What Is An AI Agent And How Is It Different From A Chatbot?

The word agent has been stretched to breaking point. Buy an agent and get a chatbot and you have paid for autonomy you never received.

Deploy a real agent without the controls a real agent needs and you have handed write access to a probabilistic system. Both mistakes are expensive, and the second one is worse.

The market is not helping. Gartner estimated in June 2025 that only around 130 of the thousands of vendors selling agentic products were doing anything genuinely agentic, with the rest rebranding assistants, workflow tools and chatbots.

UK adoption is broad but shallow. ONS figures published in July 2026 put AI use among businesses with 10 or more employees at around 35%, up from around 12% in late 2023, while the average adopter runs just 1.6 AI tools.

Here is what an agent actually is, where the line sits against a chatbot and against RPA, how often these projects fail, what the ICO expects, and what it costs to run one properly.

What Are the Moving Parts of an AI Agent?

Five things: a goal, a reasoning loop that plans the next step, tools it can call, memory that survives between steps, and a stopping condition. Remove any one and you have a component rather than an agent.

The Goal, Not the Script

A chatbot is given a turn and asked to respond. An agent is given an outcome, such as reconcile this invoice against the purchase order and flag any variance over £250, and left to work out the route.

That is the whole difference in one sentence. Everything else is plumbing built to make the difference safe.

The Reasoning Loop

The model looks at the goal and the current state, decides on one action, takes it, reads the result, and decides again. Loops usually terminate on success, on a step budget, or on a token or cost budget.

Getting the stopping condition wrong is the single most common cause of a runaway bill. It is also the easiest thing to test before launch and the most commonly skipped.

Tool Use and the Model Context Protocol

Tool use is what lets the agent act. A tool is a function the model can call: query the CRM, raise a ticket, send an email, run a query, hit an internal API.

Most of this has converged on the Model Context Protocol, released by Anthropic in November 2024 and since contributed to the Agentic AI Foundation at the Linux Foundation.

The foundation’s platinum members include Amazon Web Services, Anthropic, Google, Microsoft and OpenAI, so this is a real standard rather than one vendor’s convention.

It also has real gaps. The current specification defines resources, prompts, tools and utilities, and contains no protocol-level audit trail and no cost attribution, so you build both yourself.

Memory and Retrieval

Short-term memory is the working context of the current task. Long-term memory is usually retrieval augmented generation, which fetches your documents and records at the moment of need rather than baking them into the model.

Neither is free. Retrieval quality is the largest single determinant of whether an agent is useful, and it is a data engineering problem rather than a model choice.

Retrieval is also what makes an answer checkable, because the agent can cite the record it acted on. That citation is the difference between an audit you can pass and a transcript you have to defend, which is why explainable AI is a design decision rather than a document.

Guardrails

The permission boundary, the approval gates, the spend cap and the logging are not extras bolted on later. They are part of the agent, and platforms such as Microsoft’s Foundry Agent Service and Amazon Bedrock AgentCore now ship identity, session isolation and tracing precisely because everyone learned that the hard way.

How Does an AI Agent Differ From a Chatbot and From RPA?

A chatbot answers, RPA repeats, an agent decides. The practical test is what happens when reality does not match the plan: a chatbot apologises, RPA breaks, and an agent tries a different route, which is exactly why it needs supervision.

	Chatbot	RPA	AI agent
What triggers it	A user message. Nothing happens until someone types	A schedule, a file landing, or a system event. Fixed trigger, fixed path	A goal from a person or another system. It then decides its own sequence
What it can do	Retrieve information and generate text. Read-only in most deployments	Execute a pre-recorded sequence across defined screens and APIs	Call tools, write to systems of record, chain steps, and revise the plan mid-task
How it handles the unexpected	Falls back to a canned response or hands off to a human	Fails, usually loudly. A changed field label stops the whole run	Attempts an alternative route. Sometimes correct, sometimes confidently wrong
Oversight needed	Content review and tone monitoring. Low risk per interaction	Change control when the target system changes. Predictable and testable	Permission scoping, approval gates on write actions, spend limits, full action logging
Typical business use	FAQ deflection, internal policy lookup, first-line triage	Invoice posting, data migration, statutory reporting, joiner and leaver processes	Ticket resolution end to end, claims triage, procurement checks, code and test tasks
Where it fails	Anything needing an action rather than an answer	Any variation in the input or the interface	Long unsupervised chains, and actions that are expensive to reverse

Why It Is a Change in Risk Category, Not a Capability Upgrade

Robotic process automation is the more useful comparison and the one most buyers skip. RPA is deterministic: it does the same thing in the same order every time, which is a genuine virtue in finance and payroll.

