AI agents at work: plenty of confidence, little control

AI that does not just answer questions but carries out tasks on its own: drafting a quote, posting an invoice, handling a customer query. These AI agents are spreading quickly, including among small and medium-sized businesses. New research shows that executives' confidence is running well ahead of reality. Almost everyone thinks they are in control, yet few know what to do when an agent does something it was not meant to.

What the research shows

Software company OutSystems, together with CIO Dive and KPMG, surveyed more than 850 IT decision-makers. Dutch IT Channel summarised the findings. 82 per cent of executives say they can manage and monitor AI agents in production. Only 26 per cent feel properly prepared to resolve problems with those agents.

Oversight is also largely manual. 83 per cent rely on existing IT, security and compliance processes. Just 5 per cent have automated controls, an audit trail and fixed points at which a person reviews the work, as MSP Business also reports. Notably, European organisations cite unpredictable agent behaviour as a major concern more often than businesses elsewhere, and more often expect to rely on a partner.

What this means for your organisation

An agent acting on your behalf needs access: to your mailbox, your accounts, your CRM or your files. When something goes wrong, it goes wrong at scale. An email sent to the wrong people, a payment booked twice, or data ending up in the wrong place. With an ordinary chatbot, a person still reads the output before anything happens. With an agent, that is not a given.

Agents also often arrive through a licence or a separate app, without anyone consciously deciding what they are allowed to do. Afterwards, it is unclear who is responsible or how to trace what happened. Under the GDPR and, for organisations in scope, the Dutch Cyber Security Act implementing NIS2, that is not a comfortable position.

What you can do now

There is no need to hold back on AI agents, but it pays to get the basics right first. It is less work than it sounds:

• Take stock. Which AI tools and agents are already in use, by whom, and with which connections to your systems?
• Grant as few rights as possible. Give an agent access only to the data and functions it needs for its task. Read access rather than write access where possible.
• Build in human approval. Have a member of staff approve payments, external emails and changes to customer data first.
• Make sure you can look back. Log what an agent does, so mistakes can be traced and put right.
• Know how to stop it. Agree who may switch an agent off and how that works technically, before you need to.
• Start small. Begin with one well-defined process and keep a close eye on it for a few weeks before expanding.

How Qteco helps

We help clients use AI responsibly within Microsoft 365 and the wider workplace. That starts with insight: which apps and agents have access to your environment, and with what rights. We then set up access so that agents only do what they should, with logging and clear agreements on oversight. That way you gain the time savings without losing control.

Would you like to know where your organisation stands with AI agents and what a sensible first step would be? Book a conversation with one of our engineers.

Sources

1. Bestuurders overschatten paraatheid voor AI-agents — Dutch IT Channel (2026-10-18)
2. Kwart van organisaties voorbereid op problemen met AI-agents — MSP Business (2026-10-16)

Read also

When AI Recruited Its Own Reinforcements

The government is waking up. Is your boardroom still asleep?

AI in the workplace: opportunity and risk