AI agents in business: how much autonomy is legally defensible

What is an AI agent and how does it differ from automation and AI workflows?

An AI agent is an AI system that is primarily given a goal and determines the path to it itself. Depending on the degree of autonomy permitted, it derives intermediate steps, uses its own input, deploys various tools and adjusts its approach. The specific sequence may only emerge during execution.

According to a recent Bitkom survey, 57% of companies with 20 or more employees use AI, while nine out of ten still consider themselves at the beginning of their AI adoption. Where adoption is already more advanced, AI agents are often already being piloted or in use.

In 2026, an AI agent can also combine individual capabilities, such as access to company systems or operating graphical user interfaces, into a self-directed process and interact with other agents. This is where deployment and control become legally complex.

Terms such as AI agent, agentic AI, AI workflow or automation are used inconsistently in practice. Automation, AI workflows and AI agents can be distinguished, for example, by how far the process is predefined and how much scope for independent action the system retains:

The boundaries between these levels are fluid. For legal and organisational classification, what ultimately matters is the degree of autonomy you grant the system, more than the label. You still need consistent terminology across the company, because without it you cannot develop a sound structure for deployment.

Anyone seeking to classify AI agents legally should therefore first define internally what counts as an agent within the company and how much autonomy it should be given.

Are an AI agent's actions attributed to the company?

Initial court decisions show that the fact that an AI system generates content autonomously does not, in itself, preclude that content from being attributed to the company deploying it. The two decisions on this point concern a chatbot and an AI-generated search overview, not AI agents.

The Higher Regional Court (OLG) of Hamm (judgment of 12 May 2026, case no. 4 UKl 3/25) ruled on a chatbot on a company's website. The chatbot had provided incorrect information about the specialist medical qualifications of the doctors working there. The court classified the answers as commercial practices of the company, even though they had been generated autonomously. In the court's view, the chatbot was not an outside third party but a means of communication deployed by the company.

The Regional Court (LG) Munich I (judgment of 28 May 2026, case no. 26 O 869/26) took a similar line. It classified an incorrect AI-generated Google overview as Google's own content, attributable to Google, and to that extent held Google liable as a direct interferer (unmittelbare Störerin). The parties have since ended the appeal proceedings by settlement, so the judgment has ceased to have effect.

Anyone deploying an AI agent should therefore assume that the content generated by the agent may be attributed to them. Which obligations frame the deployment depends on the use scenario, starting with the AI Act.

Does an AI agent fall under the AI Act?

The AI Act does not have a separate category for "AI agents". Whether an agent falls within the scope of the Regulation depends on the general criteria for an AI system and then on its specific area of use. Depending on the use, the requirements for high-risk AI systems may also apply.

One example is recruiting. If an AI agent assesses or sorts applications, its deployment can become a highly demanding project from a regulatory perspective.

With AI agents, it is above all their ability to make independent decisions that makes control under the AI Act difficult. When planning an agent, you should keep these three points in mind:

• Predictability: The more action steps an AI agent selects and executes directly itself, the harder it can become to fully map its actual behaviour before deployment.
• Human oversight: In a longer chain of actions, you need to decide at which points intervention is meaningful at all and possible in good time.
• Control points: These points of intervention must already be built into the technical and organisational design of the deployment.

The AI Act is only one part of the legal framework.

Which areas of law apart from the AI Act affect AI agents?

Which requirements apply alongside the AI Act depends on the respective use scenario. Every additional capability of an AI agent can create a further regulatory touchpoint, from the GDPR to payment services law.

AI agents can access company systems and external tools. They can, for example, send messages, modify data, book appointments or prepare or trigger orders, payments and other transactions. Intermediate steps that previously had to be initiated by a human are eliminated.

Depending on its capabilities, an AI agent touches on different areas of law:

• Processing of personal data: If an AI agent processes personal data, the requirements of the GDPR apply within its scope.
• Access to IT infrastructure and code: If an agent accesses internal IT infrastructure or generates or modifies code, questions of IT security law arise. Depending on the product, the company and the context of use, the Cyber Resilience Act or the NIS2 regulations may become relevant.
• Orders and payments: Here, contract law and payment services law requirements come into play.
• External communication: If an agent acts externally, requirements under competition, media or platform law, for example, may also apply.

For legal classification, you therefore need a functional assessment. Five questions are particularly decisive: In which process is the agent used? Which data does it access? Which systems is it allowed to use? Which actions can it carry out? And which persons or rights may be affected?

