AI Agents for Business: Examples, Use Cases and Where They Break

AI agents for business work best today on narrow, high-volume tasks, with a person or a hard-coded rule in front of anything that moves money or cannot be undone. The public record is thinner than the marketing around it. This article uses only deployments we can attribute to a named source, and as of November 2026 that covers customer support, banking and claims operations, and software work, with two reversals, one tribunal loss and one deleted database among them. For sales, HR and procurement we have no attributable deployment that passed our source check, so those sections describe general scenarios and say so plainly.

Several familiar examples are not agents at all. The table marks them, because the difference decides what you can learn from each one. If the terms need sorting first, see AI agents vs agentic AI.

What the public record contains

Two things stand out. Most of the positive numbers come from the party that benefits from them, and these sources name no independent audit behind any of them. And no row shows an agent releasing money by itself.

Two outside reference points help set expectations. Gartner forecast in June 2025, as reported by Reuters, that more than 40% of agentic AI projects would be cancelled by the end of 2027, citing costs and unclear value. That is a prediction. The nearest thing to a measurement is a benchmark: in TheAgentCompany by Xu et al., the best agent completed about 30% of tasks autonomously in a simulated company. The version we read dates from September 2025, and a benchmark is no guide to production.

The rule behind every “must not do alone” list

OpenAI’s “A practical guide to building agents” (2025) gives two triggers for bringing in a person: the agent exceeds a failure threshold, or the action is high risk. The guide’s wording for the second is actions that are “sensitive, irreversible, or have high stakes”, and its examples are large refunds and payments. We apply that test in each function below, and we would add one condition of our own: the limit belongs in code and in the agent’s credentials. A limit that exists only in the prompt is a request.

Before any of it, ask whether the task needs an agent. Microsoft’s Agent Framework documentation says that if a function can handle the task, you should write the function. Many scenarios below are mostly ordinary code, with one agent step where the path depends on what the system finds.

Customer support

Support has the most public evidence and the most public embarrassment, almost none of it about true agents.

Klarna reported in February 2024 that in its first month the AI assistant handled 2.3 million conversations and two-thirds of service chats, did the work of 700 full-time staff, cut resolution time to under 2 minutes from 11, reduced repeat inquiries by 25% and would add an estimated $40M to profit. All of that is Klarna’s own account of one month. In May 2025 Fortune reported the CEO telling Bloomberg that the company was recruiting again so a human is always available, and that treating cost as the main factor had produced lower quality. A spokesperson said Klarna remained AI-first.

Commonwealth Bank went through the same turn faster. It cut 45 service roles in July 2025 in a move linked to AI, then on 21 August admitted an error and apologised. The union FSU called it a major win. The reporting does not establish what kind of system was involved, so it teaches something about workforce decisions and nothing about agent design.

Air Canada is the legal marker. In Moffatt v. Air Canada (2024 BCCRT 149) the airline was held liable for negligent misrepresentation by its chatbot, and its argument that the bot was a separate entity failed. This is a small-claims decision about a chatbot, read here through McCarthy Tétrault’s summary. Giving the same system tools would hardly reduce the exposure.

As a general scenario, an agent in support reads a ticket, looks up the order and customer history, checks the applicable policy, and either drafts a reply or carries out a low-value action such as creating a return. Where the path is always the same, that is a workflow, and it should be built as one.

Alone, the agent must not grant exceptions to policy, issue large refunds, close complaints or block the route to a person. It breaks in predictable places: it states a policy the documents do not support, it handles the common case well and the angry edge case badly, and its first-month numbers look better than its later ones because the easy volume goes first. That last one is our inference, and Klarna’s reversal is consistent with it without proving it. Measure repeat contacts and complaint rates over months, and keep the human route staffed before you shrink it.

Article 50 of the AI Act has applied since 2 August 2026. Our AI agent development process article covers what that means for customer-facing systems, along with data protection and works council steps.

Sales

We have no attributable deployment for this function that passed our source check, so what follows is a general scenario. No real company stands behind it.

A B2B manufacturer receives enquiries through a web form and a shared inbox. An agent identifies the company, checks the CRM for existing contacts and open opportunities, looks up the product in approved documentation, drafts a reply for the account manager and proposes a CRM update. The path varies with what it finds, which is what justifies an agent.

The account manager sends the reply. Alone, the agent must not quote prices or discounts, commit to delivery dates, make technical claims the documentation does not contain, or start outbound sequences to new contacts. Stale CRM data is the first thing to break it: it will confidently personalise a reply around a contact who left two years ago. The second is its own writes, since an agent updating stages and fields without review can damage the pipeline report that management relies on, and the damage may go unnoticed for a quarter. Inbound email is also untrusted input, so instructions hidden in a message can steer the agent if it holds write permissions.

Some of this needs far less than an agent. Our chat bot for meeting scheduling case is an NLP chatbot, and for a task that narrow a chatbot is the right size.

Finance and claims

Regulated finance has the most careful public deployments, and they share one design choice: a person stays at the money. Our article on AI agents in financial services covers the banks and the regulation in depth, so here is only what a business reader outside banking should take from them.

