AI agents for SMEs what they do, what they cost, what can go wrong
What an agent is, where it helps in a manufacturing company and where it does not, what it costs, what can go wrong and how it is kept under control, with an example on the orders that arrive by email.
What is an AI agent, in practice?
It is a program that uses a language model (LLM) to reach a goal inside your systems, choosing on its own which steps to take and which tools to use. For example it reads an email, looks up a customer in the management system, checks a price against the price list, prepares a draft. An assistant like ChatGPT answers whoever writes to it; an agent works on the company's data and programs, with the permissions you give it.
The market sells different things under the same name. Anthropic, which develops the Claude models, tells workflows apart from agents (“Building effective agents”, 19 December 2024). In workflows, models and tools follow code paths decided in advance; in agents, the model directs its own steps and its use of tools. The advice it draws from this is to look for the simplest solution possible, and to add complexity only when it is needed.
| What it is | What it does | Where it stops | Example in a manufacturing company |
|---|---|---|---|
| classic automation | runs steps decided in advance | it jams when the input changes shape | importing suppliers' electronic invoices into the management system |
| AI assistant | answers whoever writes to it | it does not work inside your systems: a person copies and pastes the data | writing a reply to a customer with Copilot |
| workflow with a model | follows fixed steps and uses the model to read or classify | the cases the path does not foresee go to a person | reading an order in PDF and preparing the draft in the management system |
| agent | chooses the steps and the tools to reach the goal | it needs more controls: permissions, spending limits, approvals | preparing the file for a request for quotation |
Many of the cases that AI assistants' answers call agents are the third row: the order flow they describe follows fixed steps, read, extract, check, enter. And it is often the right choice, because a fixed path is easier to test, measure and explain. The autonomy of the fourth row is needed when the path really changes from one case to the next, and then an agentic system has to be kept within precise limits. More autonomy means more control: guardrails, protection of personal data and role-based permissions, otherwise flexibility turns into unpredictability.
What can an agent do in a manufacturing SME?
Read what arrives in free form and turn it into data for the management system, and prepare the work that a person then decides on. That is where someone copies by hand today, and where a traditional program is not enough, because every customer and every supplier writes in their own way.
| Process | What arrives | What the agent does | Who decides |
|---|---|---|---|
| customer orders | emails with PDFs, in a different format for each customer | checks items, quantities and prices, prepares the draft | whoever handles orders confirms it |
| requests for quotation | emails with drawings, materials and quantities | prepares the file: part data, similar past jobs, questions for the customer | the engineering office sets the price |
| supplier confirmations and delays | free-text emails | compares dates and quantities with the purchase order and flags the differences | the buyer decides how to reply |
| incoming delivery notes | paper or PDF | compares them with the order and flags shortages and differences | the warehouse |
| invoices from foreign suppliers | PDF, in the supplier's format | extracts the data and compares them with order and delivery note | accounts records them |
| invoices from Italian suppliers | XML files from the Exchange System | nothing: the data are already structured, they only need importing | nobody, it is an import |
| procedures and technical documents | an archive of files | answers questions citing the document the answer comes from (RAG) | whoever asks checks the document |
The row on Italian invoices is the one that AI assistants' answers forget. Since 1 January 2019, invoices between parties resident or established in Italy are electronic only, in an XML file that goes through the Exchange System. The Italian Revenue Agency points out that the XML format itself makes bookkeeping faster and cuts the errors of manual entry (guide to electronic invoicing, in Italian, December 2025). Reading them takes no model, it takes a well built import. The agent is useful for what the Exchange System does not carry: invoices from foreign suppliers, delivery notes, and the cases where invoice, order and delivery do not match.
On 24 October 2026 we asked the same questions about AI agents for SMEs to Google, to its AI Overview and AI Mode, to ChatGPT and to Perplexity, and we read 161 of the pages they cited. The AI Overview and AI Mode suggest having an agent read supplier invoices from PDFs, emails and certified email. None of the 26 answers mentions that invoices from Italian suppliers are already structured data.
SMEs that use AI are still few, but growing. According to ISTAT, in 2025 15.7% of Italian SMEs with at least 10 employees use at least one AI technology, against 7.7% in 2024; among large companies it is 53.1%. On technical documents and procedures the same principle works at scale. In an industrial company we brought together 4 archives, 225 GB of documents, in a single archive queried in natural language, with RAG, and every search saves 23 minutes.
