

It is measured by the cost per completed case: reasoning steps, tool calls and loops use many times the tokens of a chat reply. Often less will do – if the flow is fixed and only one step needs language understanding, a workflow with an AI step is enough.

The language model supplies understanding: it reads, summarises, recognises intent and writes. It was pre-trained to predict the next word; today's models then also learn to think tasks through in intermediate steps. None of these steps guarantees truth: where knowledge is missing, a plausible guess often comes more naturally than “I don't know”. Models are replaced at short intervals; the architecture should plan for the switch.

With retrieval-augmented generation, the system retrieves relevant passages from your documents and gives them to the model – classically before every answer, with agents increasingly as a tool the agent calls on purpose. The model answers on that basis and cites the source. Errors do not disappear, but they become verifiable. This is usually faster, cheaper and easier to correct than training a model of your own.

Tools give the agent defined capabilities: query an order, propose a posting, start a robot. Each tool is described with a name, purpose and parameters; the Model Context Protocol (MCP) – vendor-neutral under the Linux Foundation since December 2025 – unifies how systems offer them; with A2A, agents hand tasks to each other. What is not released as a tool, the agent cannot do.

Evals are software testing for systems that work with probabilities: a collection of real cases with known correct outcomes against which the agent is checked automatically after every change. “Seems good” becomes a measurement with a history – and a model switch becomes plannable.

With agents, the path counts too: which tools it called with which values and whether it kept to its limits. Because the same case can turn out differently, every test runs several times.

Every agent gets its own identity – identity systems now treat agents as a distinct identity type, such as Microsoft Entra Agent ID or Okta – with an accountable owner, never a shared service account. Its permissions are tightly scoped, its credentials short-lived. That keeps it traceable who acted, and access reviews work as they do for employees.

The agent's limits are laid down as rules – and enforced in the tool layer, not just in the prompt. A rule in the prompt is a request to a model; a rule in the tool is a fact. Policies are changed like software: with review and version history.

The biggest risk is instructions hidden in the content the agent processes – an email, a PDF, a web page (prompt injection). Language models cannot reliably separate instructions from data; what matters is therefore what the agent can do when it is deceived.

Every step is recorded tamper-evidently: inputs including third-party content, tool calls with parameters, the policy decision, the result and the agent's reasoning, ideally hash-chained. The audit trail answers the question internal audit and management will ask: why did the system do that? And it is the best tool for root-cause analysis.

Human oversight does not mean someone looks at everything. Designed well, exceptions land in a queue with a service level – with the case, the reasoning and the agent's proposal. It includes a stop switch for each agent that works outside the model – disable the identity, revoke tokens, end the run – and that the business team can operate itself.

People do every step. That is no flaw but often the right choice – for rare cases, for work that needs a lot of judgement and relationships, or as long as the process is not understood. And it is the baseline: if you do not measure how long and how costly the work is today, you cannot prove any benefit later.

Fixed procedures run without people: scripts through interfaces, software robots through user interfaces. The software does not judge; every exception goes back to a person. That works as long as cases are uniform.

Machine learning takes on individual steps that need understanding: reading documents, classifying cases, estimating risk. The straight-through processing rate rises – the share of cases that pass without a human touch. The difficult exceptions stay with people.

The agent handles the whole case and proposes; a person confirms every action. This level is the learning phase for both sides: the team sees how the agent decides, and every correction becomes a new test case.

The agent acts on its own – within clear limits and for defined groups of cases. People decide the exceptions and monitor the metrics. The level is not granted for the whole process at once: it is released per group of cases and can be withdrawn at any time.

Article 5 of the AI Act prohibits AI practices whose risk to people is considered unacceptable – for example social scoring, manipulative or deceptive techniques, exploiting the vulnerabilities of certain groups, or emotion recognition in the workplace and in education, except for medical or safety reasons. These prohibitions have applied since 2 February 2025. The Digital Omnibus added AI systems that generate non-consensual intimate imagery or child sexual abuse material; that prohibition applies from 2 December 2026.

High-risk systems are permitted but strictly regulated. Under Annex III they include AI in recruitment and workforce management, in creditworthiness checks of private individuals or in critical infrastructure; under Annex I, AI as a safety component of regulated products. Providers carry the main obligations. Deployers must, among other things, use the system as instructed, ensure human oversight by trained people and keep automatically generated logs (Art. 26). These obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Not every system in an Annex III area is automatically high-risk; anything that profiles people, however, always is.

Article 50 has applied since 2 August 2026, with separate duties. Providers design AI systems that interact directly with people so that those people are informed – unless it is obvious – and mark synthetic audio, image, video and text outputs in machine-readable form; standard editing assistance is exempt. Deployers disclose, among other things, deepfakes, the use of emotion recognition and AI-generated text published to inform the public on matters of public interest, unless there is editorial control. The Commission published guidelines on 20 July 2026; a voluntary code of practice is recognised as an adequate way to demonstrate compliance.

The large remainder of AI applications is subject to no special requirements under the AI Act; voluntary codes of conduct are possible. Regardless of the tier, Art. 4 has applied since 2 February 2025: providers and deployers take measures to support the AI literacy of their staff and of people acting on their behalf – since the Digital Omnibus without a duty to guarantee a particular level.

Since this date, the transparency obligations under Article 50 have applied: providers inform people about interactions with AI systems and mark synthetic content in machine-readable form; deployers disclose deepfakes, among other things. From this date, the Commission can also fine providers of GPAI models. For companies with agents, this is the obligation with the biggest day-to-day impact, because it affects every point where an agent communicates with people or produces content.

Two dates coincide: providers of AI systems that generate synthetic content and were placed on the market before 2 August 2026 must implement machine-readable marking under Art. 50(2) by this date; the other transparency obligations already apply. And the prohibition added by the Digital Omnibus on AI systems that generate non-consensual intimate imagery or child sexual abuse material becomes applicable.

From this date, the obligations for high-risk systems under Annex III apply – for example AI in recruitment, creditworthiness checks or critical infrastructure. The original date was August 2026; the Digital Omnibus moved it. Systems placed on the market before then only fall under the obligations if their design is significantly changed afterwards; separate rules apply to systems used by public authorities.

From this date, the high-risk obligations apply to AI in regulated products under Annex I – for example as a safety component in medical devices or lifts. Since the Digital Omnibus, machinery takes its own route via the Machinery Regulation (EU) 2023/1230. AI used solely for non-safety-relevant tasks such as automation or performance optimisation does not count as a safety component. Mainly affected are manufacturers whose products already go through a conformity assessment.