Allianz is the clearest case. Project Nemo in Australia went live in July 2025 with seven agents on food spoilage claims under AUD 500, and Allianz reports an 80% cut in processing and settlement time. We found no independent audit. The detail worth copying is that a person makes every payout decision, on claims under AUD 500.

Banks show the same caution. CNBC reported in February 2026 that BNY has 134 of what it calls digital employees on narrow repetitive tasks, and its CFO said the headcount decline had nothing to do with AI yet. A recap of Sibos 2026 by the newsletter author R. Beri reports BNY on payment repair (over 10% of issues, which is Microsoft’s figure), BNP Paribas on one trade flow (80 to 85% of the work) and HSBC on document checks, and says no live deployment releases payments unsupervised. That is one source.

For a company outside banking, the nearest general scenario is accounts payable. Invoices that match their purchase order and delivery note need no agent, because a rule handles them. An agent earns its place on the exceptions:

• It works out why an invoice does not match, by reading the order, the delivery note and earlier correspondence.
• It drafts a query to the supplier or a proposed booking.
• An accountant confirms before anything is posted.

Alone, it must not release payments, change supplier bank details or approve anything above a fixed amount. It breaks on retries that would create a duplicate entry, on tolerance rules nobody wrote down, and on supplier emails, because a changed bank account in an inbound message is exactly what an attacker would try to get it to accept. Credit decisions about natural persons are high-risk under Annex III of the AI Act and do not belong on a first-agent list.

HR

Again, no attributable deployment, and the scenario here is general. HR is also the function where we would hold back longest.

The low-risk version is hardly an agent. Staff ask about leave, travel rules or onboarding steps, and a system answers from the current policy documents with references, then opens a ticket when it finds no answer. A private chatbot such as AiSuperiorGPT, which runs on a custom LLM on-premises or in a private cloud and cites its documents, covers that without any autonomy. An agent becomes defensible when the same request crosses systems: an onboarding case that checks whether the laptop, the accounts and the training booking exist, and chases whichever is missing.

Alone, it must not screen, rank or reject candidates, touch pay or contract data, or assess anyone’s performance. The usual breakages are old policy PDFs answered as if they were current, and retrieval that ignores permissions and shows one employee’s salary band to another.

Oversight may also sit somewhere you did not expect. According to a BaFin interview published in July 2026, HR AI falls to the Bundesnetzagentur under the AI Act. The process article linked above covers AI Act classification and works council involvement for German companies. Plan for both before scoping anything that touches employees.

IT and software operations

The most instructive public incident in this function had no attacker in it. In July 2025, Gizmodo reported, a Replit agent deleted a live database during a code freeze, on day 8 of a 30-day project. The database held records on more than 1,200 executives and nearly 1,200 companies. Recovery was at first said to be impossible, and the data was later retrieved. Replit’s CEO called the deletion unacceptable.

Two practical conclusions follow, and both are ours. A code freeze limits an agent only if its credentials enforce the freeze. And no agent’s or tool’s statement about what can be recovered replaces a restore test you have run yourself.

A general scenario for the service desk: an agent reads a ticket, pulls logs and configuration through read-only tools, compares the symptoms with runbooks and past tickets, and proposes a diagnosis and fix for an engineer. Reversible actions from an approved list, such as restarting a named non-production service, can run on their own once the evaluation data supports it. Alone, it must not write to production, delete anything, grant permissions or change monitoring and logging.

It breaks when the runbooks are out of date, when it loops on a failing call, and when it reads something hostile. Workplace assistants have a documented exposure here: EchoLeak (CVE-2025-32711, CVSS 9.3) showed that one crafted email could exfiltrate data from Microsoft 365 Copilot with no user action. It was a vulnerability and not a breach. Aim Labs reported it, it was fixed server-side in May 2025, and Microsoft reported no evidence of exploitation. Our AI agent security article has the threat model and the controls.

Procurement

Once more we have no attributable deployment, so this is a general scenario. A manufacturer’s buyers get purchase requests that may or may not fall under existing framework contracts. An agent checks the request against contracts and catalogues, looks for approved suppliers, collects missing certificates, flags contracts close to expiry and drafts a request for quotation. The value lies in questions that need several lookups across documents, such as which suppliers in one country have contracts expiring before a given date.

Alone, it must not negotiate, award, sign or change supplier master data. We would not put autonomous negotiation on a roadmap at all for now, since a wrong commitment binds the company and there is no way of grading “good negotiation” automatically.

Supplier documents are the weak spot: they arrive from outside, so any of them can carry instructions aimed at the agent. OWASP lists prompt injection as LLM01 in its 2026 LLM Top 10 and agent goal hijack as ASI01 in its Top 10 for Agentic Applications. An agent that reads these files should not hold write access in the same run. The more mundane failures are comparisons across unlike units or payment terms, and contract repositories full of scanned copies and several versions of the same contract. Contract data is also commercially sensitive, so settle hosting location early.

What the reversals have in common

The sample is small, it is not a study, and the systems differ, so what follows is our reading.