The figures in this guide
Prices and durations are those of Volcanic Minds, current at the date at the top of the page. The numbers in the order example are declared assumptions, to be replaced with yours. Figures from others come from the sources listed at the bottom.
Can an agent enter orders and requests for quotation into the management system?
Orders yes, as drafts with a person who confirms them; requests for quotation no, because they are not data to copy but work to prepare. They arrive in the same inbox and often in the same form, an email with a PDF, but they call for two different flows. The order becomes a line in the management system, the request for quotation becomes a file for whoever sets the price.
The case is a 30-person engineering company where about a hundred emails with orders and requests for quotation arrive every day, and two people copy them into the management system. On 24 October 2026 we asked it in these words, in Italian, to the same surfaces. All the answers say yes. Only ChatGPT and Perplexity treat requests for quotation and orders as two different jobs, and the cost figures, when there are any, come from vendors' blogs or from no source at all.
For each email the flow is this:
- the agent reads the email and its attachments and recognises what they are: an order, a request for quotation, a reminder, something else;
- for an order it extracts customer, codes, quantities, prices and delivery dates, and checks them against the management system: customer record, price list or accepted quotation, availability;
- it prepares the draft order and marks the fields that are uncertain or differ from the quotation;
- a person compares it with the document, corrects it if needed and confirms it: only then does the order enter the management system;
- for a request for quotation it prepares the file, with customer, drawing and revision, material, quantity, similar past jobs with their times and costs, and the questions to ask the customer if something is missing. The engineering office sets the price.
In the systems we build, an order enters the management system only after a person has confirmed the draft, and every correction is recorded: it serves to measure how often the agent gets things wrong, and on what.
The two people do not disappear: they move from copying to checking, and they handle the exceptions, the new customers, the cases the agent flags. According to the Bank of Italy (Questioni di Economia e Finanza no. 1005, in Italian, March 2026), among Italian firms with at least 50 employees AI raises labour productivity and profitability. It also shifts employment towards more qualified profiles, with no negative effect on overall employment. In 2024 just over 10% of those firms used it, and about a third expected to adopt it within two years.
How much time is freed depends on your numbers. An example with assumed numbers: of the hundred documents a day, 70 are orders, and copying one takes 5 minutes. If the agent prepares a correct draft for 7 orders out of 10 and checking it takes one minute, while the others are fixed by hand as today, the count is this.
| Item | Today | With the agent, under the assumptions |
|---|---|---|
| orders a day | 70 | 70 |
| work per order | 5 minutes to copy it | 1 minute to check each of 49 correct drafts, 5 minutes for each of the 21 orders to fix |
| time a day | 350 minutes, almost 6 hours | 154 minutes, about 2 and a half hours |
These are assumptions to show the calculation, not a promise: your numbers are measured by the pilot. And freed time is not yet a saving. Three hours a day become value only if you use them: to answer requests for quotation sooner, to handle more orders without hiring, for work that nobody does today. If they stay empty hours, the numbers do not add up.
It pays to start in parallel: in the first weeks the agent prepares the drafts without writing anything, and they are compared with what people entered. It is the cheapest way to know how often it gets things wrong before it can get them wrong for real. The pilot is then judged on four measures:
- the share of drafts confirmed without changes;
- the errors that reached the management system after confirmation, by type: quantity, price, code, date;
- the time per document, checking included;
- the cost per document, that is, model usage divided by the documents processed.
The item that usually weighs most is the connection to the management system, and on this the answers agree. We connect to ERP, CRM, MES, MRP, APS and legacy systems through REST APIs, batch, WebSocket, MQTT, AMQP and other secure channels. The management system is not replaced, and if it has no API we use whatever route it allows. How factory systems are connected is in the guide ERP and MES.
How much does an AI agent cost?
A custom agent costs from 10,000 € for the first process, plus model usage, and it starts with a feasibility study that costs up to 2,500 €, deducted from the pilot if you sign. These are the entry thresholds of Volcanic Minds: the price of your project is written by the study, with a range and a cap.
| How you get it | When it is enough | How you pay | Where it stops |
|---|---|---|---|
| AI feature of the management system you already have | when the vendor has already foreseen your case | often an extension of the subscription | it does what the vendor foresaw, on the data of that system |
| no-code automation platform | simple flows between widespread services, with few exceptions | a subscription plus usage | exceptions, permissions and traceability, as the flow grows |
| custom agent | your own process, several systems, confidential data or controls | from 10,000 € for the first process, plus model usage | it takes a pilot to know whether it pays |
The price grows with the connections and the checks, not with the model. What counts is how many access routes your management system has, how many document formats arrive, how many checks a piece of data must pass before it goes in, where the data must stay. A system with several processes and several agents working together is another class of project: an MVP starts at 10,000 €, an Enterprise platform at 45,000 €.