An agent is probabilistic. Ask it the same thing twice and you may get two routes to the same outcome, or two different outcomes, and that flexibility is the product and the risk in equal measure, which is why intelligent automation often means both technologies rather than one replacing the other.

The comparison usually gets framed as an upgrade. It is better understood as a change in risk category, because the moment a system can write, your controls have to cover actions rather than words, and a conversational assistant is still the right answer for a great deal of work.

The Four Levels of Autonomy

Gartner’s autonomy model is a more useful frame than the binary. It runs from Observe, through Advise, to Act with Approval and finally Act Autonomously.

Level	What the system does	Controls it needs	Where it fits
Observe	Reads and summarises, takes no action	Access scoping and data protection review	Research, monitoring, reporting
Advise	Recommends an action for a person to take	The same, plus output review	Triage, drafting, prioritisation
Act with Approval	Prepares an action and waits for a human gate	Approval workflow, action logging, spend caps	Most defensible production deployments in 2026
Act Autonomously	Executes without a gate inside a defined boundary	All of the above, plus kill switch, rollback and continuous evaluation	Narrow, high-volume, cheaply reversible tasks only

Most vendors sell the fourth level and most successful deployments run at the third. Decide which one you are buying before you compare prices.

Where Do AI Agents Genuinely Work in Business Today?

Narrow, high-volume, reversible tasks with a human check at the end. The pattern that works in 2026 is an agent handling the first 80% of a well-defined process while a person keeps the final decision.

The Deployments That Hold Up

• Customer service resolution where the agent can read the order system and issue a refund below a set value.
• Software engineering tasks: writing tests, fixing a failing build, opening a pull request a human reviews.
• Document-heavy back office work such as matching invoices, chasing missing data and pre-populating claims files.
• Research and preparation tasks where the output is a draft rather than a decision.

Notice what those share: high volume, a clear definition of done, a cheap error, and a human who sees the result before it reaches a customer or a regulator. That shape is what enterprise AI agents for workflow automation should be scoped against.

Where They Still Fail

Reliability over long chains is the honest weak point, and the published benchmarks are blunt about it. On the original tau-bench study in 2024, the best model scored 61.2% on retail customer service tasks at a single attempt and 35.2% on airline tasks.

Consistency is worse than the headline. The same paper reported pass^8, meaning success on all eight of eight attempts, at under 25% in the retail domain, and the follow-up tau2-bench study in 2025 found a leading model at 74% on retail dropping to 34% on a telecom domain.

What was measured	Result	What it tells a buyer
tau-bench 2024, retail, single attempt	61.2% for the best model tested	Roughly two in five tasks fail first time on a realistic benchmark
tau-bench 2024, retail, eight of eight attempts	Under 25%	A demo that works once is not evidence it works reliably
tau2-bench 2025, retail versus telecom	74% falling to 34%	Performance is domain-specific and does not transfer
tau2-bench 2025, autonomous versus guiding a user	Around 20 points lower when guiding	Agents are worse at working with a person than working alone

That gap between one good run and eight consistent ones is what separates a demo from a deployment. Ask any vendor for their pass rate across repeated runs, not their best result.

What That Means for Scoping

Pick a task somebody does by hand hundreds of times a month, and write down the number you expect to move before anyone writes code.

The business case that survives a finance director is a narrow one with a measurable baseline rather than a platform-wide autonomy story, which is the same discipline that applies to building any custom AI solution.

Book an AI consultancy session about what to automate first

How Often Do Agent Projects Actually Fail?

