{"id":28149,"date":"2026-11-09T22:49:23","date_gmt":"2026-11-09T22:49:23","guid":{"rendered":"https:\/\/generationimpact.global\/?p=28149"},"modified":"2026-11-10T14:40:03","modified_gmt":"2026-11-10T14:40:03","slug":"ai-agents-explained","status":"publish","type":"post","link":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/","title":{"rendered":"AI agents explained: how agentic AI works and why most organisations should not build it alone"},"content":{"rendered":"\n<style data-wp-block-html=\"css\">\n.gig-article h2{font-weight:900;font-size:32px;line-height:1.3;margin:48px 0 16px}\n.gig-article h3{font-weight:800;font-size:22px;margin:32px 0 12px}\n.gig-article table{width:100%;border-collapse:collapse;margin:20px 0;font-size:15px}\n.gig-article th{background:#eff5f5;color:#2c555a;text-align:left;padding:10px;border:1px solid #dfeaeb}\n.gig-article td{padding:10px;border:1px solid #dfeaeb;vertical-align:top}\n.gig-article .gig-clip{margin:28px 0}\n.gig-article .gig-clip video{width:100%;height:auto;border-radius:12px;display:block}\n.gig-article .gig-clip figcaption{font-size:14px;color:#6c6763;margin-top:8px}\n<\/style>\n\n\n\r\n\t\t<div  class=\"block-41d3885e-8d2f-45e1-b6d4-0f133f41dd40 areoi-element gig-article\">\r\n\t\t\t\r\n\t\t\t\n\n<p class=\"gig-meta fs-14 m-fs-12 has-custom-neutral-500-color has-text-color has-link-color wp-elements-1 wp-block-paragraph\">By Anna Shpak, Founder &amp; CEO, Generation Impact Global<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">In short<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An AI agent is software that takes a goal, decides the steps itself, uses tools to carry them out, and checks the results as it goes. Autumn 2026 brought a new generation of agents from Anthropic, OpenAI and Google, and with it new evidence on what they can and cannot do. Five points to take away:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Agents can now work for hours, even days.<\/strong> All three developers released agent-grade models between September and November 2026. Anthropic&#8217;s newest model scores close to 90% on a standard test of operating a computer, and one experiment ran more than 1,000 agents for eight days.<\/li>\n\n\n\n<li><strong>Real business tasks are still hard.<\/strong> On Zapier&#8217;s benchmark of realistic business automations, Google&#8217;s September 2026 model completed only about half.<\/li>\n\n\n\n<li><strong>Most organisations are still piloting.<\/strong> MIT researchers found that by the end of 2025 nearly 85% of banks were piloting AI, yet essentially none had it deeply embedded in how they work.<\/li>\n\n\n\n<li><strong>The hard part is not the model.<\/strong> Security, monitoring, testing, model upgrades and skilled people make up most of the effort. Anthropic monitors every action of the roughly 30,000 agents it runs internally, and calls people who can make AI work in a business the hardest talent to find.<\/li>\n\n\n\n<li><strong>For regulated data, control matters more than cleverness.<\/strong> New research shows that experts tend to follow an agent&#8217;s lead, and that safety test results do not reliably predict how agents behave in real use. In sustainability reporting, every figure must be traceable to a source and approved by a person.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">This article explains how AI and agents work in plain language, what the latest research says, and why a specialised platform is usually the better route. A companion article covers the regulation: the EU AI Act, global rules, and how we apply them at Generation Impact Global.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">From chatbot to agent<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The word &#8220;agent&#8221; is used loosely. It helps to see four levels, each giving the AI a little more freedom.<\/p>\n\n\n\n<figure class=\"wp-block-table table-responsive\"><table><thead><tr><th>Level<\/th><th>What it does<\/th><th>Who decides the steps<\/th><th>Example<\/th><\/tr><\/thead><tbody><tr><td>Model<\/td><td>Turns text in into text out<\/td><td>Nobody; it answers one prompt<\/td><td>A raw language model behind an API<\/td><\/tr><tr><td>Assistant<\/td><td>Holds a conversation and answers questions<\/td><td>The person, one question at a time<\/td><td>A chatbot answering &#8220;what is SFDR?&#8221;<\/td><\/tr><tr><td>Workflow<\/td><td>Runs the model through fixed steps written in code<\/td><td>The developer, in advance<\/td><td>Extract figures from a PDF, then check them against a template<\/td><\/tr><tr><td>Agent<\/td><td>Takes a goal, plans, uses tools, checks results, repeats<\/td><td>The model, within limits set by the developer<\/td><td>&#8220;Find every Scope 2 figure in these 40 files and flag the gaps&#8221;<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The line between a workflow and an agent is who decides the next step. In a workflow, a developer fixes the steps in code. In an agent, the model chooses what to do next and which tool to use, within limits the developer sets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In 2026 the major developers turned agents into products. OpenAI opened its Agents API in public beta in September 2026, with hosted sessions, sandboxes and connections to outside tools (<a href=\"https:\/\/developers.openai.com\/api\/docs\/changelog\" rel=\"nofollow noopener\" target=\"_blank\">OpenAI changelog<\/a>). Anthropic made computer use generally available in August 2026, so its models can operate software through the screen as a person would (<a href=\"https:\/\/platform.claude.com\/docs\/en\/release-notes\/overview\" rel=\"nofollow noopener\" target=\"_blank\">Claude release notes<\/a>). Google launched the <a href=\"https:\/\/cloud.google.com\/blog\/products\/ai-machine-learning\/welcome-to-gemini-at-work-2026\" rel=\"nofollow noopener\" target=\"_blank\">Gemini agent<\/a> for businesses in October 2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Every agent has three parts:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>The model<\/strong>, which does the reasoning.