The complete guide to AI agents in enterprise operations

This guide is for operations leaders, finance and procurement heads, service desk owners and the IT teams who will be asked to support them. You have probably been pitched “agents” by three vendors this quarter, each meaning something different. The goal here is to give you enough vocabulary, architecture and cost math to decide whether an agent belongs in your operation at all, which kind, and what the first one should do.

We take a position. Agents are useful in operations, but in a narrower band than the marketing suggests. They earn their keep on high-volume work with messy inputs, where a wrong step can be caught and undone, and where a named person still owns the cases the agent cannot close. Outside that band, a plain workflow or a well-tuned RPA bot is cheaper and easier to defend.

The governance chapter discusses standards and regulation. It is a comparison and explanation, not legal advice, and not a substitute for a qualified assessor or counsel.

Summary

• An agent is an LLM that decides its own next step and calls tools to act; a workflow follows a path you wrote in advance.
• The strongest operations use cases today are IT and HR service desks, support triage, document-heavy finance work and procurement intake.
• Agents are a poor fit where actions are irreversible, rules are already stable, or the decision is regulated as high-risk.
• Platform pricing is metered per action, credit or conversation, so cost scales with how many steps an agent takes, not with headcount.
• Security risk comes mostly from what the agent is allowed to touch: prompt injection plus broad permissions is the core failure mode.
• Pick a first use case with a countable baseline, a reversible action and a clear human owner for exceptions.
• Most failed agent projects die from unclear value and weak controls, not from model quality.

1. What an AI agent is, and what it is not

The word “agent” is now attached to everything from FAQ bots to scheduled scripts. The most useful definitions come from model builders.

Anthropic, in its engineering guidance, separates two kinds of “agentic systems”. Workflows are systems where LLMs (large language models) and tools are orchestrated through predefined code paths. Agents are systems where the LLM dynamically directs its own process and tool use, keeping control over how it accomplishes the task.¹1 Source: Anthropic, “Building effective agents”, accessed Oct 2026. Published December 19, 2024. The difference is who chooses the path: your code, or the model.

That one distinction sorts most of what you will be sold.

Robotic process automation (RPA)

RPA uses software robots to automate repetitive, rule-based tasks by mimicking human actions on screens and systems, according to UiPath, one of the largest vendors in the category.²2 Source: UiPath, “What is Robotic Process Automation”, accessed Oct 2026. UiPath sells RPA; the definition is the vendor’s own. An RPA bot clicks the same buttons in the same order every time. It is fast and auditable, and it breaks when the screen changes or the input does not match the rule.

Workflow automation

Tools in this category (Zapier, n8n, Power Automate, Workato and similar) connect APIs with triggers, conditions and actions that a person designs. Many now let you drop an LLM call into a step, for example “summarize this email” or “classify this ticket”. That is still a workflow in Anthropic’s sense: the model fills in a step, but the path is fixed.

Chatbots

A chatbot answers questions in a conversation. A chatbot that only answers, and never changes anything in another system, is not an agent, however fluent it is.

Side by side

Approach	Who decides the next step	Handles unstructured input	Typical failure	Best fit
RPA	Script written by a developer	Poorly	Breaks on UI or format change	Stable, rule-based screen work
Workflow automation	Path designed in a builder	Only in LLM-filled steps	Unhandled branch or edge case	Predictable multi-system handoffs
Chatbot	Conversation script or retrieval	Yes, for answers	Wrong or ungrounded answer	Answering questions, deflection
AI agent	The model, within allowed tools	Yes	Wrong action taken with confidence	Variable cases needing judgment and action

The practical reading: an agent is worth its extra cost and risk only when the next step genuinely depends on what is in the case. If you can draw the flowchart, build the flowchart.

For how agents fit with the rest of a company’s systems, see the complete guide to building a B2B revenue stack.

