AI Agents for Business:What They Do, What They Cost, How to Start

As of May 3, 2026, about one in five American businesses used AI in any business function. The exact rate was 19.8%. The number comes from the U.S. Census Bureau, in its report on the business survey.

I start with that number because most talk about AI agents for business starts with a demo, a vendor or a headline. One in five is a better place to start.

The rate also changes with company size. Between December 2025 and May 2026, AI use increased at firms with 20 or more employees. It did not change significantly at smaller firms. At firms with 250 or more employees, 37% reported that they use AI. At firms with four or fewer employees, the rate was below 20%.

If you run a company of 10, 40 or 150 people, you are not late. You want to know what an agent does for you, what it costs and how to start. This guide answers those three questions.

I am Chris Machetto. I run Frenchy Digital, and we build agents for clients. That gives me a commercial interest, so I do three things in this guide. I show the arithmetic. I give the source of each number. I tell you where our own offer is the wrong choice.

This is the order. First, what an agent is. Second, how many businesses use AI. Third, what agents do in each department. Then how to know if a task fits, what an agent costs, what fails first and the rules that apply now. The guide ends with a plan for your first 30 days.

The clearest definition that I know is one sentence from the OpenAI guide for product teams.

Agents are systems that independently accomplish tasks on your behalf.

OpenAI, A practical guide to building agents

The same guide says what is not an agent. An application can use a language model and not let the model control the work. That application is not an agent. The guide gives simple chatbots, single-turn models and sentiment classifiers as examples.

Anthropic uses a different division, and I find it more useful for the scope of a project. In Building effective agents, Anthropic calls the full group agentic systems and divides it in two. In workflows, models and tools are "orchestrated through predefined code paths". In agents, the model directs its own process and decides which tools to use.

Compare three ways to do the same task. A chatbot answers one question and stops. A workflow moves the task through the same fixed steps each time. An agent gets a goal, then selects the steps and the tools.

The access is the important part. The tools and the data that an agent can use define it more than the model does.

OpenAI describes an agent as three parts. The first part is a model that reasons. The second part is a set of tools that read or change data in other systems. The third part is the instructions that control its behavior. When a vendor sells you an agent, ask about those three parts.

Most owners think that an agent is a digital employee. You hire the agent in place of a person, and the payroll cost decreases. That belief is reasonable, because vendors advertise the products that way.

Klarna gave the best-known example. In February 2024 the company announced results for the first month of its AI assistant. The assistant handled 2.3 million conversations, which was two-thirds of its customer service chats. Klarna said that the assistant was "doing the equivalent work of 700 full-time agents". It estimated a profit improvement of $40 million for the year. These figures are from the press release of the company.

About 14 months later, the chief executive said something different. Entrepreneur reported in May 2025 what Sebastian Siemiatkowski told Bloomberg. He said that the cheaper chatbots gave lower quality. He said that the company recruited human support staff again. His words: "Really, investing in the quality of human support is the way of the future for us."

I do not read that result as a failure of the technology. The assistant answered those chats. I read it as a failure of the unit of measurement. Klarna counted the agent in jobs. A job includes work that is not an answer: judgment, exceptions and the upset customer who wants a person.

The correct idea is smaller. An agent takes tasks, not jobs. Give the agent a narrow task, only the access that the task needs, and a supervisor.

With that scope, an agent can do very good work. When an agent replaces a full department, the Klarna result is the risk. The company hires people again.

Five numbers describe 2026 better than a forecast. They all show the same pattern: many trials, less scale and little proof of value at this time.

The Gartner rows come from three press releases: the survey on AI scale, the CIO survey and the infrastructure and operations survey. The McKinsey row is from the FM Magazine report on the annual survey of the firm.

Subtract the numbers in the last row. If 28% fully succeed and 20% fail, the other 52% are between the two. Those projects give some value, but less than the promised value. That is about half. I expect that result from a new type of software. It is very different from the claims of the optimists and the pessimists.

