Introducing AI agents at work: a practical playbook

Most companies do not start with a strategy for AI agents. They start with one team trying a tool, then another, until nobody is sure which agents exist, what they are allowed to do or who checks them. This playbook sets out a simpler order: decide who owns each agent, write down its job, review its work, keep records, and be open with the people it deals with.

The short answer: treat each AI agent like a new role in the organization. Give it a named human owner, a written job with clear limits, a review step matched to the risk, and logs you can check later. Tell staff how to work with it and tell customers when they are dealing with AI. Start small and widen what the agent may do only after it proves itself on real work.

Step 1: Name the roles

The US NIST AI Risk Management Framework puts governance first and calls for roles, responsibilities and lines of communication about AI risks to be documented and clear to individuals and teams across the organization. It also expects executive leadership to take responsibility for decisions about AI risks (NIST AI RMF 1.0, GOVERN 2.1 and 2.3).

In practice, every agent needs at least three roles filled:

• Owner: answers for what the agent does, approves changes to its job and can pause or stop it.
• Reviewers: the people who check its output in daily work, usually the team whose work it does.
• A senior sponsor: decides how much risk the company accepts for this use and settles disputes.

One person can hold more than one role in a small company. What matters is that the names are written down.

Step 2: Write a job for each agent

A short written job, often a single page, prevents most problems. It should state:

• Purpose: the one thing the agent is for.
• Inputs: what data and systems it may read.
• Allowed actions: what it may do alone, what needs approval, and what it may never do.
• Quality bar: what a good result looks like and how it will be checked.
• Escalation: when it must stop and hand over to a person.
• Owner and review date: who is responsible and when the job will be looked at again.

This matches NIST's call for policies that define and differentiate roles and responsibilities for human and AI setups and for oversight of AI systems (GOVERN 3.2).

Step 3: Match review to risk

Not every output needs a person to read it first. Use more review where mistakes are hard to undo or affect people's money, health, jobs or rights, and less where work is reversible and easy to check. Our guide to human in the loop and accountability covers how to place each task.

If a use falls under the EU AI Act's high-risk category, review is not optional. Deployers must assign human oversight to people with the necessary competence, training and authority, and the support to do it (EU AI Act, Article 26). Those people must be able to understand the system's limits, interpret its output, override it and stop it (Article 14).

Step 4: Keep logs

When something goes wrong, the first question is what the agent was asked, what it saw and what it did. Without records, nobody can answer. Log inputs, actions and approvals for every agent, and keep them long enough to investigate problems.

For high-risk systems the EU AI Act sets a floor: deployers must keep the logs the system generates, where they control them, for at least six months unless other law says otherwise. They must also monitor the system, suspend use if risks emerge and report serious incidents (Article 26).

NIST adds that someone must have the assigned responsibility and the means to supersede, disengage or deactivate an AI system whose performance or outcomes do not match its intended use (MANAGE 2.4).

Step 5: Tell people they are dealing with AI

Customers, applicants and the public should know when they are talking to an AI system or reading AI-generated content. Under the EU AI Act's transparency rules, which apply from 2 August 2026 (for generative AI systems placed on the market before that date, the marking duty in Article 50(2) applies from 2 December 2026 under Regulation (EU) 2026/1744) (EU AI Act, Article 50):

• AI systems meant to interact directly with people must be designed so those people are told they are dealing with AI, unless it is obvious to a reasonably well-informed person.
• Synthetic audio, image, video and text produced by AI systems must be marked in a machine-readable way as artificially generated.
• Organizations that use AI to create deepfakes must disclose it, and so must those publishing AI-generated text to inform the public on matters of public interest, unless the text has gone through human review and someone holds editorial responsibility for it.
• The information must be clear and given at the latest at the first interaction or exposure.

Even where the law does not require it, a plain line such as "This reply was drafted by our AI assistant and checked by our team" builds more trust than silence.

Step 6: Train the people who work with agents

Since 2 February 2025, providers and deployers of any AI system covered by the EU AI Act must take measures to support AI literacy among staff who operate and use it, taking into account their experience and the context of use (EU AI Act, Article 4). Good training is practical: what this agent is good and bad at, how to check its output, when not to trust it and how to raise a problem.

Step 7: Start small, then widen

1. Pick one well-defined task with clear success criteria.
2. Run the agent alongside the current process and compare results.
3. Measure its error rate on your own work.
4. Widen what it may do alone only when the numbers support it.
5. Review the written job on its set date, and after any incident.

A launch checklist

• Named owner, reviewers and sponsor.
• Written job with allowed, approval-needed and forbidden actions.
• Review level set by risk.
• Logs switched on and kept.
• A tested way to pause or stop the agent.
• Disclosure to customers where they interact with it.
• Training for the staff who use it, in working time where it is required; see who pays for AI training.

In the EU, check whether you must inform and consult employee representatives first; see consulting employees before an AI rollout. If the work is going to an outside vendor rather than an in-house agent, staff may transfer with it; see outsourcing work to AI vendors.