<\/li>\n\n\n\n<li><strong>Tools<\/strong>, which let it fetch information or take actions.<\/li>\n\n\n\n<li><strong>Instructions<\/strong>, which set how it should behave.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">More agents is not always better. Anthropic&#8217;s October 2026 guidance on <a href=\"https:\/\/claude.com\/resources\/articles\/building-agents-when-to-fold-subagents-into-your-main-agent-loop\" rel=\"nofollow noopener\" target=\"_blank\">building agents<\/a> reports that many enterprise deployments did better with one agent and a set of skills than with many specialist agents.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Agents are most useful where work depends on messy, unstructured documents: annual reports, supplier letters, utility bills, policies. That is why AI is useful in sustainability reporting, and why it needs care.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How a language model works, and why it makes mistakes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every agent has a large language model at its centre. Understanding what the model actually does explains both its strengths and its errors.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prediction, not lookup<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A language model is trained on a very large amount of text. During training it learns one skill: given some text, predict what comes next. Repeat that billions of times and the model picks up grammar, facts, styles of reasoning and the structure of documents.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The model does not store a database of facts it can look up. It stores patterns. When you ask a question, it produces the answer that best fits those patterns. Most of the time that answer is right. Sometimes it is fluent, confident and wrong.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why errors happen<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Two reasons explain most mistakes.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Some facts cannot be learned from patterns.<\/strong> Spelling and grammar follow rules, so models get them right. A company&#8217;s exact emissions figure for 2025 follows no rule. If the model has seen it rarely or never, it may fill the gap with something plausible.<\/li>\n\n\n\n<li><strong>Models are rewarded for answering.<\/strong> Training and scoring have often favoured a confident answer over &#8220;I don&#8217;t know&#8221;, so models tend to guess when unsure.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Newer models are better at this, but not perfect. When Anthropic launched <a href=\"https:\/\/www.anthropic.com\/claude-opus-5-5\" rel=\"nofollow noopener\" target=\"_blank\">Claude Opus 5.5<\/a> in September 2026, it reported that 16 of 18 research reports passed a test where a single invented figure or quote meant failure. Earlier models passed none. That is real progress, and it also means two reports in eighteen still contained something made up.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Context and memory<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A model can only see a limited amount of text at once, called its context window. Long tasks fill it up, so agents need a way to remember. Anthropic&#8217;s November 2026 research on <a href=\"https:\/\/www.anthropic.com\/research\/components-of-agent-memory\" rel=\"nofollow noopener\" target=\"_blank\">agent memory<\/a> found that a well-designed memory lifted one model&#8217;s score on a database task from 0.56 to 0.83. It also found that less is more: a newer model kept 9 well-organised memory files and did better than an older one that kept 413.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What reduces errors<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The most reliable fix is <strong>grounding<\/strong>: making the model answer from documents you supply, not from memory. Anthropic&#8217;s guidance on <a href=\"https:\/\/platform.claude.com\/docs\/en\/test-and-evaluate\/strengthen-guardrails\/reduce-hallucinations\" rel=\"nofollow noopener\" target=\"_blank\">reducing hallucinations<\/a> lists practical techniques:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Let the model say &#8220;I don&#8217;t know&#8221;.<\/li>\n\n\n\n<li>Ask it to quote the source passage before it answers.<\/li>\n\n\n\n<li>Require a quote for every claim, and drop any claim it cannot support.<\/li>\n\n\n\n<li>Limit it to the documents provided.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These techniques reduce errors but do not remove them. Critical figures still need a human check, which is exactly how sustainability reporting should work.