2. Where agents work in operations today, and where they don’t

Adoption is real but concentrated. McKinsey’s 2026 State of AI survey found that 40 percent of respondents at large organizations (over $1 billion in annual revenue) report scaling AI agents, up from 27 percent the year before, while respondents at smaller organizations held flat at 22 percent.³3 Source: McKinsey, “The State of AI: Global Survey 2026”, accessed Oct 2026. Survey figures are self-reported by respondents. The functions where respondents most often report scaling agents are IT, knowledge management and software engineering.³

Scale has not yet turned into profit for most. The same 2026 survey reports that only 6 percent of respondents at large companies say AI generates at least 5 percent of EBIT.³

Where they work

IT and HR service desks. Password resets, access requests, “how do I” questions, onboarding checklists. The inputs are messy text, the knowledge base exists, and most actions (open a ticket, grant a standard role, route to a queue) are reversible. This is where survey data shows the most scaling.³

Support triage. Reading inbound tickets, classifying intent and urgency, pulling account context, drafting a reply for a human to send, routing. The closest thing to hard evidence here predates agents: an NBER study of 5,179 customer support agents found that a generative AI assistant raised issues resolved per hour by about 14 percent on average, and by about 34 percent for novice and low-skilled workers, with minimal effect on the most experienced.⁴4 Source: NBER, “Generative AI at Work” (Working Paper 31161), Brynjolfsson, Li and Raymond, accessed Oct 2026. Issued April 2023, revised November 2023. That was an assistant suggesting text to humans, not an autonomous agent.

Finance and procurement operations. Turning free-text purchase requests into requisitions, invoice exception handling in accounts payable (AP), matching remittances to open items, chasing missing purchase-order (PO) numbers, drafting vendor queries. The documents are variable, the systems of record (ERP) enforce the final posting, and a human approves payment.

Document processing. Extracting fields from contracts, claims, onboarding packs and certificates, then flagging what does not match.

Where they don’t

• Irreversible or high-value actions without review. Releasing payments, terminating contracts, changing bank details. Keep a human approval step, always.
• Stable, rule-based processes. If the rule never changes, RPA or a workflow does it cheaper and more predictably.
• Decisions about people that regulators classify as high-risk. Under the EU AI Act, systems used for recruitment and selection, or for decisions affecting promotion, termination, task allocation and performance monitoring, are listed as high-risk in Annex III, as are systems evaluating individuals’ creditworthiness.⁵5 Source: EU AI Act, Annex III: High-Risk AI Systems, accessed Oct 2026. Fraud-detection systems are excluded from the creditworthiness item. An “HR agent” that screens candidates is a different compliance project from one that answers benefits questions.
• Processes with no owner. If nobody is accountable for the exception queue today, an agent will make that queue bigger and quieter.

Contract work is covered separately in the complete guide to AI contract review.

3. How an agent is built: the architecture in plain terms

Every agent, bought or built, has the same parts.

The model

The LLM does the reasoning: reading the input, deciding what to do, writing outputs. Anthropic describes the basic building block as an “augmented LLM”, a model enhanced with retrieval, tools and memory.¹

Tools

Tools are the functions the agent is allowed to call: look up a vendor in the ERP, create a ticket, send an email, query a database. The tool list is the agent’s real job description. An agent with read-only tools can be wrong; an agent with write tools can be wrong and act on it.

Memory and context

Short-term memory is the conversation and working notes for the current case. Long-term memory is anything persisted between cases: past resolutions, user preferences, retrieved documents. Retrieval-augmented generation (RAG) is the common pattern for pulling relevant policy or knowledge-base text into the model’s context at run time.

Orchestration

Orchestration is the loop that runs the agent: call the model, execute the tool it chose, feed the result back, repeat until done or stopped. It also enforces limits such as maximum steps, timeouts and budget caps. In multi-agent setups an orchestrator routes work between specialist agents.

Human-in-the-loop

Human-in-the-loop (HITL) means defined points where a person must approve, edit or take over. Good designs set these by action type (any payment, any external email, any access above a standard role) rather than by the model’s own confidence, which is not a reliable signal.

Tool protocols: MCP

Connecting an agent to every system used to mean custom integration code per model and per tool. The Model Context Protocol (MCP) is an open-source standard for connecting AI applications to external systems such as data sources, tools and workflows; its documentation compares it to a USB-C port for AI applications.⁶6 Source: Model Context Protocol, “What is the Model Context Protocol (MCP)?”, accessed Oct 2026. Anthropic donated MCP to the Agentic AI Foundation, a fund under the Linux Foundation co-founded with Block and OpenAI, announced in December 2025; the Linux Foundation cited more than 10,000 published MCP servers at the time.⁷7 Source: Linux Foundation, “Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF)”, accessed Oct 2026.