Often enough that it belongs in your business case. Gartner forecasts that more than 40% of agentic AI projects will be cancelled by the end of 2027, and separately that 40% of enterprises will demote or decommission autonomous agents by 2027 over governance gaps.

No competitor guide on this subject publishes a single failure figure. Here are the ones that exist.

Finding	Source and date	Read it as
More than 40% of agentic AI projects cancelled by end of 2027, on escalating cost, unclear value or inadequate risk controls	Gartner, June 2025	A forecast, and the three named causes are all avoidable
Only around 130 of thousands of agentic vendors are doing anything genuinely agentic	Gartner, June 2025	Most of what you will be pitched is not an agent
40% of enterprises will demote or decommission autonomous agents by 2027 over governance gaps	Gartner, May 2026	Deployment is not the finish line
Only 13% of organisations believe they have the right agent governance in place	Gartner, April 2026	The strongest single argument for doing the controls first
74% of enterprises have rolled back or shut down a customer-facing AI agent after deployment	Sinch survey, May 2026, vendor-sponsored, 2,527 decision makers	Directionally useful, but treat a vendor survey as directional
UK AI adoption at around 35% of businesses with 10+ staff, average 1.6 tools per adopter	ONS, July 2026	Broad adoption, shallow depth. Most firms are not running agents at all

What the Numbers Have in Common

Cost, unclear value and weak controls appear in every list. None of the three is a modelling problem, and none of them gets fixed by choosing a better vendor.

Agents also fail where the data is a mess, where the task has no measurable definition of done, and where nobody owns the thing after launch. Those are the same causes that sink any software project.

The Readiness Test Before You Start

• Is there a named owner who will still be accountable in twelve months?
• Can you state the number you expect to move, and measure it today?
• Do the systems the agent must touch have APIs, or will it be driving screens?
• Is the process written down anywhere, or does it live in three people’s heads?
• Has anyone audited the permissions on the data the agent will read?

Two or more noes and the honest answer is not yet. Fix the process and the data first, because a proof of concept will tell you which of those five is actually blocking you, at a fraction of the cost of finding out in production.

What Does Human-in-the-Loop Oversight Look Like in Practice?

Specific, named actions require a person to approve them before they execute, with the agent pausing rather than proceeding on a guess. The design question is which actions get a gate, not whether to have gates.

The useful distinction is between reading and writing. Let the agent read widely and act narrowly.

Where to Put the Gates

• Anything that moves money, changes a price, or issues a credit above a threshold.
• Anything that sends external communication in the company’s name.
• Anything that deletes, or that is expensive to reverse.
• Anything that produces a decision about a person, such as eligibility, pricing or shortlisting.

That last one carries legal weight in the UK, and it is the one most likely to be missed because it does not feel like an action.

Approval Fatigue Is the Failure Mode

Gate everything and reviewers rubber-stamp within a fortnight. Gate nothing and you find out about the problem from a customer.

Sample the ungated actions instead. Review a fixed percentage weekly, and move an action into the gated set the moment its error rate crosses a number you agreed in advance.

Kill Switches and Rollback

Decide before launch how you stop the agent mid-task and what happens to work already in flight. A pause that leaves half a batch processed is not a kill switch.

Every write action should be reversible or logged well enough to be reversed by hand. If neither is true, that action belongs behind a gate whatever its error rate, and it is the kind of judgement a fractional CTO should be making before the first release rather than after the first incident.

What Does the ICO Expect From an Agentic Deployment?

You stay responsible for data protection compliance for any agentic system you build, deploy or integrate. The ICO named eight novel risks in January 2026, including excessive automated decision-making and unclear controller responsibilities across the agent supply chain.

Not one competitor article on this subject mentions the ICO. For a UK buyer this is the section that decides whether a deployment survives its first data protection review.

The Risks the ICO Named

The ICO tech futures report on agentic AI, published on 8 January 2026, sets out eight data protection risks specific to systems that act rather than answer.

Two matter more than the rest for most deployments. Rapid automation of increasingly complex tasks produces a larger volume of automated decision-making than anyone planned for, and responsibilities blur across the supply chain.

