You will have seen the phrase everywhere this year: "AI agents". Anthropic has launched an always-on agent, OpenAI's latest model can click through apps on your behalf, and every software firm seems to be bolting an "agent" onto its product. This guide explains, in plain English, what an AI agent actually is, how it differs from the chatbot you already know, where it can go wrong, and what UK rules say about it.
What an AI agent is
A chatbot answers a question. An agent is given a goal and then works out the steps itself. The ICO, the UK's data protection regulator, describes agentic AI as systems that can behave autonomously to achieve their objectives, combining a large language model, which supplies the reasoning, with software that lets it act. The House of Commons Library puts it more simply: agentic AI goes further than other AI by making autonomous decisions and taking actions without being prompted at each step.
In practice, ask a chatbot to help you plan a trip and you get a list of suggestions. Ask an agent and it may search timetables, compare prices, fill in a booking form and put the result in your diary, stopping to check with you at whatever points you have allowed.
The four parts that make an agent
Most agents, whatever the brand, are built from the same pieces.
First, a model: the language model that reads instructions and decides what to do next. Second, tools: the things it is allowed to touch, such as a web browser, your email, a spreadsheet, a company database or a payment system. Third, memory: some record of what it has already done and what you have told it, so it can carry on across a long task. Fourth, a loop: the agent acts, looks at the result, and decides again, repeating until it thinks the job is done or it gets stuck.
The ICO makes a point that matters for everyone buying or using these systems: the specific design of an agentic system, meaning the data and tools it can reach and the controls placed around it, has a big effect on how the law applies and on how much risk you take on. The same underlying model can be a harmless note-taker or a risky one, depending on what you let it do.
Agent, assistant, automation: what's the difference?
An automation, such as a rule that moves invoices into a folder, does exactly what it was told and nothing else. An assistant, such as a voice speaker, responds to a request. An agent decides how to reach a goal, which means it can handle messy, open-ended jobs, and also that it can do things you did not expect. That flexibility is the selling point and the hazard in the same breath.
What agents are good at today
Agents are strongest at repetitive digital chores with clear success conditions: gathering research from many pages, drafting and sorting email, updating records, writing and testing code, or working through a form-filling routine. The ICO notes that agentic systems are being developed for research, coding, planning and transactions, and it also says the field is at an early stage with many use cases unproven.
Where they go wrong
Agents inherit every weakness of the models underneath them, then add new ones because they can act. They can misread an instruction and carry out the wrong task confidently. They can be tricked by text hidden in a web page or document that tells them to do something else, a trick known as prompt injection. They can wander beyond the task. And because they hold access to your accounts, a mistake can cost money or leak data rather than just producing a bad paragraph.
The industry itself is wrestling with this. We recently reported on OpenAI's own AI agents trying to switch off their safety monitors, a reminder that oversight has to be designed in rather than assumed. The sensible rule for any agent you use is to give it the least access it needs, keep a human approval step for anything involving money, deletion or sending messages in your name, and read the activity log.
The UK angle: who is responsible?
The UK has no single AI law. As the Commons Library briefing explains, AI is regulated through the context in which it is used, under existing frameworks such as financial services rules and data protection. For agents, three bodies matter most.
The ICO says organisations remain responsible for the data protection compliance of agentic AI they develop, deploy or integrate. It points to risks including cyber security threats and the concentration of personal information that personal assistant agents may gather. It has opened a call for evidence on how organisations manage these risks, covering security, transparency, accountability, automated decision-making, fairness and lawful data use. The ICO's agentic AI work is a research report and consultation rather than formal guidance, so expect the detail to change.
On consumer law, the government's published guidance for businesses is blunt: you are responsible for what an AI agent does in the same way you are responsible for what an employee does, even if someone else built it. Firms should not overstate what the agent can do, and should make sure it respects customers' statutory rights, such as cancellation rights, and does not mislead them.
For a small business, the practical message is that you cannot blame the software. If an agent sends the wrong quote, mishandles a customer's data or ignores a refund right, the liability is yours. Our explainer on the Automated Vehicles Act shows how the UK is approaching the same question of responsibility for machines that act on their own on the road.
A short checklist before you use one
Decide the single job you want done and write it down. Give the agent a separate account with limited permissions rather than your main login. Turn on approval prompts for payments, deletions and outgoing messages. Check what personal data it will see, particularly customer or staff data, and whether it is sent outside the UK. Keep logs, and review them for the first few weeks. If you run a business, record who is accountable for the agent, and tell customers plainly when they are dealing with one.
What's next
Expect agents to become more capable and more embedded in everyday software over the next year, and expect UK regulators to say more. The ICO has said it will work with industry to explore the data protection implications over the next two to five years. Until the rules settle, the safest approach is the old one: start small, keep a human in the loop, and never hand over more access than the task needs.