Then there are the running costs, which are yours: model usage, hosting and, if you want it, maintenance, which is a separate contract. Model usage is paid per use, in tokens, and depends on how many documents go through, how long they are and which model is needed. For reading and classifying a small model is often enough, faster and cheaper. That is why it is measured in the pilot as a cost per document, and in operation the cost of every step is recorded, with spending limits per process instead of discovering the consumption at the end of the month. There is no license fee on the software we develop for you.
Almost all the answers we read give ranges, from a few tens of euros a month for a no-code platform to tens of thousands of euros for a connection to the ERP. They come from vendors' and agencies' blogs, and in some answers from no source; the same holds for the return percentages. The return of your agent is calculated on your process, from the measured starting point, as in the order example.
What can go wrong?
The agent may misread a piece of data, carry out an instruction hidden in a document, or have more permissions than it needs. The first error is stopped by the checks and by the person who confirms; the other two are prevented in the design, not afterwards.
| What can happen | How it happens | How it is contained |
|---|---|---|
| a misread piece of data | 1,000 read as 100, an item code similar to another, the wrong revision of a drawing | checks against records, price lists and quotations; uncertain fields flagged; the order goes in only after confirmation |
| an instruction hidden in a document | an email or a PDF contains text that the model mistakes for an order to carry out: this is indirect prompt injection | the content of documents is treated as data, never as an instruction; the agent has no tools to act outside its task |
| too much autonomy | the agent has more functions, permissions or freedom than it needs | only the tools it needs, read-only where that is enough, a person on the actions that matter |
| fraud | a fake order, or an email asking to change a supplier's bank details | the agent does not change customer or supplier records or bank details; a change is verified outside the email |
| growing costs | a loop that calls the model several times on the same document | the cost of every step recorded, spending limits per process and per period |
| data leaving | customer documents sent to a service that keeps or uses them | Enterprise services that exclude training, Zero Data Retention or a private infrastructure |
| dependence on a vendor | a model changes price or terms | the model stays replaceable, and the process does not stop |
The second and third rows are on OWASP's list of risks for applications built on language models; OWASP is the foundation that publishes the most widely used references on software security. Prompt injection is the first risk, and the indirect kind occurs when the model accepts input from external sources, such as websites or files (LLM01:2025). For an agent that reads incoming mail it is the normal working condition. Excessive agency is the sixth, and its causes are excessive functionality, permissions and autonomy (LLM06:2025). In OWASP's example, an assistant that summarises mail receives an email with hidden instructions and uses it to send messages on the user's behalf. The remedies are an extension that can only read, a read-only permission and a person who reviews and sends every email drafted by the model.
In the 26 answers of 24 October 2026 prompt injection comes up three times, and OWASP in 2 of the 161 cited pages we read. The agents we build act only through explicit tools, with limited permissions and strict validation of the data schemas: if the output does not follow the rules, the system does not proceed. AI never writes freely to the production database: every change goes through a tool with limited permissions and, when it matters, through a person.
What does the agent decide, and what does a person decide?
The agent reads, looks up and prepares; a person confirms everything that changes your systems or leaves the company. AI classifies, drafts and finds gaps; it is not the authority that decides.
| Action | Who does it | Why |
|---|---|---|
| reading emails and attachments, recognising what they are | the agent, on its own | it changes nothing in your systems |
| looking up customers, items, price lists and past jobs in the management system | the agent, read-only | it needs them to prepare, not to decide |
| preparing the draft order or the quotation file | the agent, as a draft | a person sees it before it takes effect |
| confirming the order in the management system | a person, on the draft | it is a write to your systems |
| replying to the customer or the supplier | a person, on the prepared reply | it leaves the company and commits you |
| setting the price of a quotation | the engineering office | it follows rules known to whoever machines the parts |
| changing customer or supplier records, price lists or bank details | never the agent | it is where the most expensive errors and fraud get through |
Over time some confirmations can become automatic: for example the orders of a regular customer, with codes and prices already known, that have passed the check without changes for weeks. It is a choice to make on the pilot's numbers, process by process, and a person (HITL) stays on the risky operations. Automation goes as far as the cost of a mistake stays acceptable.