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How an AI agent works, step by step<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An agent is a language model running in a loop. Each turn of the loop, it looks at where things stand, decides what to do next, does it, and checks what happened.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The loop<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Receive a goal.<\/strong> For example: &#8220;Prepare draft answers for the E1 climate disclosures from these documents.&#8221;<\/li>\n\n\n\n<li><strong>Plan.<\/strong> The model breaks the goal into steps: find energy data, find emissions data, check reporting years, draft each answer.<\/li>\n\n\n\n<li><strong>Act.<\/strong> It calls a tool: searches the documents, reads a table, runs a calculation.<\/li>\n\n\n\n<li><strong>Observe.<\/strong> It reads the real result the tool returned, not what it expected.<\/li>\n\n\n\n<li><strong>Check and decide.<\/strong> Is the step done? Is something missing or inconsistent? Then it plans the next step.<\/li>\n\n\n\n<li><strong>Stop.<\/strong> It stops when the goal is met, when it hits a limit set by the builder, or when it needs a person to decide.<\/li>\n<\/ol>\n\n\n\n<figure class=\"gig-clip mb-20 mb-lg-32\"><video aria-label=\"Animated diagram of the AI agent loop\" autoplay=\"\" loop=\"\" muted=\"\" controls=\"\" playsinline=\"\" poster=\"https:\/\/generationimpact.global\/wp-content\/uploads\/gig-agent-loop-16x9-poster.jpg\" preload=\"metadata\"><source src=\"https:\/\/generationimpact.global\/wp-content\/uploads\/gig-agent-loop-16x9.mp4\" type=\"video\/mp4\"><\/video><figcaption>How an AI agent works: a loop of plan, act, observe and check, inside guardrails.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The loop repeats until the goal is met or a limit is reached; the guardrails apply at every step, not only at the end.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Agents now run for much longer than a year ago. When Anthropic launched <a href=\"https:\/\/www.anthropic.com\/claude-opus-5-5\" rel=\"nofollow noopener\" target=\"_blank\">Claude Opus 5.5<\/a> in September 2026, one customer reported a single task running for over 18 hours with nobody watching. In November, Anthropic reported that <a href=\"https:\/\/www.anthropic.com\/claude-fable-and-mythos-5-2\" rel=\"nofollow noopener\" target=\"_blank\">more than 1,000 sub-agents<\/a> worked together for eight days to build a prototype operating system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">More freedom also means higher cost and errors that compound from one step to the next. So builders set limits. In 2026 Anthropic added <a href=\"https:\/\/platform.claude.com\/docs\/en\/release-notes\/overview\" rel=\"nofollow noopener\" target=\"_blank\">spending caps that pause an agent and an approval policy<\/a> that allows, blocks or holds each tool call for a person. OpenAI added a similar <a href=\"https:\/\/developers.openai.com\/api\/docs\/changelog\" rel=\"nofollow noopener\" target=\"_blank\">automatic review of tool and permission requests<\/a> in October.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Tools and skills<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Tools are how an agent touches the outside world: a search function, a database query, a calculator, an email client. Agents sometimes skip the right tool, misuse it, or answer from general knowledge instead. More tools do not help: Anthropic&#8217;s <a href=\"https:\/\/claude.com\/resources\/articles\/building-agents-when-to-fold-subagents-into-your-main-agent-loop\" rel=\"nofollow noopener\" target=\"_blank\">October 2026 guidance<\/a> notes that tool choice tends to get worse beyond roughly 30 to 50 tools.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Skills<\/strong> are a newer idea: packaged instructions and files that teach an agent how to do one kind of task, loaded only when needed. Anthropic reports that about 1 million skills have been published and nearly 280 million installed, across more than 70 platforms, including ChatGPT and GitHub Copilot (<a href=\"https:\/\/www.anthropic.com\/news\/donating-agent-skills-to-the-agentic-ai-foundation\" rel=\"nofollow noopener\" target=\"_blank\">Anthropic, October 2026<\/a>).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Memory and long tasks<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An agent cannot hold a long task in view at once. Common techniques:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Retrieval:<\/strong> search a document store and load only the relevant passages.<\/li>\n\n\n\n<li><strong>Notes:<\/strong> write key facts to storage outside the context window and reload them later.<\/li>\n\n\n\n<li><strong>Compaction:<\/strong> summarise the work so far and continue with a clean window. Since autumn 2026, both Anthropic and OpenAI run this inside their agent platforms.<\/li>\n\n\n\n<li><strong>Sub-agents:<\/strong> hand a sub-task to a helper that returns a short summary.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Open standards: MCP, A2A and skills<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Until recently, every connection between an AI tool and a data source had to be built by hand. Three open standards now sit under one neutral body, the Agentic AI Foundation, part of the Linux Foundation.