You may already be using them, without having decided to.
Until recently this was a build question. You’d pick a framework and wire something together, and for most firms of 5 to 100 people the effort wasn’t worth it yet. That answer’s now out of date. Through the middle of 2026 the major vendors shipped agent capability into the subscriptions businesses already run. Some of it costs nothing extra, some of it bills by the task and almost all of it arrives switched off.
So the question has moved. It’s now what you’re willing to let one touch, and that’s a judgement the software can’t make for you.
What is an AI agent?
Software that’s given a goal, works out the steps itself and can use your tools along the way.
Traditional automation follows a fixed script: when this happens, do that. You can read it, predict it and test it. An agent is handed an objective and decides how to reach it, calling on whatever it’s been connected to. Draft the proposal. Chase the invoice. Sort the inbox and escalate what matters.
Two consequences follow. Output varies a little between runs, which is true of any AI and gets more attention than it deserves. The one that matters is that the work happens in a chain, and each step is built on the last. A small misreading at step one gets elaborated by step four.
Everything people argue about, which model, how many agents, which framework, is downstream of that.
Why does that difference matter so much?
Because it changes what happens when something goes wrong.
A script that breaks tends to stop. Something errors, a queue backs up, someone notices by lunchtime. The failure is loud, which is a gift.
An agent that drifts keeps going. It carries on producing plausible work in a slightly wrong direction, and because each individual output looks reasonable, nobody catches it by looking at any single one. You find it a fortnight later, in a client email, or you never find it at all.
So know what good output looks like before you stop reading every one. Most businesses have never had to write that down, because a person was always doing the job, and a person notices when a job feels wrong.
What changed in the middle of 2026?
Agents stopped being a project and started being a setting.
In May 2026, Claude for Small Business shipped with ready-to-run workflows and connectors into the tools firms already run, on paid Claude plans. Microsoft sells Copilot two ways, bundled into some Microsoft 365 business plans and as a paid add-on to others, so two firms both on Microsoft 365 can be in quite different positions. Find out whether you already have it.
In June, Microsoft made Copilot Cowork generally available. It works across your Microsoft 365 apps and hands back finished work. It needs a Microsoft 365 Copilot licence, and then bills by the task on a credit meter, so the same instruction can cost different amounts depending on how much it reads and how long it runs. Microsoft’s own wording is worth having in front of you: Cowork is off by default, and an administrator decides when to enable it and who gets access.
The pattern holds at every size: the capability arrives inside subscriptions people already hold, it arrives switched off and someone in the business decides to turn it on.
Before anyone gets enthusiastic: having the assistant and having agents running are different things, and the billing has more than one rule. Agents published to Microsoft 365 Copilot are included in that licence. For staff without that licence, agents that reach SharePoint or Graph connector content bill on metered consumption, and they stay off until an administrator sets up billing for them. Cowork needs the licence and meters on top of it. That difference is what separates a surprise bill from a deliberate choice, so ask which of these you’re turning on before you widen anything. I’ve set out how Copilot agents and Credits are billed, including where an admin caps the spend.
In the product copy, the approval step is the default. You confirm the plan, or you let it run once you’re comfortable, and your existing permissions still apply. The control I’d have told you to build is now a checkbox.
That’s good, and it moves the constraint. Knowing that a tool can require approval doesn’t tell you which jobs should require it, what “wrong” looks like for your work or which client information should be within reach in the first place. Those are the questions I get paid for, and no vendor can answer them, because the answers are specific to your practice.
What would have to be true before you let one run?
Four things, and none of them are technical.
The job is described precisely: what people do in practice, exceptions included, which is rarely what the process document says. If you can’t write it down, you can’t judge whether the thing did it correctly.
You know what a good result looks like. Specifically enough that a second person could sort a pile of outputs into fine and not fine, and agree with you.
The inputs are reliable. If the information lives in three places and one of them is somebody’s inbox, an agent will do the wrong thing faster and more confidently than a person would.
Someone owns the output. By name, including the bad days, which is the part that gets skipped.
A peer at a consultancy told me what happens when those conditions aren’t met. A colleague built some AI skills so consultants could report progress and risks in plain English, and it worked well enough to end up running the dashboard the leadership team looks at. But the rules for marking a project red or amber were sentences, which a model can read differently today and tomorrow, and people were on different models. Untangling it took three technical people about a week and a half. If a rule has to hold every time, don’t leave it as a request in a prompt.
The government’s own readiness guidance puts it more bluntly than I would: successful adoption comes down to people and team culture, not only technology. Its readiness areas are business goals, people, oversight and accountability, data fit for purpose and reviewing your processes. Not one of them is about choosing a model.