We always recommend AI observability tools. With them, every operation leaves a trace of the context read, the data extracted from your systems, the steps followed and the cost: an error can be reconstructed months later, and an audit finds its answers.
Would you rather talk it through?
Book a call with people who work on these topics every day: we will look at your case together.
What does the AI Act ask for an agent?
For an agent that reads orders and prepares drafts, little more than what it asks for any use of AI in a company: training for the people who use it and the rules on personal data that already apply. Training is required by article 4 since 2 February 2025. The obligations grow with what the agent does and with the people it affects.
| If the agent | What applies | From when |
|---|---|---|
| reads documents and prepares drafts that a person confirms | training for the people who use it (article 4) | 2 February 2025 |
| processes personal data, such as names and emails of customers' contacts | GDPR; with the model provider, a contract for processing on your behalf (GDPR article 28) | already in force |
| replies to customers on its own | whoever receives the reply must know they are dealing with an AI, an obligation of the system's provider (article 50) | 2 August 2026 |
| changes how the people who use it work, or their pace | in Italy, assessment in the risk assessment document and information and training for workers (Legislative Decree 179 of 2026, article 42) | 23 October 2026 |
| decides about people, for example screens CVs or evaluates employees | high-risk (annex III), with the obligations of article 26; in Italy the final decision already rests with a person | 2 December 2027; in Italy since 23 October 2026 |
The texts behind the rows are GDPR article 28, article 50 and annex III of the AI Act, and article 42 of Legislative Decree 179 of 2026, in Italian.
There is one point that none of the answers we read touches. If you have a custom agent built and put it into service under your own name, under the AI Act the provider is you (article 3, point 3). And if the agent talks to customers, the notice of article 50 falls on you. When we build a custom system for you, under your name, you are the provider under the AI Act: that is why we put compliance into the architecture, not into a separate document.
On 24 October 2026 the AI Act came up only in the answers of ChatGPT and Perplexity; Google's surfaces do not name it, or reduce it to where the data travel. The obligations case by case, with a self-check, are in the guide AI Act for deployers, which like this one is a technical contribution, not legal advice.
Where do you start?
With a single process, chosen because it repeats every day, can be measured and has a cost of error you know: the orders that arrive by email are often the right candidate. The path is the one in the guide AI in business: where to start, with the same phases and the same prices.
- You measure the starting point: how many documents arrive, in how many formats, how long each one takes, how many errors reach the management system today.
- The feasibility study, 1-2 weeks and up to 2,500 €, says whether you need an agent, a simpler flow or just a well built import. It also says how it connects to the management system, what model usage costs and with which criterion to stop. The study stays yours even if you do not sign, and if you sign its cost is deducted from the pilot.
- The pilot, 4-6 weeks from 10,000 €, puts the agent to work on a narrow scope, first in parallel and then with a person's confirmation, and measures the result against the starting point.
- Integration and governance take the process into production: adding up the phases, from the first meeting to a process in production takes between 11 and 15 weeks.
If the pilot does not reach the goal, we tell you to stop. On the agentic AI audit platform a first working MVP arrived within six to eight weeks, and each audit saves 4 hours. In the measurements made together with the client the agent collects 60% more data than interviews run by hand, with 88% accuracy against an auditor's work. How we build and govern systems with several agents is on the page on AI agent orchestration.
When is an agent not needed?
When the data already arrive structured, when the path is always the same, or when the problem is a messy archive. In the first case an import is enough: invoices from Italian suppliers through the Exchange System, orders from customers who already send them as data, from their portal or in an agreed file layout. In the second, classic automation is enough, or a feature of the management system you already have, cheaper and easier to test.
In the third, the agent would make the problem faster, not smaller. Two records of the same customer or two price lists that say different things produce drafts that are confident and wrong: incompleteness can be managed, contradiction cannot. Data in order comes before the agent. And a decision about people is not a good first process, because of the rules it brings with it.
Many processes, though, need a well built form and a clean database, not an agent, and in that case we tell you so. When it makes sense to bring in AI agents, and when it does not, is in the frequently asked questions on AI agents.