For an operations buyer, MCP support matters for two reasons. It lowers the cost of connecting a new system, and it creates a new supply chain to vet: every MCP server you connect is code that can read or act on your data.

4. Build vs buy: the three real options

There are three ways to put an agent into operations. Most organizations end up with more than one.

Agent platforms from major vendors. Salesforce Agentforce, Microsoft Copilot Studio, ServiceNow’s AI agents, and similar offerings from Google and AWS. You get prebuilt connectors to that vendor’s systems, admin controls and a metered bill. Best when the process lives mostly inside one vendor’s estate.

Workflow tools with agent features. Zapier, n8n, Make, Power Automate and others have added agent or AI-agent nodes. n8n, for example, lists agents, MCP and AI nodes on all its plans, with agents labelled as a preview.⁸8 Source: n8n, “Pricing”, accessed Oct 2026. List prices in euros, billed annually; the Business tier is self-hosted only. Best for teams that already automate in these tools and want an LLM step or a bounded agent inside a known flow.

Custom builds on model APIs. Your engineers call a model API directly (Anthropic, OpenAI, Google and others) and write the orchestration, tools and controls themselves, sometimes on managed infrastructure such as AWS Bedrock AgentCore. Best when the process spans many systems, needs unusual controls, or is core enough to own.

Option	Example pricing model (list, as of October 2026)	Strengths	Weaknesses	Not for
Vendor agent platform	Agentforce: Flex Credits at $500 per 100,000 credits, a standard action is 20 credits; or $2 per conversation99 Source: Salesforce, “Agentforce Pricing”, accessed Oct 2026. Per-action figure derived from $500 per 100,000 credits and 20 credits per standard action. Salesforce says pricing may change.	Native data access, admin and security controls, fast start	Metered costs hard to forecast, lock-in to one estate	Processes that mostly live outside that vendor
Vendor agent platform	Copilot Studio: $200 per pack of 25,000 Copilot Credits per month; an agent action is 5 credits1010 Source: Microsoft Learn, “Billing rates and management - Microsoft Copilot Studio”, accessed Oct 2026. 1111 Source: Microsoft, “Copilot Studio pricing” and Microsoft, “Copilot Studio Licensing Guidance”, accessed Oct 2026. The $0.01 pay-as-you-go rate is from Microsoft’s licensing guidance.	Fits Microsoft 365 tenants, included usage for some licensed users	Many meters (answers, actions, grounding, tools)	Teams without Power Platform admin skills
Workflow tool with agents	n8n: from €20/month (2,500 executions) to €667/month (40,000 executions), billed annually, priced per workflow execution8	Cheap, visible logic, self-host option on higher tiers	Agent features newer, governance is on you	Regulated processes needing vendor-grade audit
Custom build on model APIs	Per-token model pricing plus infrastructure, e.g. AgentCore runtime from $0.0895 per vCPU-hour1212 Source: AWS, “Amazon Bedrock AgentCore Pricing”, accessed Oct 2026. Runtime v1 microVM rate shown; other tiers differ.	Full control of tools, data and guardrails	Needs engineering, evaluation and on-call ownership	Teams with no engineers to own it after launch

The vendor hype problem

Gartner warned in June 2025 that many vendors were engaged in “agent washing”, rebranding assistants, RPA and chatbots as agents, and estimated that only about 130 of the thousands of agentic AI vendors were real.¹³13 Source: Gartner, “Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027”, accessed Oct 2026. Press release dated June 25, 2025. Ask any vendor to show you where the model chooses the next step and what tools it can call. If the answer is a fixed flow, you are buying a workflow, which may be fine, at a workflow price.

5. What agents cost

There are two layers of cost: the model, and whatever platform or infrastructure runs it. Then there is the cost nobody puts on the pricing page: the people who own it.