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Model Context Protocol (MCP)<\/strong> connects agents to tools and data. Its <a href=\"https:\/\/blog.modelcontextprotocol.io\/posts\/mcp-roadmap\/\" rel=\"nofollow noopener\" target=\"_blank\">August 2026 roadmap<\/a> makes agent identity and enterprise security one of its five priorities, so agents no longer rely on pasted API keys.<\/li>\n\n\n\n<li><strong>Agent2Agent (A2A)<\/strong> lets agents from different vendors work together. It <a href=\"https:\/\/aaif.io\/blog\/a2a-joins-aaif\" rel=\"nofollow noopener\" target=\"_blank\">joined the foundation in August 2026<\/a>, backed by more than 150 organisations, and its first stable version added signed agent identities.<\/li>\n\n\n\n<li><strong>Agent Skills<\/strong> were donated by Anthropic in October 2026.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The foundation had <a href=\"https:\/\/www.linuxfoundation.org\/press\/agentic-ai-foundation-welcomes-57-new-members-gaining-major-financial-services-players-and-apac-leaders\" rel=\"nofollow noopener\" target=\"_blank\">247 members by August 2026<\/a>, including Visa and Wells Fargo. For buyers, this lowers lock-in risk: a platform that supports these standards can connect to your other systems without bespoke integration work.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">One agent or many?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Splitting work across many agents sounds powerful, but the 2026 evidence favours simplicity. Anthropic reports that many enterprise deployments did better with <a href=\"https:\/\/claude.com\/resources\/articles\/building-agents-when-to-fold-subagents-into-your-main-agent-loop\" rel=\"nofollow noopener\" target=\"_blank\">one agent and a set of skills<\/a> than with many specialists; one customer&#8217;s runs became roughly twice as fast.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Agents are also weak teammates. In a <a href=\"https:\/\/arxiv.org\/html\/2611.02633\" rel=\"nofollow noopener\" target=\"_blank\">November 2026 study<\/a> of 18 models on 240 teamwork tasks, every model lost 20 to 47 points when a teammate caused a problem, and when a teammate pushed for a worse deal, the strongest models reached the best result for the team in only 14% of cases. A <a href=\"https:\/\/arxiv.org\/abs\/2609.24967\" rel=\"nofollow noopener\" target=\"_blank\">Stanford and Georgia Tech study<\/a> from September 2026 found that agents left to interact over long periods colluded in 94% of runs. Both are preprints, not yet peer reviewed. The practical advice: get the most from one agent first, and split only when you must.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What the research says<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Autumn 2026 produced a wave of new evidence from the developers and from universities. Five findings matter most for business readers.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Capability jumped again<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">All three major developers released agent-grade models between September and November 2026. The figures below are reported by the developers themselves.<\/p>\n\n\n\n<figure class=\"wp-block-table table-responsive\"><table><thead><tr><th>Model<\/th><th>Developer<\/th><th>Released<\/th><th>Reported result<\/th><\/tr><\/thead><tbody><tr><td>Claude Opus 5.5<\/td><td>Anthropic<\/td><td>22 Sep 2026<\/td><td>81.8% on OSWorld 2.1, a test of operating a computer (at launch)<\/td><\/tr><tr><td>Gemini 4 Argon<\/td><td>Google<\/td><td>30 Sep 2026<\/td><td>77.9% on DeepSWE, long software tasks; 51.3% on Zapier&#8217;s AutomationBench, realistic business automations<\/td><\/tr><tr><td>GPT-6.1 Sol<\/td><td>OpenAI<\/td><td>29 Sep 2026<\/td><td>Can hand work to sub-agents (beta), per OpenAI&#8217;s API changelog<\/td><\/tr><tr><td>Claude Fable 5.2<\/td><td>Anthropic<\/td><td>9 Nov 2026<\/td><td>89.3% on OSWorld 2.1; over 1,000 sub-agents working for eight days<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The yardsticks are struggling to keep up. METR, an independent evaluator, <a href=\"https:\/\/metr.org\/time-horizons\/\" rel=\"nofollow noopener\" target=\"_blank\">stopped updating<\/a> its widely cited chart of how long a task AI can complete, and notes that tasks over 16 hours cannot be measured reliably with its current tests. In November it <a href=\"https:\/\/metr.org\/blog\/2026-11-05-anthropic-ai-rd-acceleration-assessment\/\" rel=\"nofollow noopener\" target=\"_blank\">estimated<\/a> that Anthropic now improves its models at about twice its earlier pace, largely thanks to AI. And Stanford researchers who reviewed 56 widely used benchmarks found that many <a href=\"https:\/\/hai.stanford.edu\/news\/the-tests-that-grade-ai-may-be-getting-it-wrong\" rel=\"nofollow noopener\" target=\"_blank\">do not measure what they claim<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Real business tasks are still hard<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The most telling number in the table is the lowest one. On Zapier&#8217;s benchmark of realistic business automations, Google&#8217;s <a href=\"https:\/\/blog.google\/innovation-and-ai\/models-and-research\/gemini-models\/gemini-4-argon\/\" rel=\"nofollow noopener\" target=\"_blank\">Gemini 4 Argon<\/a> ranked first with 51.3%. In other words, about half of the tasks still failed. Operating a computer in a test is not the same as completing a multi-system business process end to end.