Before an AI agent is given a new capability, it is therefore worth checking which area of law it touches and whether the agent may use it without approval.

How much autonomy should an AI agent be given in a company?

Which path an AI agent chooses to reach its goal is difficult to predict in longer autonomous chains of action. Several incidents in summer 2026 demonstrated this. During cybersecurity evaluations, agents from various providers left the intended test environment, reached real systems and carried out unintended actions there.

In another case, OpenAI agents used a publicly accessible German wiki to exchange information about test tasks and ways of circumventing restrictions. In these cases, agents in some instances exceeded their intended scope of action and circumvented existing restrictions in order to achieve their goal.

We therefore recommend defining a specific framework for each AI agent and each area of use. It determines which actions are permitted, which data and systems the agent may access and at which points human approval is required. Technically, you implement such limits through role and authorisation concepts, restricted API permissions, amount limits or approval steps, for example.

As a rule of thumb: the greater the potential impact of an action and the harder it is to reverse, the narrower the scope of action should be. Control does not have to look the same for every step. Three forms of control can be combined for AI agents depending on the risk of an action:

• Retrospective control: For low-risk, reversible actions, a review after the fact may be sufficient.
• Prior approval: For sensitive data, external declarations or financial transactions, approval before execution makes sense.
• Monitoring and intervention: Monitor the agent continuously and retain the ability to stop or redirect it during a process.

How narrowly you define the framework for an AI agent is therefore not purely an IT decision, which is why the legal department should be involved from the outset.

What are the legal department's tasks when deploying AI agents?

The legal department helps shape the permissible scope of action of AI agents and reviews its limits during ongoing operation. Even though the risks of the technology cannot yet be fully assessed, it needs a structured process to do so.

The legal department builds a process for AI agents in four steps:

1. Start with a joint workshop. Anyone addressing the topic for the first time brings together the legal department, IT, information security, data protection and the responsible business units.
2. Create an overview. Companies must be able to see from their AI inventory which agents are in use, who created them and which systems they can access. This applies to off-the-shelf agents from external providers as well as to agents in workflows and in-house developments. The overview is particularly important where business units configure agents themselves or build their own applications on low-code platforms.
3. Define the scope of action for each use case. Together with the business units, the legal department decides what scope is defensible for the respective use and translates legal requirements into concrete technical and organisational limits.
4. Support ongoing operation. AI agents may receive new tools, switch data sources or gain additional capabilities through updates. The area of use may also change, and with it the legal risk profile. Regular sparring with IT, information security, data protection and the business units keeps the framework up to date. For new developments or cases that are difficult to classify, external expertise can be useful.

The legal department thus keeps an eye on an AI agent's scope of action throughout its entire period of use.

Conclusion: AI agents need a clearly defined framework for autonomy

With AI agents, the legal position is determined by how their deployment is designed. Because even autonomously generated content can be attributed to the company, the framework should be in place before the agent acts: which data it processes, which systems it accesses, which actions it may carry out without approval and what impact they may have.

For agentic AI in companies, this means: the greater an agent's scope of action, the more clearly permissions, approvals, control points and responsibilities must be defined. Above all, responsibility for this must also be clearly allocated internally.

Frequently asked questions

#1 What is the difference between an AI agent and conventional automation?

With conventional automation, the process is fully pre-programmed; with an AI agent, it is primarily the goal that is predefined. Automation only executes rule-based steps and need not be an AI system. Depending on the autonomy permitted, an AI agent derives intermediate steps itself, uses tools and adapts its approach.

#2 Is an AI agent automatically a high-risk AI system?

No, an AI agent is not automatically a high-risk AI system. The AI Act has no separate category for AI agents; classification follows the specific area of use. If an agent assesses or sorts applications, for example, the requirements for high-risk AI systems may apply.

#3 Does every action of an AI agent have to be approved by a human in advance?

No, not every action of an AI agent requires prior approval. For low-risk, reversible actions, retrospective control may be sufficient. For sensitive data, external declarations or financial transactions, approval before execution makes sense.

#4 Do AI agents belong in the AI inventory?

Yes, companies must be able to see from their AI inventory which agents are in use, who created them and which systems they can access. This is particularly important where business units configure agents themselves or build their own applications on low-code platforms.

#5 Does an AI agent need to be legally reviewed again after implementation?

An AI agent should continue to receive legal support after implementation, because its risk profile can change during operation. Agents may receive new tools, switch data sources or gain additional capabilities through updates. If the area of use changes, the legal risk profile may change as well.