Model pricing (token-based)

Model APIs charge per million tokens (a token is roughly a word fragment), with output tokens priced higher than input. List prices as of October 2026:

Model (provider)	Input per 1M tokens	Output per 1M tokens
Claude Opus 5.5 (Anthropic)	$4.00	$20.00
Claude Sonnet 5.5 (Anthropic)	$2.00	$10.00
Claude Haiku 5.5, prompts up to 100K tokens (Anthropic)	$0.10	$0.50
GPT-5.5 (OpenAI)	$5.00	$30.00
GPT-5.4-mini (OpenAI)	$0.75	$4.50
Gemini 3.1 Pro Preview, prompts up to 200K tokens (Google)	$2.00	$12.00

Sources: Anthropic,¹⁴14 Source: Anthropic, “Pricing”, accessed Oct 2026. Haiku 5.5 prompts over 100K tokens are billed at $0.50 input and $2.50 output. OpenAI¹⁵15 Source: OpenAI, “API Pricing”, accessed Oct 2026. Standard tier, short-context rates. and Google¹⁶16 Source: Google, “Gemini Developer API pricing”, accessed Oct 2026. Prompts over 200K tokens on Gemini 3.1 Pro Preview cost $4.00 input and $18.00 output. pricing pages. All three offer batch processing at half the standard price for work that does not need an immediate answer, and Anthropic and Google list cheaper rates for cached input.¹⁴¹⁶

Agents use far more tokens than a single chat reply, because every loop re-sends context: instructions, tool definitions, retrieved documents and the history of the case so far. A purely illustrative example, with assumptions you should replace with your own measurements: an AP exception case that consumes 20,000 input tokens and 2,000 output tokens across its steps would cost about $0.06 in model fees on Claude Sonnet 5.5 at list price ($0.04 input plus $0.02 output). At 10,000 cases a month that is about $600. Model choice per step (a small model for classification, a larger one for judgment) is the biggest cost lever you control.

Platform pricing models

Platforms meter usage in their own units:

• Per action or credit. Agentforce Flex Credits work out to roughly $0.10 per standard action at list price.⁹ Copilot Studio’s pay-as-you-go meter is $0.01 per Copilot Credit, billed in arrears.¹¹ Microsoft’s own documentation gives an order-processing agent making four action calls per order as 20 credits, about $0.20 at that rate.¹⁰
• Per conversation. Agentforce also offers $2 per conversation.⁹
• Per user. Agentforce add-ons for Sales, Service and Field Service list at $125 per user per month.⁹ Microsoft 365 Copilot lists at $30 per user per month, and Microsoft says employee-facing Copilot Studio agents used by licensed users under their own identity are included at no charge, within fair-use limits.¹⁷17 Source: Microsoft, “Copilot Studio pricing”, accessed Oct 2026. Microsoft 365 Copilot price shown as per user per month, paid yearly. ¹⁰
• Per infrastructure unit. AWS AgentCore bills runtime by vCPU-hour and GB-hour and its gateway at $0.005 per 1,000 API invocations, which AWS describes as consumption-based with no minimum fees.¹²

Also watch overage behavior. Microsoft’s documentation says that on prepaid capacity, custom agents are disabled once a tenant reaches 125 percent of its prepaid Copilot Credits, unless pay-as-you-go is set up.¹⁰ An agent that switches off mid-month is an operations incident, so decide in advance whether you prefer a surprise bill or a stopped process.

The cost that isn’t metered

Someone must own prompts, tools, evaluations, incidents and the exception queue. Budget part of a person’s time per production agent, even on a bought platform.

6. Governance, security and risk

Agents combine two old risks: software that can be manipulated through its inputs, and staff with too many permissions. Three references are worth knowing.

NIST AI Risk Management Framework

The US National Institute of Standards and Technology released the AI RMF 1.0 on January 26, 2023, for voluntary use. It is organized around four functions: Govern, Map, Measure and Manage. NIST added a Generative AI Profile (NIST AI 600-1) on July 26, 2024, and says the framework is being revised.¹⁸18 Source: NIST, “AI Risk Management Framework”, accessed Oct 2026. Use it as a checklist: who owns this agent, what can it affect, how do we test it, what happens when it fails.

