What Agentic AI Means for Risk
Share
The word agentic is doing a lot of marketing work. Underneath it there is a real and important distinction.
Direct answer
Agentic AI means a model given tools and permission to take actions rather than only produce text. It can send, book, edit or purchase. The failure mode changes from a wrong answer you can check to a wrong action that already happened.
Based on the AI and Automation Practitioner standard (ST1512), a Level 4 apprenticeship for people already in work. Funding rules described here are the England position and are set by the funding body.
Potentially free for you
The learner never pays. Employers potentially pay nothing either, and where the apprentice is aged 16 to 24 the government funds the whole cost even if the employer does not pay the levy.
Closing any gap. A levy transfer from another employer covers 100% of the cost. Unused transfer allowance is not carried forward at the end of the tax year, and it must be agreed before the apprentice starts.
From 1 August 2026 the government stopped adding the 10% top-up to new funds entering levy accounts, so there is less in the system than there was.
Part of our guide to AI Explained in Plain English for Work.
What makes something an agent
Tool access. It can call an API, send an email, update a record or run a search rather than writing about doing so.
A goal rather than an instruction. You describe an outcome and it decides the steps, which is where the value and the risk both come from.
Memory across steps, so an early mistake shapes everything after it.
Autonomy. Some steps happen without a person approving each one. That is the line that actually matters.
Why the risk is different in kind
A wrong answer costs you a check. A wrong action costs whatever the action did, and it has already happened.
Errors compound. A misread in step one shapes steps two to six, and the output stays internally consistent throughout.
Failure is often silent. A person who cannot complete a task asks a question. An agent produces something and continues.
Attribution is harder. Without a log you cannot say afterwards what it did or why, which makes investigation impossible.
The controls that matter
A list of actions always requiring human approval. Sending external communication, spending money, deleting records, changing permissions.
A complete audit log. Every action, every input, timestamped and retained.
A scope limit. Access to one system rather than everything, and read access wherever write access is not needed.
A stop condition, so it halts on an unexpected state instead of improvising past it.
There is more on this in our guide to AI explained in plain English.
Where agents genuinely help today
Multi-step research and collation, producing a document a person then reads and acts on.
Routine movement of data between systems where the rules are clear and failures are visible.
Triage. Categorising and routing incoming work, with the actual decision left to a person.
The pattern is the same in all three. The agent prepares and a person commits, which is the safe shape for most organisations now.
How to test one honestly
Run it against last month's real cases where you already know the right answer. Nothing else gives you a real error rate.
Count wrong actions rather than wrong answers. They are different numbers and only one of them matters.
Run it in propose-only mode for a fortnight and read what it proposed. This is the cheapest safety measure available.
Remove approval steps one at a time, only on actions where the record shows it was consistently right.
The UK regulatory position on automated action
UK GDPR gives people rights around decisions made solely by automated means where those decisions have legal or similarly significant effects.
That matters directly for agents. An agent that decides an outcome affecting an individual is exactly the case those provisions cover.
The practical response is the approval list. Keep a person in the loop on anything affecting a person, and you stay clear of the difficult ground entirely.
Sector regulators add their own expectations. Financial services, health and education all have published positions worth reading before you deploy anything autonomous.
The vocabulary to be sceptical about
Autonomous, used without saying what it is autonomous over. Autonomy is a scope question, not a property.
Reasoning, used to imply reliability. The system produces text describing reasoning, which is not the same as reasoning correctly.
Self-improving. Nothing in common use improves itself in production without a human retraining it.
When buying, ask what happens when it is wrong. The answer tells you more than any capability demonstration.
Key takeaways
- An agent acts rather than answers, which changes the failure mode.
- Errors compound across steps while the output stays internally consistent.
- Require approval for sending, spending, deleting and permission changes.
- Test against real historic cases and count wrong actions, not wrong answers.
- Ask what happens when it is wrong before you buy anything.
Frequently asked questions
What does agentic AI mean?
A model given tools and permission to take actions rather than only produce text. It can send, book, edit or purchase on your behalf.
How is an agent different from a chatbot?
A chatbot answers and you decide. An agent decides the steps and carries them out, so a mistake becomes an action rather than a wrong answer.
Why are agents riskier?
Errors compound across steps, failures are often silent, and without a log you cannot say afterwards what it did or why.
What controls does an agent need?
An approval list for high-impact actions, a complete audit log, a scope limit, and a stop condition for unexpected states.
Where do agents actually work well?
Multi-step research and collation, routine data movement between systems, and triage where a person makes the final decision.
How do I test an agent?
Against last month's real cases where you know the right answer, counting wrong actions rather than wrong answers.
What does propose-only mode mean?
The agent suggests each action rather than performing it. Running that way for a fortnight is the cheapest safety measure available.
What should I ask a vendor?
What happens when it is wrong. The answer tells you more than any capability demonstration they can run.
The funded route, in figures
Figures are the England position. Levy-paying employers usually draw the whole cost from the levy they already contribute, so they pay nothing extra. Employers below the £3 million pay bill threshold pay nothing for an apprentice aged 16 to 24. For an older apprentice the government funds 95 per cent, and a levy transfer from a larger employer can cover the rest. Eligibility and funding rules are set by the funding body and can change.
Where to go next
If you want automation and its governance assessed towards a qualification, the funded route uses your own work as evidence.
We help UK employers and employees access government-funded AI training. Training is delivered by third-party providers. We do not guarantee a place, a qualification, a job or any particular outcome. Eligibility and funding rules are set by the funding body and can change. Always check the current position before you commit. See our disclaimer.