Sources and further reading
- Anthropic, “Building effective agents”, 19 December 2024anthropic.com, accessed 24 October 2026
- OWASP GenAI Security Project, “LLM01:2025 Prompt Injection”genai.owasp.org, accessed 24 October 2026
- OWASP GenAI Security Project, “LLM06:2025 Excessive Agency”genai.owasp.org, accessed 24 October 2026
- Agenzia delle Entrate (Italian Revenue Agency), “La fattura elettronica e i servizi gratuiti dell'Agenzia delle Entrate” (Electronic invoicing and the free services of the Revenue Agency), December 2025agenziaentrate.gov.it, in Italian, accessed 24 October 2026
- Banca d'Italia, Tiziano Ropele and Alex Tagliabracci, “L'impatto economico dell'adozione dell'intelligenza artificiale: evidenza dalle imprese italiane” (The economic impact of AI adoption: evidence from Italian firms), Questioni di Economia e Finanza no. 1005, March 2026bancaditalia.it, in Italian, accessed 24 October 2026
- ISTAT, “Imprese e ICT, anno 2025” (Enterprises and ICT, 2025), 15 December 2025istat.it, in Italian, accessed 22 October 2026
- AI Act, article 3, “Definitions”ai-act-service-desk.ec.europa.eu, accessed 24 October 2026
- AI Act,article 4, “AI literacy”ai-act-service-desk.ec.europa.eu, accessed 24 October 2026
- AI Act,article 50, transparency obligations for providers and deployersai-act-service-desk.ec.europa.eu, accessed 24 October 2026
- AI Act,annex III, high-risk AI systemsai-act-service-desk.ec.europa.eu, accessed 24 October 2026
- Legislative Decree of 7 October 2026, no. 179, aligning Italian law with Regulation (EU) 2024/1689normattiva.it, in Italian, accessed 24 October 2026
- Regulation (EU) 2016/679 on data protection (GDPR), article 28eur-lex.europa.eu, accessed 24 October 2026
What is the difference between an AI agent and a chatbot?
The chatbot answers whoever writes to it; the agent works inside your systems to reach a goal, for example it reads an order, looks up the customer in the management system and prepares the draft. That is why an agent needs limited permissions, spending limits and a person who confirms the actions that matter.
Does an AI agent replace employees?
In the office processes of an SME it usually changes the work of the people who are there instead of removing it, because whoever copied orders moves to checking drafts and handling exceptions. According to the Bank of Italy, in Italian firms with at least 50 employees AI raises productivity and profitability and shifts employment towards more qualified profiles, with no negative effect on overall employment.
How much does an AI agent cost per month?
It depends on how many documents go through and which model is needed, because model usage is paid per use and is measured in the pilot as a cost per document. On top come hosting and, if you want it, maintenance, which is a separate contract. There is no license fee on the software we develop for you; building it starts at 10,000 € for the first process.
Do I have to change my management system to use an AI agent?
No. The agent connects to the management system you have, dated ones included, through APIs, periodic imports or the other routes the system allows, and it writes only through tools with limited permissions, after a person's confirmation. If the management system has no access route at all, the feasibility study says so before you start.
Does my company's data end up training the models?
No. We choose Enterprise-grade cloud services that contractually exclude the use of your data for training, and Zero Data Retention services when more is needed. If the data is particularly sensitive we consider a private AI infrastructure, European, national or on-premise, so that nothing leaves your perimeter.
Can an AI agent make mistakes?
Yes, just as a person can misread a number or mix up a code. That is why every piece of data is checked against the management system, uncertain fields are flagged and the order goes in only after a person's confirmation. The most serious risk is an instruction hidden in a document, and it is contained by giving the agent only the tools and permissions it needs.
Does the AI Act apply to an AI agent too?
Yes, as to every AI system used for work. For an agent that reads orders and prepares drafts, what is needed above all is training for the people who use it, required by article 4. If the agent replies to customers on its own, from 2 August 2026 they must know they are dealing with an AI; if it decides about people, as in recruitment, it is high-risk.
An agent that works in your management system, under control?
Tell us which process takes up most of your time and in what form the documents arrive. The feasibility study tells you whether you need an agent or something less, what it costs and with which criterion to stop.
- You won't talk to a salesperson
- NDA before we get into the details
- The code stays yours
Articles on the same topics.
Web Bot Auth: visitors with no eyes
AI agents read your site and convert better than organic, yet they never show up in analytics. How to measure them and verify them with Web Bot Auth.
Read
Generative UI: for humans and machines
Explore how Generative UI and Dual-Interaction UX transform enterprise SaaS by creating adaptive interfaces for human operators and AI agents.
Read
Data quality: data decides, not the model
When AI gets it wrong, blame the data, not the model. How to identify, sanitize and refresh your sources so AI actually works in your next business project.
Read