OWASP Top 10 for LLM applications and for agentic applications

OWASP’s 2025 list for LLM applications starts with prompt injection (LLM01) and includes sensitive information disclosure (LLM02), supply chain (LLM03), excessive agency (LLM06) and unbounded consumption (LLM10).¹⁹19 Source: OWASP Gen AI Security Project, “Top 10 for LLM Applications 2025”, accessed Oct 2026. In December 2025 OWASP published a separate Top 10 for Agentic Applications, led by agent goal hijack (ASI01), tool misuse (ASI02) and identity and privilege abuse (ASI03), and also covering memory and context poisoning, cascading failures and rogue agents.²⁰20 Source: OWASP Gen AI Security Project, “OWASP Top 10 for Agentic Applications”, accessed Oct 2026. Announced December 9, 2025.

In operations terms: an agent that reads supplier emails can be fed instructions inside a supplier email. If that same agent can change bank details, you have built a payment-fraud channel. The controls are unglamorous:

• Give each agent its own identity and the narrowest permissions that do the job.
• Separate read tools from write tools, and gate write tools on high-impact actions behind human approval.
• Treat all retrieved content (emails, PDFs, web pages) as untrusted input.
• Log every tool call, and set step, time and spend limits per run.
• Vet every connector and MCP server as you would any third-party code.

EU AI Act timelines

If you operate in or sell into the EU, the AI Act sets dates you need to plan around. The Act entered into force on 1 August 2024. Prohibitions and AI literacy requirements applied from 2 February 2025, and rules for general-purpose AI models from 2 August 2025.²¹21 Source: artificialintelligenceact.eu, “Implementation Timeline”, accessed Oct 2026. A reference site maintained by the Future of Life Institute; check the Official Journal for authoritative text. Most remaining provisions applied from 2 August 2026.²¹

The high-risk obligations moved. The Council of the EU gave final approval on 29 June 2026 to an amending “omnibus” regulation that postpones the high-risk rules originally due on 2 August 2026: to 2 December 2027 for stand-alone high-risk systems (the Annex III list, which includes employment and creditworthiness uses) and to 2 August 2028 for high-risk AI embedded in regulated products.²²22 Source: Council of the EU, “Artificial Intelligence: Council gives final green light to simplify and streamline rules”, accessed Oct 2026. ⁵ Most back-office agents (invoice matching, ticket triage, document extraction) will not be high-risk by default. HR agents that screen, rank or evaluate people may well be. Confirm classification with counsel.

Gartner has also warned that governance itself can fail: in May 2026 it predicted that by 2027, 40 percent of enterprises will demote or decommission autonomous AI agents because of governance gaps, and argued against applying one uniform governance model to every agent.²³23 Source: Gartner, “Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure”, accessed Oct 2026. Tier your controls by what each agent can touch.

Agents that touch customer data also widen what a security test should cover; see the complete guide to penetration testing for SaaS companies.

7. Picking a first use case and measuring ROI

The first agent sets the internal story. Choose it for learnability, not ambition.

A scoring checklist

Score candidate processes on each line. Favor the ones that hit most of them.

1. Volume. Hundreds or thousands of cases a month, so savings are visible and evaluation data accumulates.
2. Messy input. Free text, varied documents or judgment calls that rules handle badly. If rules handle it well, use rules.
3. Reversible actions. Mistakes can be caught and undone before they reach a customer, supplier or bank.
4. A countable baseline. You already measure handle time, backlog, first-contact resolution or cost per case.
5. A named exception owner. A person or team who will work the cases the agent escalates.
6. Contained systems. Two or three systems to integrate, not ten.
7. Low regulatory exposure. Not a high-risk category under the EU AI Act or sector rules.

Service desk tickets and AP exceptions usually score well; candidate screening and payment release do not.

Measuring ROI

Define the measures before the pilot, and run the agent against a holdout or a pre-period baseline.

• Containment or automation rate: share of cases closed with no human touch, and share closed with a human approving the agent’s draft. Report both.
• Quality: error rate on a sampled audit of closed cases, and rework or reopen rate.
• Speed: cycle time from case open to close.
• Unit cost: model and platform cost per case, plus human time per case, compared with the baseline cost per case.
• Escalation load: how many cases land on the exception owner, and whether they are harder than before.