Klarna and Commonwealth Bank both moved service work towards AI and then put people back, with Klarna’s CEO naming quality and the bank admitting an error. Air Canada tried to put the blame on the software and lost. Replit relied on a rule its agent could get past. On the other side of the ledger, the deployments with the most careful public descriptions, Allianz and the Sibos cases, keep a person at the point where money moves.

We have no failure rate for either approach. But the pattern is consistent enough to plan around: shrink the human route last, assume the company answers for what the system says, and put limits where the model cannot argue with them.

Choosing a first use case

The scores below are our own judgement on the general scenarios above, from 1 to 5, as a starting point to overwrite with your numbers. They say nothing about any named company. Higher is better, so 5 under “low error cost” means a mistake does little harm.

Two rules override the total. A 1 under “low error cost” or “reversible” rules a task out as a first agent. A 1 under “path varies” means you do not need an agent at all. System access is left out because it depends on your stack, but a task with no API and no test environment is out too.

The top four rows share one trait: a person sees the result before it has consequences, or the tools cannot change anything. You can often move a task up this table by changing its design and leaving the task itself alone. Turning “refunds executed” into “refund proposed, person approves” raises its reversibility and error scores considerably.

The process article mentioned above has the weighted version of this method for a selection workshop, plus the baseline measurement that should come next. If you want outside help producing the shortlist, that is what our AI use case identification work is for.

Why we do not rank the best AI agents for business

A ranking would need comparable measurements, and the sources we rely on contain none. Gartner estimated that about 130 of thousands of agent vendors are genuine and uses the term agent washing for the gap, which is a reason for suspicion and gives you no shortlist.

Test candidates on your own work. Anthropic’s “Demystifying evals for AI agents” (January 2026) suggests starting with 20 to 50 simple tasks drawn from real failures, and keeping a regression set that sits near 100%. Run every candidate on the same tasks, with your documents and in your test systems, and let the results decide. Ask vendors who audited their case-study numbers. For the figures in the table at the top of this article, the sources name no auditor.

Frequently asked questions

What are examples of AI agents in business?

Attributable ones include Allianz’s Project Nemo for small food spoilage claims in Australia and bank deployments in payment repair and document checks reported at Sibos 2026. Klarna’s assistant and Air Canada’s chatbot come up in the same discussions, but neither is presented in the sources as an autonomous agent.

What is a good first AI agent use case?

A high-volume task whose path varies, whose result someone can check, and where a person sees the output before it has consequences. Ticket triage with drafted replies, invoice exception handling with confirmation, and read-only service desk diagnosis all score well on our table.

Which tasks should AI agents not do alone?

Anything sensitive, irreversible or high stakes, in OpenAI’s phrase: releasing payments, large refunds, production changes, deletions, changes to supplier bank details, and decisions about job applicants. Allianz keeps a person on every payout, even on claims under AUD 500.

Are companies liable for what their AI says?

Air Canada was, in a small-claims tribunal decision about its chatbot, and its argument that the bot was a separate entity failed. That is one decision and it is not EU law, so take legal advice on your own exposure. We would still plan on the assumption that the company answers for the system.

Building a first agent with AI Superior

AI Superior is an AI engineering company in Darmstadt, Germany, founded in 2019 by AI scientists. We build LLM applications, chatbots, RAG systems and AI agents for B2B clients. If the scoring above leaves you with a candidate task, our AI agent development services cover the design, evaluation and build, including the permission and approval layers this article keeps returning to.

Sources and further reading

• Klarna: press release on its AI assistant, 27 February 2024.
• Fortune: report on Klarna’s return to human recruiting, 9 May 2025.
• Information Age (ACS): report on the Commonwealth Bank reversal, 2025.
• Moffatt v. Air Canada, 2024 BCCRT 149; McCarthy Tétrault summary, 19 February 2024.
• Allianz: article on Project Nemo, 3 November 2025.
• CNBC: report on BNY’s digital employees, 9 February 2026.
• American Banker: report on Goldman Sachs agents, 13 February 2026.
• The Fintech Times: report on Lloyds Banking Group’s AI value estimate, 5 February 2026.
• Beri, R.: Sibos 2026 recap, 2 October 2026.
• Gizmodo: report on the Replit database deletion, 23 July 2025.
• Reuters via The Star: report on Gartner’s agentic AI forecast, 25 June 2025.
• Xu et al.: “TheAgentCompany”, arXiv 2412.14161, version of September 2025.
• OpenAI: “A practical guide to building agents”, 2025.
• Microsoft: Agent Framework overview, updated October 2026.
• Grace, Hadfield, Olivares, De Jonghe (Anthropic): “Demystifying evals for AI agents”, January 2026.
• OWASP: GenAI LLM Top 10 2026; Top 10 for Agentic Applications for 2026.
• CVE-2025-32711 record; Reddy, Gujral, arXiv 2509.10540; BleepingComputer, 11 June 2025.
• BaFin: interview with Obermöller on the AI Act, 29 July 2026.
• Regulation (EU) 2024/1689 (AI Act), Annex III and Article 50; Regulation (EU) 2026/1744; Cooley, 3 August 2026; NicFab, 24 July 2026.