Those four are a test for a specific job. The AI risk assessment asks them in order and adds what the output affects and where you sit legally. It ends on whether that particular job is safe to let run.
Is your first problem an agent problem?
Often not, and this is where I’d spend the afternoon instead.
A small education business I worked with uses AI to draft worksheets. The generation was never the hard part. Planning what goes out across a year was, and so was checking it, because a wrong answer key reaches children. Faster generation wouldn’t have helped with either.
“We need an agent” is usually a well-intentioned guess at a problem nobody has measured. Measure it first. Sometimes the answer is an agent. Far more often it’s a template, a shared rule about which tool does what and one job made repeatable.
What is the right test for letting something run unsupervised?
Consequence and reversibility, not how often the job happens.
A job running twice a day that goes to clients deserves more supervision than one running two hundred times a day inside your own walls. Ask what happens when this particular output is wrong, and how easily you can undo it.
Internal and reversible, like research notes, meeting summaries, first-pass drafts nobody sends: let it run further than instinct suggests. A wrong meeting summary costs somebody ten minutes.
Reaching a client, or shaping a decision about a person: keep someone on the end however routine it feels. A wrong proposal costs you the client, and a wrong assessment of a person can cost you considerably more than that.
That distinction does more work than any threshold. It’s also what your obligations track: the Tax Practitioners Board’s guidance on AI, issued in July 2026, lands on competence, reasonable care, confidentiality, record-keeping and supervision, and is clear that practitioners remain responsible for the services they provide. The responsibility stays with whoever hands the work over.
What do people get wrong about this?
Three things, and the first costs the most.
That a person approving the output solves the compliance question. It doesn’t. It substantially reduces your operational risk, which is why I recommend it, but the Privacy Act obligation arriving in December 2026 reaches systems that recommend or guide a human decision as well as ones deciding alone. I’ve set out where that sits in whether Australian businesses still need AI governance. Human review is worth having. Just don’t count on a sign-off to take you out of scope.
That autonomy reduces oversight. It moves it. You stop checking each output and start checking the pattern, which is a different skill. In the firms I work with, that job has tended to land on someone more senior, which is why the headcount savings arrive later and smaller than anyone budgeted.
That the risk is mostly about accuracy. Accuracy is the visible part. The quieter exposure is reach: once something acts on your behalf across connected systems, what it can see and touch stops being theoretical. Scope that before you widen what it does.
Where does this leave a small or mid-sized firm?
In a better position than the noise suggests, with a decision to make.
The capability is arriving whether or not you plan for it. Someone in your business will turn it on, probably the person who’s already good at this. Spreading what they know across the team is a separate piece of work.
The useful work is small and it hasn’t changed: pick one job, write down what happens, decide what good looks like, name an owner and choose deliberately how far it runs unsupervised. That used to be the price of entry. Now it’s all that’s left, and it was always the hard part.
You can see what that looks like as an engagement in AI automation. Or tell us about a job you’d like to hand over on a discovery call, and we’ll come back to you on whether it’s ready to run.
FAQ
What is the difference between an AI agent and automation?
Automation follows a fixed script: when this happens, do that. An agent is given a goal, works out the steps itself and can use your connected tools. Because it works in a chain, an early mistake gets carried forward while the process keeps running, which is why agents need different controls.
Are AI agents worth it for a small or mid-sized business?
They’re already available to most, which changes the question. Since May 2026 agent workflows have shipped inside subscriptions many firms already pay for, with approval steps included, though some charge for usage on top. Whether they’re worth using depends on the job: internal and reversible work is a good first candidate, client-facing output isn’t.
Do I need to build anything to use AI agents now?
Usually not. The major platforms ship agent capability into existing subscriptions with permission scoping and an approval gate already in place. What you still have to supply is the judgement about which jobs are safe to delegate and what a wrong output looks like, and no product provides that.
Will AI agents replace staff?
Not in the businesses I work with. They shift the work: less doing, more checking that the pattern is right. In my experience that second job sits with someone more senior than the one it replaced, which is why savings arrive later and smaller than expected.
How much autonomy should we allow?
Judge it on consequence and reversibility. Where the work is internal and a mistake costs someone ten minutes, let it run further than feels comfortable. Where the output reaches a client or shapes a decision about a person, keep someone on the end however routine it seems.
Do AI agents need human oversight?
Yes, but a different kind. You move from reviewing each output to reviewing the pattern: sampling, watching for drift and checking the record when something looks off. That’s a job in its own right, and it needs to belong to someone by name.
General information only, not legal advice. Current as at October 2026: this area is moving quickly and the position may have changed by the time you read it.