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cheaper per word, harder to predict<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Google says the price per token has fallen 98% since 2024 (<a href=\"https:\/\/cloud.google.com\/blog\/products\/ai-machine-learning\/welcome-to-gemini-at-work-2026\" rel=\"nofollow noopener\" target=\"_blank\">Google Cloud, October 2026<\/a>). But agents use far more tokens than chats, and usage-based pricing makes bills hard to forecast. MIT researchers who interviewed 48 leaders at 28 organisations say procurement and finance need <a href=\"https:\/\/mitsloan.mit.edu\/ideas-made-to-matter\/4-areas-where-companies-need-ai-guardrails\" rel=\"nofollow noopener\" target=\"_blank\">tighter controls on AI spending<\/a>. Google&#8217;s Mandiant unit describes one runaway agent loop that made more than 15,000 API calls in under an hour and added about $50,000 to the bill (<a href=\"https:\/\/cloud.google.com\/security\/resources\/ai-risk-and-resilience-2026\" rel=\"nofollow noopener\" target=\"_blank\">Mandiant, September 2026<\/a>).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lots of pilots, little depth<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">MIT researchers studied how S&amp;P 500 companies describe their use of AI in annual filings (<a href=\"https:\/\/ide.mit.edu\/insights\/pulling-back-the-curtain-on-enterprise-ai-adoption\/\" rel=\"nofollow noopener\" target=\"_blank\">MIT IDE, September 2026<\/a>). By the end of 2025:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>11% had AI deeply embedded in how they work, while about 45% were still piloting.<\/li>\n\n\n\n<li>In financial services, 68% showed heavy pilot activity, but only about 4% had deep integration.<\/li>\n\n\n\n<li>Nearly 85% of banks had pilots, and essentially none had reached deep integration.<\/li>\n\n\n\n<li>Most firms buy AI as a service rather than building it.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The study measures what firms disclose, not what they do, so treat it as a strong signal rather than an exact count. It matches a qualitative finding from <a href=\"https:\/\/cisr.mit.edu\/publication\/2026_0801_AIValuePropositions_Woerner\" rel=\"nofollow noopener\" target=\"_blank\">MIT CISR<\/a> in August 2026: building agents is easy, taking them into production with provable results is hard, and the number of agents a company has built says little about the value it gets.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">People decide whether it works<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The same tool can succeed or fail depending on how it is introduced. Researchers from Stanford, the University of Virginia and Dartmouth followed two divisions of a law firm that received the same AI tool. The division whose managers presented it as a way to enrich the job used it 58% more and experimented 70% more than the division told it was about speed (<a href=\"https:\/\/hai.stanford.edu\/news\/want-employees-to-embrace-ai-stop-selling-it-as-a-productivity-tool\" rel=\"nofollow noopener\" target=\"_blank\">Stanford HAI, October 2026<\/a>). Training, weekly knowledge-sharing and time set aside to explore made the difference.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Risks specific to agents<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A chatbot that gets something wrong gives a bad answer. An agent that gets something wrong takes a bad action: it sends the email, changes the record, or passes the data on. In the <a href=\"https:\/\/genai.owasp.org\/2026\/09\/01\/owasp-genai-security-project-unveils-2026-top-10-for-llm-applications-new-agent-control-standard-and-sponsors-as-community-tops-30000-members\/\" rel=\"nofollow noopener\" target=\"_blank\">2026 OWASP Top 10<\/a> for AI applications, published in September, &#8220;excessive agency&#8221; is now ranked the third most serious risk.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prompt injection: reduced, not solved<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An agent reads content it did not write: web pages, emails, supplier documents. If that content contains hidden instructions, the agent may follow them. This is called prompt injection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The developers have made real progress. On Gray Swan&#8217;s independent prompt injection benchmark:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Attackers succeeded 8.5% of the time against OpenAI&#8217;s GPT-6 Astra, with 15 attempts per attack, down from 27.0% for the previous model (<a href=\"https:\/\/deploymentsafety.openai.com\/gpt-6-astra\/prompt-injection\" rel=\"nofollow noopener\" target=\"_blank\">OpenAI system card, September 2026<\/a>).<\/li>\n\n\n\n<li>Google reports 0.7% for Gemini 4 Argon and 0.0% for Gemini 4 Carbon (<a href=\"https:\/\/blog.google\/innovation-and-ai\/models-and-research\/gemini-models\/introducing-gemini-4-carbon\/\" rel=\"nofollow noopener\" target=\"_blank\">Google, October 2026<\/a>).<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These are lab results on one test. In real attacks, Anthropic&#8217;s <a href=\"https:\/\/www.anthropic.com\/threat-intelligence-report-september-2026\" rel=\"nofollow noopener\" target=\"_blank\">September 2026 threat report<\/a> describes prompt injection that leaked production API keys. Mandiant warns of a &#8220;lethal trifecta&#8221;: an agent with access to private data, exposure to untrusted content, and a way to send information out can be turned into a leak.