Be careful with the scope of these numbers. The 28% from Gartner is about AI in IT infrastructure and operations, and 782 leaders in that function reported it. It is not a failure rate for all AI projects, and it is not specifically about agents. The McKinsey row has the same limit. It describes companies with revenue of $1 billion or more, and your company is probably smaller.

There are three numbers that I do not use. Many articles say that 95% of GenAI pilots fail, that 85% of AI projects fail, or that 87% never reach production. Writers repeat all three, but none has a reliable source. The first number comes from 52 interviews and 153 conference surveys about custom tools. We refuse all three, and I give the reasons in the build versus buy framework. Be careful with a vendor who quotes them.

This is my conclusion from the real numbers. Experiments are normal and scale is rare. The cause of the difference is mostly management, not models.

The CIO survey from Gartner supports that conclusion. Some organizations had written guidelines for when a pilot must not move to production. Those organizations were 2.3 times more likely to be in the top group. Only 31% of CIOs said that they had such guidelines. Alicia Mullery, the analyst who presented the results, said it in four words: "Volume is not value."

This is the map that I use. For each department it shows a task for an agent, the necessary connections and the part that a person keeps. None of these is a forecast. Each one fits the definition above: a clear goal, tools in reach and a person who owns the result.

Most small businesses start with the first two rows, for a simple reason. The volume is high, the questions repeat, and the systems usually have an API. I list ten specific first tasks in 10 AI agents every small business can deploy.

Be most careful with the HR row, and the last column gives the reason. New York City started to enforce Local Law 144 on July 5, 2023. An employer cannot use an automated tool to screen candidates unless three conditions are true. The tool had a bias audit in the past year. Information about the audit is public. The employer gave notice to the candidates.

An agent that schedules interviews is outside that law. An agent that ranks applicants is inside it.

The IT row has a warning from the infrastructure survey by Gartner. Its respondents reported the most failures in three areas: auto-remediation, self-healing infrastructure and agents that manage workflows across systems without help. In these tasks, an agent acts alone on live systems that are not predictable. Keep the words "for review" in that row.

Finance looks attractive because the work is repetitive. An agent is a good fit for the work to match documents and to request the missing ones. It is not a good fit for approval. An agent that prepares the payment run saves most of the hours. An agent that releases the payment saves a few more minutes and adds a risk. The risk is larger than the value of those minutes.

I recommend this map as the first step, before a vendor gives a price. If your company is in New York, our team for AI agent development in New York can make the map with your departments. If you prefer to see a finished agent first, the agents that we sell as products show their prices.

The OpenAI guide gives three signs that a workflow is a good fit for an agent. The first sign is judgment on exceptions, and its example is the approval of a refund. The second sign is rules that are too complex to maintain, such as vendor security reviews. The third sign is unstructured material, such as the documents in a home insurance claim.

If a task shows none of the three signs, the guide says that "a deterministic solution may suffice". That means standard software: a form and a rule.

Anthropic gives the same advice. It recommends "finding the simplest solution possible" and more complexity only when necessary. It says that this "might mean not building agentic systems at all". I think that is the most useful sentence from the two companies on this subject. It comes from a company that sells the models.

Those are the tests of the builders. These are the five questions that I ask as an owner. The thresholds are my own estimates, not statistics.

1. 1.Does the task occur frequently?: Below about 100 times a month, the time that you save rarely pays for the project. You also do not have enough examples for a test.
2. 2.Can you write down a good result?: If two of your people disagree on the correct answer, you cannot grade an agent.
3. 3.Can software reach each step?: If one step is in the memory of a person or on paper, the agent stops there. A person then completes the task.
4. 4.Can you reverse a mistake?: You can delete a draft email. You cannot recall 4,000 sent emails. Start with work that you can reverse.
5. 5.Does a person own the task?: A person must read the errors each week. If no person will do that, do not start.

Together, the questions show the difference between a good first agent and a bad first agent.