Controller and Processor Roles Across the Supply Chain

An agent typically calls a model provider, a retrieval layer, several internal systems and sometimes a third-party tool. Each hop raises the question of who is controller and who is processor.

Write that map down before launch rather than after an incident. Where the agent touches personal data, the same Article 28 processor terms apply as to any other supplier, and a security assessment should cover the tool boundary as well as the application.

Automated Decisions About People

If the agent produces a decision with legal or similarly weighty effects about an individual, UK GDPR safeguards apply, and the ICO consulted on updated automated decision-making and profiling guidance between March and May 2026.

Build the explanation and the route to contest into the design. Retrofitting either into a live agent is close to a rebuild.

How Does the EU AI Act Apply to Agents?

It applies if you place the system on the EU market or its output is used there, wherever you operate from. Article 50 transparency duties apply from 2 August 2026, and high-risk obligations for Annex III systems now fall on 2 December 2027.

Article 50 and the 2026 Dates

Article 50 requires people to be told when they are dealing with an AI system or AI-generated content. That duty applies from 2 August 2026 and was not deferred.

A four-month grace period runs to 2 December 2026 for machine-readable marking of synthetic content on systems already on the market. That is a narrower concession than the headlines suggested.

High-Risk Classification and the Deferral

The Digital Omnibus, agreed politically on 6 May 2026 and confirmed by the Council on 13 May, moved Annex III high-risk obligations to 2 December 2027 and product-embedded AI to 2 August 2028.

That buys time rather than removing the duty. If your agent scores CVs, prices credit or affects access to a public service, the design decisions that determine compliance are being made now.

What Does It Take to Run an AI Agent Safely?

Four controls, all of them boring: a scoped identity of its own, an immutable log of every action, a hard spend limit, and an evaluation suite that runs before every change. Without these you are not running an agent, you are hoping.

Give It Its Own Identity

An agent should hold its own service account with least-privilege access, not a borrowed staff login. If it runs on behalf of a user, the permission boundary should be the narrower of the two.

Inherited permissions catch people out. A retrieval layer pointed at a document store nobody has audited since 2019 will happily surface a salary review to whoever asks politely, which is why the application security work belongs at the start rather than at the security review.

Log the Actions, Not Just the Chat

You need to reconstruct what the agent did, with what inputs, under whose authority, and which source it relied on. Transcripts alone will not satisfy an auditor, an insurer or the ICO.

Log the tool call, the parameters, the result and the identity in one record. Reconstructing that from three systems six months later is how a small incident becomes a long one.

Cap the Spend

Set a per-task token budget, a per-day account cap, and an alert well below both. A looping agent is a metered loop, and the bill scales with the infrastructure underneath it rather than with the value it produced.

Evaluate Before You Ship

Build a set of 50 to 200 real cases with known correct outcomes and run them on every prompt, model or tool change. Measure the pass rate across repeated runs rather than one good attempt.

That is the same discipline the benchmarks apply, and it is the only way to know whether a change helped. Consistency is what matters in production, as the tau2-bench results show plainly.

The Frameworks Worth Adopting

Framework	What it covers	When to use it
NIST AI Risk Management Framework	Govern, map, measure and manage functions across an AI programme	Programme level, and the easiest to explain to a board
OWASP Top 10 for Agentic Applications for 2026	Threats specific to tool-calling systems: goal hijacking, tool misuse, identity abuse, memory poisoning, rogue agent behaviour	Design and security review of a specific agent
ISO/IEC 42001	A certifiable AI management system	When enterprise buyers start asking which standard you follow
Tiered internal policy	Different controls by autonomy level rather than one uniform standard	Always. Gartner warns that uniform governance across every agent tends to fail

The NIST framework works at programme level, while the OWASP Top 10 for Agentic Applications for 2026, published in December 2025 with input from more than 100 practitioners, covers the threats specific to tool-calling systems.

One caution worth repeating. Gartner warned in May 2026 that applying a uniform governance standard across every agent leads to failure, because a read-only research assistant and an agent with payment authority do not warrant the same controls.

What Does an AI Agent Cost to Build and Run?

A first production agent on a narrow process typically runs £40,000 to £150,000 over 8 to 16 weeks, with running costs made up of model tokens, infrastructure and the observability and evaluation work most budgets miss.

