AI agents: Business impact and costs
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 7
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
The business process at risk
Agent-assisted refunds, purchasing, customer messages, data exports and operational changes.
An agent can perform a technically permitted action that is commercially wrong. Repeated refunds, unintended exports or incorrect promises can accumulate before staff notice a plausible-looking explanation.
Build an estimate from your own operation
Estimate interruption, investigation, recovery and continuing control costs separately. Use a range and state the assumptions. Avoid adding overlapping losses twice: an order delayed and later fulfilled is different from an order permanently lost. The report does not assign a universal dollar loss or a probability of breach.
- Interruption: affected transactions or staff hours × your measured contribution or cost, adjusted for work recovered later.
- Response: internal hours, specialist support, clean capacity and supplier coordination actually required.
- Recovery: rebuilding, validation, transaction reconciliation and customer support during the transition.
- Continuing operation: ownership, maintenance, access review and recovery testing after normal service returns.
Decisions for the operating team
- Identify refund, purchasing and customer-promise thresholds requiring human approval.
- Review a sample of agent exceptions with the service owner and adjust the workflow.
- Appoint a business owner for each consequential agent workflow.
A scenario to rehearse
Illustrative exercise, not an observed customer incident: A support agent can draft a refund explanation and also call the refund API. The exercise tests whether a persuasive conversation can cause payment without the separate approval required by the business.
Evidence before accepting the cost
A signed autonomy policy and a business case that includes oversight and recovery costs.
Compare immediate continuity work with longer-term architecture changes. Migration can reduce specific maintenance responsibilities, but it cannot replace investigation of an active compromise. Evaluate the controls and retained responsibilities of the proposed operating model, including recovery and exit.
Decision checkpoint
Who remains responsible when an agent performs a permitted action with a bad business outcome?