AI agents for business: uses and how to implement

An AI agent is a system that takes a goal, decides which steps to take and carries them out using tools: it looks up data, calls APIs, updates records or drafts documents. Unlike a chatbot, an agent doesn’t just answer. It acts on your systems. That is why it can save a lot of work, and also why it needs clear limits.

This guide covers what an agent is, which business use cases make sense, how agents are built, what the GDPR and the EU AI Act require, and how to get started without taking unnecessary risks.

AI agent vs chatbot vs traditional automation

The three terms are often used interchangeably, but they are different things:

A practical rule: if a process can be described with fixed rules, use traditional automation. It is cheaper and more predictable. Agents add value when you need to interpret free text, combine information from several systems or choose between options.

AI agent use cases for business

These B2B cases suit an agent because they combine reading information, querying systems and taking a specific action:

• Second-line customer support. The agent reads the request, pulls the customer’s history from the CRM, checks the order status and drafts a reply for a person to review.
• Email and ticket triage. It identifies the request type, priority and customer, and creates the task in the right system.
• Expense and supplier invoice processing. It extracts data from a PDF receipt or invoice, proposes the entry in the expense system and flags anything unclear for review.
• Quote preparation. It gathers requirements from an email or meeting notes and drafts a quote using your product catalogue and price list.
• Internal questions on company documentation. It answers staff questions using your procedures, contracts and manuals, and cites the source.
• Operational reports. It queries several systems and writes a weekly summary of sales, incidents or workload.

What we have built at LCApps

These are the kinds of AI projects we have already delivered:

• Multichannel chatbots for web, WhatsApp, SMS and Telegram. They query live business data (for example, calendar availability) and take actions such as booking an appointment or notifying the customer.
• Callbots: voice agents that answer phone calls. They turn speech into text, decide with an LLM and reply with synthetic speech; every call is logged and callers hear a data protection notice at the start.
• Audio transcription: a service that turns voice recordings into text asynchronously and notifies the requesting system when it is done.
• RAG over documents: a service that processes documents, indexes them in a vector database and returns the relevant passages for each question. It powers chatbots that answer from company documentation.
• Document data extraction: we process documents with AI, extract the information relevant to each case file and enter it directly into that file.
• AI automations that process messages, forms or documents and create records, tasks or notifications in other systems.
• MCP servers that connect AI assistants to a business management system. More on this below, using our own CRM as the example.

We design and run all of these projects in line with the GDPR and the EU AI Act, to protect the data of our clients and of the people they interact with. We explain what each regulation requires further down.

“ChatGPT for business” is not the same as an agent

Many companies start with the business edition of a general-purpose assistant (ChatGPT, Claude, Gemini or Copilot). That is a good first step for drafting, summarising and analysing documents. But the assistant doesn’t know your data or work inside your systems until you connect it to them. That connection step is what turns an assistant into an agent that is useful for your business.

Typical AI agent architecture

A business AI agent almost always has four parts:

1. A language model (LLM). It interprets the request, plans the steps and generates text. It can be a commercial model accessed through an API or a model hosted by the company.
2. Tools. Functions the agent can call: find a customer, create a task, check an order, send an email. Each tool is an API to one of your systems, with defined permissions.
3. Your own data. To answer with company information, the agent retrieves the relevant documents at query time. This is called RAG (retrieval-augmented generation): the model doesn’t “learn” your data, it looks it up when needed.
4. Human oversight. Actions with real impact (sending something to a customer, issuing an invoice, deleting data) need a person’s approval. The system logs what the agent did and why.

An agent’s quality depends more on its tools and data than on the model. An excellent model with poorly designed tools or messy data gives poor results.

MCP: connecting agents to company systems

The Model Context Protocol (MCP) is an open standard for connecting AI applications to external systems: data sources, tools and workflows. Its official documentation compares it to a USB-C port for AI applications (modelcontextprotocol.io). Assistants such as Claude and ChatGPT and developer tools such as Visual Studio Code and Cursor support it.

The business benefit is practical: you build an MCP server for your system once and any compatible assistant can use it, with the permissions you define. You don’t need a separate integration for every AI tool.

We have taken this route with our own CRM. We built an MCP server that lets an AI assistant look up and work with customers, tasks, invoices and expenses, always within the permissions of the user running it. The main lesson: the real work is designing the tools well, meaning what the agent can do, what data it can see and which actions require confirmation.

If your company runs its own system, building its MCP server is a custom software development project like any other integration: it needs analysis, permissions, testing and maintenance.

Risks and governance: GDPR and the EU AI Act

An agent that handles customer or employee data is subject to the same rules as any other system, plus some AI-specific obligations.

GDPR

• Lawful basis and data minimisation. The agent should only access the personal data it needs for its task.
• Processors. If you use a model from an external provider, that provider processes data on your behalf. You need a contract under Article 28 of the GDPR and should check where the data is processed.
• Automated decisions. Article 22 of the GDPR gives people the right not to be subject to decisions based solely on automated processing that significantly affect them. That is one more reason to keep human review for decisions about customers or employees.

EU AI Act

Regulation (EU) 2024/1689 applies in phases. According to the European Commission, and after the 2026 amendment known as the “AI Omnibus” (in force since 27 July 2026), the timeline is:

For most internal agents, what matters today is:

• AI literacy: train the people who use or oversee the agent.
• Transparency: if the agent talks to people, they must know they are dealing with AI.
• Use-case classification: if the agent is involved in hiring, employee evaluation or credit decisions, it may be a high-risk system with far heavier obligations. Check before you start.

Technical risks

• Model errors: an LLM can give a wrong answer with full confidence. Validate critical data.
• Excessive permissions: give the agent only the tools it needs, read-only where possible.
• Malicious instructions hidden in data: an email or document can contain text designed to manipulate the agent. Sensitive actions need human confirmation.
• Traceability: log every action the agent takes so it can be audited.

How to implement AI in your company: start with a focused pilot

The most common mistake is starting with the technology. Start with a process.

1. Pick one specific process. Look for a repetitive, high-volume task that takes up skilled people’s time and whose output can be reviewed. For example, triaging requests that reach the support inbox.
2. Measure the current state. Time per task, monthly volume, error rate. Without this baseline you can’t prove the result.
3. Define the agent’s scope. Which systems it queries, which actions it can take and which need approval.
4. Review data and regulation. Which personal data it handles, which model provider you use and whether the use case could be high-risk.
5. Build a pilot over a few weeks with a small group of users and human oversight on every action.
6. Measure with business metrics:
   • Time saved per task.
   • Share of agent proposals accepted without changes.
   • Errors caught in review.
   • Cost per task (model usage and infrastructure).
   • Internal user satisfaction.
7. Decide with data: scale up, adjust or drop it. Dropping a cheap pilot is a good outcome too.

If the agent needs integrations with your systems, the cost works like any development project. We explain it in how much custom software costs.

FAQ

Do I need to train my own model?

Almost never. Most business cases are solved with an existing model, well-designed tools and RAG over your documents. Training your own model is expensive and only makes sense in very specific cases.

Will my data be used to train the provider’s model?

It depends on the provider and the contract. Check the terms of the business edition or API before sending customer data.

Does an agent replace a person?

In the cases that work well, the agent removes the repetitive part of the task and a person reviews and decides. You get the time savings without losing control.

Conclusion

An AI agent adds value when it works on your data and your systems, with limited permissions and human oversight. Start with one specific process, measure before and after, and treat the integration as a serious software project.

At LCApps we build custom AI projects: agents, chatbots, callbots, document data extraction and MCP servers connected to the systems you already use. Tell us which process you want to improve and we will help you design a realistic pilot.