AI agents for SMEs: what they do, what they don't and who oversees them

What an AI agent is in a small company

An AI agent is a system that does work inside a process: it reads a request, looks up the data it needs, drafts a reply or a document, records it and tells the person who has to approve it. A chatbot answers questions. An agent leaves the work ready for a person to review.

In a small company you notice it in the tasks that take up the first hours of the day: sorting client email, passing invoices to the accounts or chasing replies that have not come. Dividing those tasks between agents and people is what we call company hybridisation with AI.

What AI agents for SMEs do

An agent works well when the task repeats, follows rules someone can explain and an error can be put right without harm. These are the jobs most often given to one in a small company:

• Sales: it finds companies that match your ideal client, drafts the first message and tells you when they reply. This is how the Legathum platform works, with a person reviewing each message before it is sent.
• Customer service: it sorts each request and drafts the reply using the company's rules.
• Administration: it organises incoming invoices and leaves the drafts ready for the accounts.
• Management: it prepares reports from data that already exists and flags what falls outside the plan.

In all four cases the agent prepares and a person confirms.

An example: client email at an accountancy practice

Take an example made up for this article, though a very ordinary one: an accountancy practice of twelve people that receives its clients' invoices by email. Today, two people sort them by hand at the start of the week.

With an agent, the work is divided like this. The agent reads each email, separates the invoices from everything else, sorts them using the practice's rules and prepares a list of what is missing. If an invoice arrives without a tax number, it does not sort it: it sets it aside and drafts the message asking the client for it. One of the two people reviews the list, approves the messages and deals with the cases the agent has set aside.

The tax number rule was written by the person who does that job today, which is why the result looks like what the practice would do without the agent.

What they don't do

Some work should not be left to an agent on its own, however well it writes:

• Deciding about people: hiring, promoting, moving someone to another role or ending a contract. The agent can organise the information, and the decision is taken by a person in the company.
• Taking decisions with legal effects on someone without a person being involved. Article 22 of the GDPR protects people from decisions based solely on automated processing.
• Applying judgement nobody has written down. If the answer to «how do you decide» is «it depends», the agent will answer with whatever seems plausible.
• Negotiating, closing a deal or answering to the client for the result.
• Changing its own rules. A new rule comes in when a person approves it.

What the agent does and what the person does, area by area

This table sums up the division of work in a small services company. Use it as a starting point for writing your own:

The right-hand column is not delegated. If that column is empty in any process, a checkpoint is missing.

Who oversees an AI agent

An agent is overseen by the owner of the process: a named person who knows how it should work, reviews what the agent prepares and can correct it or stop it. In a small company that is usually whoever used to do the task or whoever runs the area.

The EU AI Act describes well what that person needs. For high-risk uses, Article 26 requires human oversight to be assigned to people with the necessary competence, training and authority. Article 14 adds that the system must allow those people to understand its capabilities and limitations, to disregard or reverse its output and to interrupt it safely.

Those obligations concern the high-risk uses listed in Annex III, such as shortlisting candidates, and apply from 2 December 2027. They also work as a pattern for any other agent: competence, training, authority and a way to stop it. In practice, the oversight of each agent fits in four lines:

• Who reviews: a named person, and a deputy for when they are away.
• What they review: everything at first, and later whatever the rules mark as sensitive.
• When: before the result leaves the company.
• What happens if they disagree: they correct it, note the reason and, if it happens again, change the rule.

A checkpoint without an owner checks nothing. An owner with no time to review is no better: oversight goes into their working day as one more task.

What to ask for before an agent goes live

Before an agent touches a real process, check that it has these six things:

1. Written rules. At Legathum they live in a Book of Criteria: rules in plain language, with versions, that a person reviews and approves.
2. Limited permissions. The agent can reach only the data and the tools its task needs.
3. An audit trail. Each decision is recorded with the rule that was applied, so it can be reviewed later.
4. An AI notice. If the agent talks to clients, they must be told they are dealing with an AI, unless it is obvious. Article 50 of the EU AI Act applies from 2 August 2026.
5. Training. Article 4 of the same regulation asks for measures so that staff know how to work with the systems they use.
6. A baseline. If you do not know how long the process takes today and which errors it has, you will not be able to say whether the agent has helped. We explain it in how to measure a process before automating it.

Where a small company starts

With one agent in one process. Choosing it well matters more than choosing the technology, and there is a way to score the candidates in which processes to automate with AI first.

In the Legathum AI-First Hybridisation Method, that first process comes out of the diagnosis, and during implementation the first result in production arrives within 2 days, measured against the baseline. After that, one new process is added per cycle. The full work, area by area, is that of the AI-First hybridisation consultancy.

When every area works this way, the company is an AI-first company: one that decides, process by process, what agents do and what people do.

The legal references in this article are EU law. Other jurisdictions have their own rules.

Keep reading

• What is company hybridisation with AI?
• Which processes to automate with AI first (and which not to)
• How to measure a process before automating it: the baseline nobody takes