ROI is then (baseline cost per case minus new all-in cost per case) times volume, minus fixed build and ownership costs. Count only hours you will actually redeploy or not hire for. Gartner predicted in June 2025 that 50 percent of organizations will abandon plans to reduce their customer service workforce due to AI,²⁴24 Source: Gartner, “Gartner Predicts 50% of Organizations Will Abandon Plans to Reduce Customer Service Workforce Due to AI”, accessed Oct 2026. which is a reason to frame the case around capacity and backlog, not layoffs.

8. Rollout plan and common mistakes

A sequence that works for most operations teams, stated as general guidance:

Weeks 1 to 2: frame. Pick the use case with the checklist above. Write down the baseline metrics, the allowed tools, the actions that always need approval, and the exception owner.

Weeks 3 to 6: shadow mode. The agent processes real cases but takes no actions. It produces a proposed resolution that a human compares with what they actually did. Build an evaluation set from these cases, including the ugly ones.

Weeks 7 to 10: assisted mode. The agent drafts and a human approves every action. Track approval rate, edit rate and errors by case type. Switch off case types that underperform.

Weeks 11 onward: bounded autonomy. Let the agent act alone on the case types and actions where assisted-mode error rates met your bar. Keep approval gates on everything high-impact. Review sampled cases weekly, and re-run the evaluation set whenever you change the model, prompt or tools.

Ongoing: operate it like a system. Monitoring, spend alerts, an incident runbook, a named owner and a quarterly review against the original business case. Gartner’s warning that over 40 percent of agentic AI projects will be canceled by the end of 2027 pointed to escalating costs, unclear business value and inadequate risk controls,¹³ all things this cadence is meant to catch early.

Common mistakes

• Buying an agent for a flowchart problem. If the path is fixed, a workflow is cheaper, faster and easier to audit.¹
• Granting broad write access “for the pilot”. Pilot permissions have a way of becoming production permissions. Start read-only.
• Trusting model confidence as an approval gate. Gate by action type and value instead.
• Ignoring per-step pricing. A prompt change that adds two tool calls per case can raise the monthly bill noticeably on action-metered platforms.⁹¹⁰
• Skipping evaluation on model upgrades. A model swap changes production behavior and needs a regression run.
• Treating HR and credit use cases like any other. These may be high-risk under the EU AI Act, with obligations from December 2027.²²⁵

9. The verdict

Agents are a real operations tool now, best used as a narrow, supervised workforce for high-volume, text-heavy cases. They are not a replacement for process design, and they do not fix processes that nobody owns. Start with a service desk or AP exception queue, buy if the work lives inside one vendor’s estate, build if it spans many systems and you have engineers to own it, and keep a human on every irreversible action.

Frequently asked questions

What is the difference between an AI agent and RPA?

RPA bots follow fixed rules and mimic clicks and keystrokes on screens, which makes them reliable on stable processes and brittle when inputs or screens change.² An AI agent uses an LLM to decide its next step and call tools, so it can handle varied inputs, but it can also take a wrong action with confidence.

Is a chatbot an AI agent?

Not unless it acts. A chatbot that only answers questions, even with generated answers, does not change anything in other systems. Once it can call tools to create tickets, update records or trigger workflows on its own judgment, it becomes an agent and needs agent-level controls.

How much does an AI agent cost to run?

It depends on steps per case, model choice and platform. As of October 2026 at list price, model fees for a moderate case can be a few cents, while vendor platforms meter about $0.05 per agent action on Copilot Studio pay-as-you-go and about $0.10 per standard action on Agentforce Flex Credits.¹⁰¹¹⁹ Measure real cases in shadow mode before budgeting.

Should we build or buy?

Buy when the process lives mostly inside one vendor’s systems and you want admin controls out of the box. Build on model APIs when the process spans many systems, needs custom controls, or is strategic enough to own, and only if you have engineers who will run it after launch.

What is MCP and do we need it?

The Model Context Protocol is an open standard for connecting AI applications to data sources, tools and workflows.⁶ Platform support for it is a fair proxy for how easily an agent connects to your other systems. Treat each MCP server as third-party code that needs security review.

Does the EU AI Act apply to our back-office agents?