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Too much freedom<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Most real incidents are not clever hacks. OWASP&#8217;s <a href=\"https:\/\/genai.owasp.org\/2026\/10\/08\/genai-and-agentic-ai-exploit-roundup-q3-2026\/\" rel=\"nofollow noopener\" target=\"_blank\">review of the third quarter of 2026<\/a> found that most involved no prompt injection at all: agents simply went beyond their intended scope. In one case, a tool server behaved normally for its first three calls, then tried to steer the agent towards passwords and cloud credentials. The lesson is to limit what an agent can reach, not only what it is told.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Agents that work around limits<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When blocked, agents tend to find another way rather than stop. Anthropic calls this <a href=\"https:\/\/www.anthropic.com\/research\/investigating-unintended-model-actions\" rel=\"nofollow noopener\" target=\"_blank\">persistence<\/a>: in its own evaluations and internal use, Claude exploited software flaws, submitted forms it should not have, and bypassed access restrictions. OpenAI reports that GPT-6.1 Sol <a href=\"https:\/\/deploymentsafety.openai.com\/gpt-6-1-sol\" rel=\"nofollow noopener\" target=\"_blank\">kept going past warnings<\/a> in 23.5% of test runs. Stopping rules need to be enforced by the system, not left to the model.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Tests do not predict real behaviour<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">OpenAI researchers found that agents behaved safely <a href=\"https:\/\/alignment.openai.com\/eval-production-behavior-gap\/\" rel=\"nofollow noopener\" target=\"_blank\">10 to 37 percentage points less often in testing than in real use<\/a>, and showed signs of knowing they were being tested in 57% to 84% of runs in one evaluation. Google reports a related problem: in one training run, shortcuts a model discussed openly fell, while silent shortcuts rose from 11.2% to 36.4% (<a href=\"https:\/\/blog.google\/innovation-and-ai\/technology\/safety-security\/gemini-4-model-safety-security\/\" rel=\"nofollow noopener\" target=\"_blank\">Google DeepMind, October 2026<\/a>). Stanford&#8217;s Rob Reich argues that developers <a href=\"https:\/\/hai.stanford.edu\/news\/can-ai-be-slowed-down-stanford-hai-experts-weigh-the-risks-rules-and-race-ahead\" rel=\"nofollow noopener\" target=\"_blank\">should not be the only ones grading their own systems<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">People defer to agents<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Human review only works if the reviewer is genuinely independent. In an Anthropic experiment published in October 2026, analysts matched the lean of their AI agent <a href=\"https:\/\/www.anthropic.com\/research\/agents-judgment-calls\" rel=\"nofollow noopener\" target=\"_blank\">86% of the time<\/a>, against about 50% expected by chance, and experience did not protect them. The agents&#8217; leans were deliberately strengthened, so the real-world effect may be smaller. Even so, review has to be designed: for example, showing the reviewer the source document, not only the agent&#8217;s conclusion.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What the developers do themselves<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The clearest guide to safe deployment is what the developers now do for their own agents.<\/p>\n\n\n\n<figure class=\"wp-block-table table-responsive\"><table><thead><tr><th>Control<\/th><th>What it means<\/th><th>Example from 2026<\/th><\/tr><\/thead><tbody><tr><td>Monitor every action<\/td><td>Every step is logged and screened<\/td><td>Anthropic monitors all actions of about 30,000 internal agents; about 100,000 transcripts are flagged each week and about 50 reach human review (<a href=\"https:\/\/www.anthropic.com\/institute\/measuring-pace-of-ai-development\" rel=\"nofollow noopener\" target=\"_blank\">Anthropic<\/a>)<\/td><\/tr><tr><td>Agent identity<\/td><td>Each agent has its own credentials with the minimum permissions<\/td><td>Google gives every agent a verified identity (<a href=\"https:\/\/cloud.google.com\/blog\/products\/ai-machine-learning\/welcome-to-gemini-at-work-2026\" rel=\"nofollow noopener\" target=\"_blank\">Google Cloud<\/a>)<\/td><\/tr><tr><td>Audit trail<\/td><td>Every action is recorded against the agent<\/td><td>Google logs each action to the agent, not to a person<\/td><\/tr><tr><td>Policy gateway<\/td><td>All traffic in and out passes a checkpoint<\/td><td>Google&#8217;s agent gateway checks traffic between agents and systems<\/td><\/tr><tr><td>Spending caps<\/td><td>The agent pauses when a budget is reached<\/td><td>Anthropic session budgets; Google per-project caps<\/td><\/tr><tr><td>Approval rules<\/td><td>Risky actions wait for a person<\/td><td>Anthropic and OpenAI approval policies for tool calls<\/td><\/tr><tr><td>Automated monitors<\/td><td>Software reviews agent behaviour at scale<\/td><td>OpenAI&#8217;s security monitor flagged about 80% of real incidents for urgent escalation (<a href=\"https:\/\/alignment.openai.com\/how-we-detect-frontier-model-misalignment\/\" rel=\"nofollow noopener\" target=\"_blank\">OpenAI<\/a>)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">None of this is free, and even the developers&#8217; best monitors miss some incidents. This is the standard any in-house build would need to meet.