The last row has a name. A test of an agent against past examples is an evaluation. With an evaluation, you know that the agent works. I explain the setup in AI agent evaluation and observability.

There are three ways to get an agent, and each one bills in a different unit. Budgets fail when owners mix the units. Each price below is a list price that I read on the page of the vendor on November 9, 2026.

Owners frequently overestimate the cost of the model. Assume that one support conversation uses about 20,000 input tokens and 2,000 output tokens. That is a scenario for the arithmetic, not a measurement of your traffic. The table shows the cost at the published prices of Anthropic and OpenAI.

Calculate the Sonnet row by hand. 20,000 input tokens at $2 for each million cost $0.04. 2,000 output tokens at $10 for each million cost $0.02. The total is six cents.

Read the last column. On the most expensive model in the two lists, the conversation costs about 30 cents. On the cheapest models, the cost is almost zero. Model usage almost never makes an agent expensive. The project, the integrations and the supervisor make it expensive.

When is it cheaper to own an agent than to rent one? Use our price. $40,000 in year one and $30,000 in each of the next two years is $100,000 for three years. That is about $2,778 a month. Fin charges $0.99 for each outcome.

Subtract about ten cents of usage that you pay directly. The usage is six cents a conversation, and some conversations do not end as resolved. Each resolved conversation that you own thus saves about $0.89. $2,778 divided by $0.89 is about 3,100 resolved conversations a month.

Below that number, the packaged agent costs less. Most small businesses are below that number. For that reason, I tell most of them to buy the packaged agent first.

A custom agent is worth its price for other reasons. The agent must write into your own systems. It must follow a rule that the settings of a vendor cannot express. Or you must own the code and the data. I explain each reason in custom AI agent versus off-the-shelf SaaS.

Five failures occur frequently enough that you must plan for them. For each one, the table shows how you see it and what limits the damage.

A legal decision supports the first row. Moffatt v. Air Canada is a 2024 decision of the Civil Resolution Tribunal of British Columbia. The chatbot on the airline website told a customer that he could claim a bereavement fare after travel. A different page on the same site said that he could not. The WeirFoulds account of the case says that Air Canada suggested that the chatbot was a separate legal entity, responsible for its own actions.

The tribunal did not accept that argument. The analysis by Barry Sookman reproduces the passage that writers quote most: "It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot."

It is a small-claims decision from one Canadian province, so it does not bind other courts. I think that most courts and regulators will start from the same position. What your agent tells a customer, you told that customer.

The second row also has a well-known example. In July 2025, Fortune reported the account of a user of the Replit platform. A coding agent deleted a live database during a code freeze. The chief executive of Replit answered in public: "Unacceptable and should never be possible". He promised to separate development databases and production databases automatically.

I do not conclude that the model was careless. I conclude that the agent had access to production, and that access was the error.

The third row has no complete solution. OWASP is a security organization, and much of the industry uses its lists. It puts prompt injection first on its Top 10 for LLM applications. The same list includes excessive agency, which is an agent with more permissions than its task needs. OWASP published a separate list for agentic applications in December 2025.

No one has a full solution for prompt injection. You can limit the damage. Decide what the agent can do after it reads content that you do not control. I list the first controls that I recommend in AI agent security: 10 controls before you connect your data.

I can show the fourth row from our own work, and the example is not favorable to us. On one of our projects, two email configuration errors stopped signup emails and password-reset emails for eleven days. No one saw the problem, because sign-in with Google continued to work. Nothing crashed. The product was worse, and no one knew. We wrote an incident report and added the monitoring that now finds this failure.

The last row seems too simple to occur. But the Gartner survey on AI scale found that about 11% of organizations were "entirely unaware" of the AI spend of their function in 2025.

Complete this table before a developer writes code. It has three columns and takes about an hour. It prevents most of the arguments that occur in month three.

