Where AI agents create value, which processes suit them and how to manage risk, cost and accountability.
In short
AI agents are AI systems that carry out tasks rather than only answer questions: they fetch data, make bounded decisions, call other systems to finish a workflow. They pay off in frequent, rule-based processes with good data and a human decision where stakes are high. Getting to production depends more on data, permissions and ownership than on the model.
AI agents are moving from conference demos into finance, customer service and operations teams. This guide is written by Devies, a Gothenburg-based product and engineering consultancy, for CTOs, data leaders and process owners at Nordic companies who want to know where agentic AI is worth the effort and how to take a pilot all the way into daily operation without losing control of risk or cost.
AI agents vs chatbots: what is the difference?
A chatbot answers a question, while an agent is given a goal and works through the steps needed to reach it, using tools and changing things in other systems.
Take an example. A chatbot can explain your invoice approval policy. An agent can be told "match incoming supplier invoices against purchase orders", and then read the invoice, look up the order in the ERP, compare amounts, flag differences and open a ticket for the right person.
Agentic AI is a way of building AI systems that plan, act and check their own results across several steps. Three things set it apart:
- Tools. The agent can call APIs, databases and internal services, not just generate text.
- Multiple steps. It plans, acts, checks the outcome and decides the next step.
- Room to act. It can change something real: create a ticket, update a record or send a message.
That room to act is both the point and the risk. A chatbot that is wrong gives a poor answer. An agent that is wrong can make a wrong entry in your ERP. Treat an agent as a new kind of colleague with limited system access, not as a new chat feature. The OWASP Top 10 for LLM applications lists "excessive agency" as a distinct risk for exactly this reason.
Which processes suit AI automation?
The processes that suit AI automation best are frequent, digitally fed, rule-guided tasks where errors can be caught before they do real damage and someone in the business owns the result.
The most common mistake with AI for business is to start with the technology and look for a problem afterwards. Start with your processes instead. A good candidate usually has these traits:
- It recurs daily or weekly and takes measurable time today.
- Its inputs are digital and reachable through systems you already have.
- There are rules, or examples of what a correct outcome looks like.
- An error can be spotted and fixed before it has serious consequences.
- A named owner in the business can judge the result.
Typical examples are reconciliations in finance, triage and first assessment of incoming cases, gathering background material for meetings or quotes, and monitoring data where the agent raises an alert and proposes an action when something looks wrong.
Decision table: agent, classic automation or a person?
Characteristic of the process
Best fit
Fixed rules, structured data, no interpretation
Best fit
Classic automation (integration, script, RPA)
Unstructured input (email, PDF, free text) and a clear goal
Best fit
Agent with a review step
Many exceptions but a low cost per error
Best fit
Agent that acts on its own and logs everything
High cost per error, legal or personal impact
Best fit
Agent prepares, a person decides
Unclear what a correct outcome is
Best fit
No agent yet: define the process first
The table makes one point plain: many processes need no agent at all. When the rules are fixed, an ordinary integration is cheaper, faster and easier to debug.
Guardrails: how do you control risk and accountability?
An agent in production needs the same controls as a new employee with system access, plus logging, quality measurement and a fast way to switch it off.
- Least privilege. Give the agent its own scoped accounts. Read access where that is enough, write access only where the process needs it.
- Human approval at thresholds. Decide in advance which actions always need a human yes, such as amounts above a limit or contact with a customer.
- Full logging. Every step, tool call and decision should be traceable afterwards. Without logs you cannot debug or explain an outcome.
- Quality measurement. Compare results against a known answer or against samples a person reviews. Measure the error rate, not just speed.
- Clear ownership. A named person in the business owns the process and the agent's results. IT owns the platform, not the outcome.
- Compliance. Personal data falls under the GDPR. Under the EU AI Act (AI-förordningen), people interacting directly with an AI system generally have to be told so. As of October 2026, the European Commission's AI Act overview states that these transparency rules apply from August 2026. An agent used in areas such as recruitment or credit scoring can count as high-risk under Regulation (EU) 2024/1689, with far heavier requirements. Our planned guide to what the EU AI Act means for your company covers this in depth.