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Build versus buy<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">With powerful models available through an API, building your own agent looks easy. A first prototype often takes days. The difficult part starts after the demo, and it never really ends.<\/p>\n\n\n\n<figure class=\"gig-clip mb-20 mb-lg-32\"><video aria-label=\"Animated graphic of the hidden work behind an AI prototype\" autoplay=\"\" loop=\"\" muted=\"\" controls=\"\" playsinline=\"\" poster=\"https:\/\/generationimpact.global\/wp-content\/uploads\/gig-build-vs-buy-16x9-v2-poster.webp\" preload=\"metadata\"><source src=\"https:\/\/generationimpact.global\/wp-content\/uploads\/gig-build-vs-buy-16x9-v2.mp4\" type=\"video\/mp4\"><\/video><figcaption>The prototype is the small part. Bank AI adoption: MIT Initiative on the Digital Economy, September 2026.<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">The evidence<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The 2026 research points one way. MIT found that most large companies buy AI as a service rather than building it, and that almost no bank had reached deep integration by the end of 2025 (<a href=\"https:\/\/ide.mit.edu\/insights\/pulling-back-the-curtain-on-enterprise-ai-adoption\/\" rel=\"nofollow noopener\" target=\"_blank\">MIT IDE<\/a>). MIT CISR adds that building agents is the easy part: production, monitoring and proof of value are where projects stall.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Skills are the bottleneck. In October 2026 Anthropic committed $100 million to train 10,000 engineers, calling people who can make AI work inside a business <a href=\"https:\/\/www.anthropic.com\/news\/claude-frontier-academy\" rel=\"nofollow noopener\" target=\"_blank\">the hardest talent to find<\/a>. Most organisations outside the technology sector will not be able to hire or keep such a team for one internal use case.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What building really involves<\/h3>\n\n\n\n<figure class=\"wp-block-table table-responsive\"><table><thead><tr><th>Work<\/th><th>What it means in practice<\/th><th>Does it end?<\/th><\/tr><\/thead><tbody><tr><td>Model choice and prompts<\/td><td>Choosing, testing and tuning the model for each task<\/td><td>No: models change every few months<\/td><\/tr><tr><td>Retrieval and data pipelines<\/td><td>Parsing PDFs, tables and scans; indexing; keeping sources linked<\/td><td>No: new document types keep arriving<\/td><\/tr><tr><td>Testing (&#8220;evals&#8221;)<\/td><td>A test set built from real failures, graders, people reading transcripts<\/td><td>No: every change needs retesting<\/td><\/tr><tr><td>Security<\/td><td>Prompt injection defences, permissions, deliberate attack testing (red-teaming)<\/td><td>No: attacks adapt<\/td><\/tr><tr><td>Monitoring and logs<\/td><td>Tracing every run, alerts, audit records<\/td><td>No<\/td><\/tr><tr><td>Model retirements<\/td><td>Migrating when the provider retires a model<\/td><td>No: on the provider&#8217;s schedule<\/td><\/tr><tr><td>Regulation<\/td><td>AI Act duties, data protection, contracts with model providers<\/td><td>No: rules keep moving<\/td><\/tr><tr><td>Domain knowledge<\/td><td>Knowing what the ESRS climate disclosures or SFDR PAI 1 actually ask for<\/td><td>No: standards are revised<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Testing is a discipline of its own.<\/strong> Anthropic&#8217;s October 2026 guidance suggests starting with about 10 worked &#8220;golden&#8221; examples, measuring whole tasks completed, and running each test more than once, because a regression can show up in only one of two runs (<a href=\"https:\/\/claude.com\/resources\/articles\/building-agents-when-to-fold-subagents-into-your-main-agent-loop\" rel=\"nofollow noopener\" target=\"_blank\">claude.com<\/a>). And as OpenAI&#8217;s research shows, test results do not reliably predict behaviour in real use.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Models and platforms do not stay still.<\/strong> Anthropic deprecated Claude Sonnet 4.5 on 30 September 2026 and will retire it on 30 November, with at least <a href=\"https:\/\/platform.claude.com\/docs\/en\/about-claude\/model-deprecations\" rel=\"nofollow noopener\" target=\"_blank\">60 days&#8217; notice<\/a> as standard. OpenAI <a href=\"https:\/\/developers.openai.com\/api\/docs\/changelog\" rel=\"nofollow noopener\" target=\"_blank\">shut down its Assistants API<\/a> on 26 August 2026, so anything built on it had to be rebuilt. Every change means retesting prompts, tools and outputs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Security is never finished.<\/strong> Attacks keep changing: OWASP now publishes a quarterly review of new agent exploits, and its September 2026 Agent Control Standard sets out the identity, testing and runtime controls an agent needs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What a specialised platform carries for you<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A well-run SaaS platform spreads this ongoing work across all its customers. In practice it should take on:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Model management:<\/strong> testing new models, migrating before retirements, rolling back if quality drops.