Those are our own delivery figures rather than a published benchmark, because no credible UK benchmark exists. No competitor article on this subject gives a number at all.

Cost line	Typical share of year one	What drives it
Discovery, process definition and data audit	10% to 20%	How well the process is documented today
Integration and tool building	30% to 40%	Number of systems, and whether they have APIs
Guardrails, identity, logging and approval workflow	15% to 25%	Autonomy level and how reversible the actions are
Evaluation harness and test cases	10% to 15%	How measurable the definition of done is
Model inference	10% to 25% of running cost	Volume, and whether cheap models handle routine work
Ongoing ownership	15% to 25% of build cost a year	Someone has to re-run evaluations and watch the override rate

What Most Budgets Miss

Evaluation and observability are the two lines that get cut first and cost the most to add later. An agent without an evaluation suite cannot be safely changed, which means it cannot be improved.

Model choice matters less than routing. Send routine work to a cheap model and reserve the expensive tier for the hard cases, and the inference bill falls by an order of magnitude, which is covered in more detail in what AI software costs.

Should You Build an Agent or Buy One?

Buy where the process is generic and a vendor already runs it for thousands of customers. Build where the agent needs your data, your rules and your systems, which is most of the work that would justify an agent in the first place.

The honest middle is usually to buy the platform and build the agent on top of it, rather than buying an agent or writing one from scratch.

What to Ask an Agent Vendor

Question	What a good answer sounds like	What a bad answer sounds like
Which tools can it call, and what is its permission scope?	A named list, with scopes and a service identity	It integrates with everything
What autonomy level does it run at by default?	Act with approval, with named exceptions	It is fully autonomous
How do we review a decision after the fact?	An action log with inputs, sources and identity	You can read the conversation history
What is your pass rate across repeated runs?	A number, and the evaluation set it came from	A demo
Who is controller and who is processor?	A written map, and Article 28 terms	We are GDPR compliant
What happens to our data and configuration if we leave?	An export, a notice period and a defined handover	It is all in the platform

The Platforms and Frameworks You Will Be Offered

Two names in common circulation are already out of date. Amazon Bedrock Agents is now Bedrock Agents Classic, in maintenance mode and closed to new customers from July 2026, with AgentCore the current path.

On the Microsoft side, the platform is now Microsoft Foundry with the Foundry Agent Service, and the Microsoft Agent Framework supersedes both AutoGen and Semantic Kernel. Anyone proposing AutoGen for a new build in 2026 has not looked recently.

On the framework side, LangGraph, CrewAI, the OpenAI Agents SDK and Google’s Agent Development Kit are the ones a UK buyer will encounter. The choice matters far less than the guardrails around it, which is the point most vendor comparisons avoid and where an AI tool development team earns its fee.

How Many Agents Should You Start With?

One. Multi-agent architectures multiply the failure surface and the debugging cost, and most published multi-agent wins would have worked as a single agent with better tools.

Why Multi-Agent Multiplies the Failure Surface

Two agents talking to each other produce failure modes neither has alone: circular delegation, contradictory actions, and errors that compound instead of surfacing.

Add a second agent only when the first is measurably reliable and the second solves a problem the first cannot. That is a higher bar than most architectures clear, and the direction of travel in software delivery suggests it will stay that way for a while.

Agent Sprawl Is Already a Thing

Gartner forecasts that by 2028 the average global Fortune 500 enterprise will have more than 150,000 agents in use, up from fewer than fifteen in 2025. Whatever the exact number, the direction is a governance problem rather than a technology one.

Decide now who approves a new agent, who owns it, and how it gets retired. That register is the cheapest thing on this page and the one nobody builds until it is late, which is the same lesson every digital transformation programme learns about shadow IT.

Related Guides

Related: Custom AI Software Development: The Secret to Scaling Your Business

Related: How Much Does AI Software Development Cost?

Related: How AI Reduces the Cost of PoC Software Development

Related: How AI-Driven Development Accelerates MVP Software Implementation

Related: What Is Bespoke Software?

Frequently Asked Questions