What does an AI agent cost to run?
The cost of an agent has three parts, data and integrations, usage per run, and ongoing maintenance, and the model itself is rarely the largest.
- Data and integrations. An agent is only as good as the data it can reach. If customer, order and finance data sit in separate systems with different definitions, much of the budget goes on fixing that. The work also pays off in reporting and in later AI projects.
- Usage per run. Language models are usually billed by the amount of text sent in and out. Agents make many calls per task, so the cost per case can be higher than expected. Measure it early in the pilot and set a ceiling.
- Maintenance. Models get replaced, systems change and processes evolve. Someone has to watch quality, update instructions and handle exceptions.
A sound business case therefore compares the total cost per handled case, including human review, with what the same case costs today.
From pilot to production in five steps
The reliable path from pilot to production is to pick one measurable process, secure its data, run the agent in shadow mode on real data, widen its autonomy gradually and hand it over with monitoring in place.
Many AI pilots look great in a demo but never reach production. Usually the pilot ran on hand-picked data without real permissions. Work like this instead:
- Pick one process and one metric. One process, one owner and one measurable goal, for example halving handling time for a specific case type.
- Secure the data. Map which systems the agent needs, what the data looks like and who owns it. Fix the worst gaps before you build.
- Run the pilot on real data in shadow mode. Let the agent work alongside people without acting on its own, and compare outcomes over a few weeks.
- Widen its autonomy step by step. Start with the agent proposing and a person approving. Grant more independence once the error rate is known and acceptable.
- Hand over to operations with follow-up. Monitoring, alerts, cost ceilings, logs and a plan for who does what when something breaks. Only then is the agent truly in production.
Checklist before go-live
- [ ] Named process owner and a measurable goal
- [ ] Agent has its own accounts with least privilege
- [ ] Defined thresholds for human approval
- [ ] Logging of every step and tool call
- [ ] Measured error rate from shadow mode
- [ ] Cost per case measured and a ceiling set
- [ ] Documented assessment against the GDPR and the EU AI Act
- [ ] A routine for switching the agent off quickly
For a structured way to think about these controls over time, the NIST AI Risk Management Framework is a useful, freely available reference.
Keep reading
From our work
Client Case: Stena LineStena Line modernised its Azure data platform - improving Power BI reliability, reducing pipeline runtimes and scaling with medallion architecture.Read the caseDevies
Want a second opinion?
Devies, a Gothenburg-based product and engineering consultancy, works on questions like this with Nordic product and IT teams. Tell us where you are and we will suggest a sensible first step.
Frequently asked questions
Do we need a data platform before we start with AI agents?
Not for a first pilot, but often yes for production at scale. An agent that makes decisions needs reliable and consistent data. If the same term means different things in different systems, for example "customer" or "order value", the agent's output will be just as unreliable. Many companies therefore run a pilot on one well-defined data source while building a shared data foundation in parallel for the next agents.
What does the EU AI Act require for AI agents?
It depends on what the agent is used for. Most internal automation workflows carry no specific obligations beyond taking measures to support AI literacy among staff. Agents that interact directly with people must disclose that they are AI under the transparency rules, which apply from August 2026. Agents used in high-risk areas such as recruitment or credit scoring face extensive requirements on risk management, logging and human oversight.
How long does it take to go from pilot to production?
It depends mainly on the state of your data and how many systems the agent must reach. A narrow process with clean, accessible data moves much faster than one that first needs new integrations and data clean-up. Plan for a shadow-mode period of a few weeks before the agent acts on its own, and budget time for monitoring, alerts and handover to the team that will run it.
What is the difference between AI agents and RPA?
RPA (robotic process automation) follows fixed, scripted steps on structured data and breaks when screens or rules change. An agent can interpret unstructured input such as emails and PDFs, choose its next step and call several tools to reach a goal. The trade-off is predictability: RPA does exactly what it was told, while an agent needs guardrails, logging and quality measurement because its behaviour can vary between runs.