The middle column gives the most value. The agent prepares the work and puts it in a queue, then a person approves it. I call this method prepare and queue. It gives most of the saved time with a small part of the risk. An agent may prepare a payment batch and put it in the queue. A person with authority must release it.

The right column must have no surprises. Some teams debate if the agent can make a decision to hire or delete live data. The answer is no. That debate shows that a vendor sold them the digital employee idea.

One more point about the left column. Actions move into it with time, and they must move one at a time. An action that a person approved 200 times in sequence with no change is a good candidate. An action that a person corrects one time in ten is not.

I am not a lawyer and this is not legal advice. It is the list that I give to your lawyer to make the conversation short.

• United States, federal.: No single statute governs business agents, but existing law applies. On September 25, 2024, the FTC announced five enforcement actions with the name Operation AI Comply. FTC Chair Lina M. Khan said that the actions make clear that there is "no AI exemption from the laws on the books". If your agent makes a claim, it is your claim.
• European Union.: The ban on prohibited practices in the AI Act started to apply on February 2, 2025. The transparency duties started to apply on August 2, 2026. One duty is to tell people when they deal with an AI system. An amending regulation entered into force on July 27, 2026. It moved the obligations for stand-alone high-risk systems from August 2, 2026 to December 2, 2027.
• Colorado.: SB 26-189, signed on May 14, 2026, replaces the 2024 AI Act of the state. It takes effect on January 1, 2027, unless a pending court challenge delays it. The law applies when automated decision-making technology materially influences a decision in areas such as employment, lending, insurance, education or healthcare. The business that uses the technology must give notice before the decision. After an adverse outcome, it must give an explanation and an opportunity for human review.
• California.: The Office of Administrative Law approved the regulations of the privacy agency on automated decision-making technology in September 2025. The regulations took effect on January 1, 2026. Law firms that track them say that the decision-making requirements start on January 1, 2027.
• New York City.: The city started to enforce Local Law 144 on July 5, 2023. The law applies before an employer uses an automated tool to screen candidates or employees. It requires a bias audit in the past year, public information about the audit and notice to those people.

The federal statement is from the FTC announcement, and the Davis Polk note on it quotes the same statement. The European dates are from the K&L Gates note on the amending regulation and the Gibson Dunn summary of the agreement. The Colorado details are from DLA Piper and Davis Wright Tremaine. The California details are from the regulations page of the privacy agency.

All five show the same pattern. When a system decides more about a person, you owe that person more: a notice, an explanation and a human.

Agents that answer questions and move documents have the fewest duties. Agents that screen, score or deny have the most duties. That is one more reason to keep those tasks in the right column of the table above.

The agent project that I can show in public is Beyond Points, a travel product for people with loyalty points. The goal was an assistant that finds the best way to book a trip with points, and then books the trip.

Two details from that project apply to all businesses. First, the conversation layer has thirteen tools, from award search to transfer math. With those tools, the chat looks up a fare and does not guess it. Second, the part that moves real points is behind an explicit confirmation step. Transfers, bookings, payments and cancellations never run until the user says yes.

That is the middle column of the table, built into the product.

I will not quote one large result number from that project. The case study says what we verified and what we did not verify. An audit on the project found 112 timing claims in the product, and 83 of them had no label. We examined each one, so that the interface says only what the logs support. I prefer that you read that audit, not a number that I selected to impress you.

Now a scenario. The inputs are invented but plausible, so that you can replace them with your own. Consider a home services company with 25 people that gets about 900 customer messages a month. Assume that 60% of them are the same twelve questions: hours, prices, a new appointment time and the location of the technician.

• Conversations that an agent can possibly take: 900 times 60% is 540 a month.
• With a packaged agent at the list price of Fin: 540 times $0.99 is about $535 a month, plus seats.
• With a custom agent at our prices: $100,000 for three years is about $2,778 a month, plus usage.
• At this volume, the packaged agent costs about one fifth as much.

I tell that owner to buy the packaged agent. The difference is large.