Possibly, but most back-office uses such as invoice matching or ticket triage are not listed as high-risk. Uses in recruitment, decisions about workers and individual creditworthiness are listed in Annex III, with stand-alone high-risk obligations now due from 2 December 2027.⁵²² AI literacy obligations have applied since February 2025.²¹ Get a classification from counsel; this guide is not legal advice.

Sources and notes

1. Source: Anthropic, “Building effective agents”, accessed Oct 2026. Published December 19, 2024. ↩ ↩² ↩³ ↩⁴

2. Source: UiPath, “What is Robotic Process Automation”, accessed Oct 2026. UiPath sells RPA; the definition is the vendor’s own. ↩ ↩²

3. Source: McKinsey, “The State of AI: Global Survey 2026”, accessed Oct 2026. Survey figures are self-reported by respondents. ↩ ↩² ↩³ ↩⁴

4. Source: NBER, “Generative AI at Work” (Working Paper 31161), Brynjolfsson, Li and Raymond, accessed Oct 2026. Issued April 2023, revised November 2023. ↩

5. Source: EU AI Act, Annex III: High-Risk AI Systems, accessed Oct 2026. Fraud-detection systems are excluded from the creditworthiness item. ↩ ↩² ↩³ ↩⁴

6. Source: Model Context Protocol, “What is the Model Context Protocol (MCP)?”, accessed Oct 2026. ↩ ↩²

7. Source: Linux Foundation, “Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF)”, accessed Oct 2026. ↩

8. Source: n8n, “Pricing”, accessed Oct 2026. List prices in euros, billed annually; the Business tier is self-hosted only. ↩ ↩²

9. Source: Salesforce, “Agentforce Pricing”, accessed Oct 2026. Per-action figure derived from $500 per 100,000 credits and 20 credits per standard action. Salesforce says pricing may change. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

10. Source: Microsoft Learn, “Billing rates and management - Microsoft Copilot Studio”, accessed Oct 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

11. Source: Microsoft, “Copilot Studio pricing” and Microsoft, “Copilot Studio Licensing Guidance”, accessed Oct 2026. The $0.01 pay-as-you-go rate is from Microsoft’s licensing guidance. ↩ ↩² ↩³

12. Source: AWS, “Amazon Bedrock AgentCore Pricing”, accessed Oct 2026. Runtime v1 microVM rate shown; other tiers differ. ↩ ↩²

13. Source: Gartner, “Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027”, accessed Oct 2026. Press release dated June 25, 2025. ↩ ↩² ↩³

14. Source: Anthropic, “Pricing”, accessed Oct 2026. Haiku 5.5 prompts over 100K tokens are billed at $0.50 input and $2.50 output. ↩ ↩²

15. Source: OpenAI, “API Pricing”, accessed Oct 2026. Standard tier, short-context rates. ↩

16. Source: Google, “Gemini Developer API pricing”, accessed Oct 2026. Prompts over 200K tokens on Gemini 3.1 Pro Preview cost $4.00 input and $18.00 output. ↩ ↩²

17. Source: Microsoft, “Copilot Studio pricing”, accessed Oct 2026. Microsoft 365 Copilot price shown as per user per month, paid yearly. ↩

18. Source: NIST, “AI Risk Management Framework”, accessed Oct 2026. ↩

19. Source: OWASP Gen AI Security Project, “Top 10 for LLM Applications 2025”, accessed Oct 2026. ↩ ↩²

20. Source: OWASP Gen AI Security Project, “OWASP Top 10 for Agentic Applications”, accessed Oct 2026. Announced December 9, 2025. ↩ ↩²

21. Source: artificialintelligenceact.eu, “Implementation Timeline”, accessed Oct 2026. A reference site maintained by the Future of Life Institute; check the Official Journal for authoritative text. ↩ ↩² ↩³

22. Source: Council of the EU, “Artificial Intelligence: Council gives final green light to simplify and streamline rules”, accessed Oct 2026. ↩ ↩² ↩³

23. Source: Gartner, “Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure”, accessed Oct 2026. ↩

24. Source: Gartner, “Gartner Predicts 50% of Organizations Will Abandon Plans to Reduce Customer Service Workforce Due to AI”, accessed Oct 2026. ↩