Three conditions can change my answer. The first is a new appointment time that must go into a dispatch system, when the packaged agent cannot reach that system. The second is price rules that are too specific for a settings page. The third is volume above about 3,100 a month, which is almost six times 540. Volume alone will not bring most companies to that number. The first two conditions possibly will.

This is my plan for the first month. Its purpose is a low cost before you know if the idea works.

1. 1.Week 1: select one task, not a department.: Use the five questions. Complete the three columns. Name the person who owns the task.
2. 2.Week 1: collect your examples.: Get 100 to 200 real past cases of that task. Write down the correct result for each one. This hour has the most value, and it is useful even if you build nothing.
3. 3.Week 2: try the cheapest route first.: If software that you pay for now has an agent, switch it on in draft mode. In draft mode, the agent proposes and a person sends.
4. 4.Week 3: grade the agent.: Run it against your examples. Decide the pass mark before you see the score.
5. 5.Week 4: launch on a small part.: Use one channel, business hours only and a daily cost limit. Write a rule for when to switch it off.
6. 6.Day 30: decide.: Keep it, extend it or stop. A stop is a valid result, and it costs little at this point.

The stop rule in week 4 is not pessimism. The CIO survey from Gartner connects that habit to results, and fewer than a third of the CIOs had it.

One name is not in the plan: ours. If the packaged route passes your test, you do not need an agency. You need an agency when the agent must reach a system that the packaged product cannot reach. You also need one when the test continues to fail for reasons that a settings page cannot correct.

You can buy a product or hire a builder, and that includes us. In both cases, these signs tell me not to buy.

• An accuracy, resolution or ROI percentage with no method. In this market, the seller publishes each such figure. Ask for the sample, the period and the definition of success.
• The words "it replaces staff". See the Klarna example above.
• No clear answer to two questions: what can it change in our systems, and how do we reverse a change?
• No test set. If the vendor cannot show how it grades the agent before each change, no one grades it.
• A price before the vendor asks what the agent must read and write.
• Data terms that are not clear. Ask who can see your conversations, if they train a model and how you export them. Each answer must be one sentence.
• Security badges that the vendor cannot prove. Ask for the report, not the logo.
• A contract with no exit: no source code, no data export, no end date.

On the seventh point, this is our own position, because I ask the same of other vendors. Frenchy Digital signs business associate agreements with healthcare clients. We hold no SOC 2 or ISO 27001 attestation. If your procurement process requires one, a vendor that has it will pass and we will not. You must know that before the first call, not after.

This is what I did not verify, or decided not to use as evidence.

• The McKinsey figures come from the FM Magazine report on the survey. The McKinsey page did not load for me, so I did not read the original.
• The landing page of the Stanford 2026 AI Index says that organizational adoption reached 88%. The page does not define the term, so I did not use the number.
• Each price is a list price that I read on November 9, 2026. Vendors discount, bundle and change prices.
• The Colorado date of January 1, 2027 depends on litigation that I cannot predict. The California date of 2027 for the decision-making requirements comes from law firm summaries, not from the page of the agency.
• The OWASP site shows its 2025 list as current, but some security firms describe a 2026 edition with a different order. I cited only what is true in both.
• I read the Air Canada decision through the analyses of two lawyers, because the court database blocks automated access. For that reason, I did not include the damages figure.
• Our public evidence is one agent case study. That is a small sample, and I tried not to argue from it.
• The token scenario and the home services scenario are arithmetic on assumed inputs, not measurements.

1. 1.List the ten questions or requests that your team answers most. Count how many times each one came in last month. That is your candidate list.
2. 2.For the first item on the list, complete the three columns: may act alone, needs approval, must never touch.
3. 3.Check if software that you pay for now has an agent with a draft mode. If it has one, that is your pilot, and it costs you one afternoon.

If you complete those three tasks and want a second opinion on the table, book a discovery call with us. If the packaged agent fits, I will tell you.

Start with the count.