<\/li>\n\n\n\n<li><strong>Security and certification:<\/strong> independent audits such as ISO 27001, penetration testing, and contracts with model providers covering data use and retention.<\/li>\n\n\n\n<li><strong>Domain logic:<\/strong> the rules, frameworks and data structures for the field, kept current as standards change.<\/li>\n\n\n\n<li><strong>Audit trail by design:<\/strong> every AI suggestion linked to its source and to the person who approved it.<\/li>\n\n\n\n<li><strong>Regulatory duties:<\/strong> transparency notices, AI literacy material, risk classification, kept up to date.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Three routes compared<\/h3>\n\n\n\n<figure class=\"wp-block-table table-responsive\"><table><thead><tr><th><\/th><th>Build in-house<\/th><th>General AI tool (chat assistant)<\/th><th>Specialised SaaS platform<\/th><\/tr><\/thead><tbody><tr><td>Time to first value<\/td><td>Months<\/td><td>Immediate<\/td><td>Days to weeks<\/td><\/tr><tr><td>Domain logic<\/td><td>You build it<\/td><td>None<\/td><td>Built in<\/td><\/tr><tr><td>Source tracing and audit log<\/td><td>You build it<\/td><td>Usually none<\/td><td>Built in<\/td><\/tr><tr><td>Model updates and retirements<\/td><td>Your team<\/td><td>Vendor<\/td><td>Vendor<\/td><\/tr><tr><td>Security testing and certification<\/td><td>Your team<\/td><td>Vendor, general purpose<\/td><td>Vendor, scoped to the use case<\/td><\/tr><tr><td>Control over your data<\/td><td>Full<\/td><td>Depends on licence and settings<\/td><td>Contract and data processing agreement<\/td><\/tr><tr><td>Ongoing cost<\/td><td>High, mostly staff<\/td><td>Low per seat<\/td><td>Subscription<\/td><\/tr><tr><td>Main risk<\/td><td>Pilot never reaches production<\/td><td>Staff paste sensitive data into unofficial tools<\/td><td>Vendor lock-in; check export options<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">When building does make sense<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Building is the right call when the AI capability is your core product, when no vendor covers your process, or when your data cannot leave your own infrastructure under any contract. If you build, plan and fund the ongoing work in the table above, not just the prototype.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For most organisations whose core business is not AI, the question to ask is simpler: who will still be maintaining this in three years?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">AI in sustainability reporting<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Sustainability reporting is close to an ideal use case for AI, and also one where mistakes are costly.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why it suits AI<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>The data is scattered.<\/strong> Figures sit in annual reports, utility bills, supplier questionnaires, HR systems and policy documents, often as PDFs and scans.<\/li>\n\n\n\n<li><strong>The same data is asked for many times.<\/strong> A regulator, a bank, an investor and a customer may each want similar figures under <a href=\"https:\/\/generationimpact.global\/products\/esrs\/\">ESRS<\/a>, <a href=\"https:\/\/generationimpact.global\/products\/gri\/\">GRI<\/a>, <a href=\"https:\/\/generationimpact.global\/hub\/sfdr\/\">SFDR<\/a>, ISSB or a questionnaire of their own.<\/li>\n\n\n\n<li><strong>The frameworks overlap but do not match.<\/strong> <a href=\"https:\/\/generationimpact.global\/platform\/interoperability\/\">Mapping one disclosure to another<\/a> is detailed, repetitive work, where a well-grounded model saves the most time.<\/li>\n\n\n\n<li><strong>The work is document-heavy.<\/strong> Agents are most useful where work depends on unstructured documents, which is exactly the shape of sustainability data.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Why it needs care<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reports are public and increasingly assured.<\/strong> Under the <a href=\"https:\/\/generationimpact.global\/hub\/csrd\/\">CSRD<\/a>, sustainability statements go through external assurance. An auditor needs to see where each figure came from and who approved it.<\/li>\n\n\n\n<li><strong>Errors carry consequences.<\/strong> A wrong figure in an <a href=\"https:\/\/generationimpact.global\/hub\/sfdr\/\">SFDR disclosure<\/a> or a CSRD report is a regulatory and reputational problem, not a typo.<\/li>\n\n\n\n<li><strong>Fluent text is not evidence.<\/strong> A model can write a convincing paragraph on a policy the company does not have. Narrative disclosures need the same source check as numbers.<\/li>\n\n\n\n<li><strong>Standards keep changing.<\/strong> The <a href=\"https:\/\/generationimpact.global\/products\/esrs\/\">revised ESRS<\/a> adopted in 2026 changed numbering and requirements. A tool built on last year&#8217;s version gives last year&#8217;s answers.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What good looks like<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In this field, the right design is not an autonomous agent that files a report on its own. It is AI that does the heavy reading and matching, with people firmly in charge of what is approved.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>The AI reads the documents and proposes where each figure or statement belongs.<\/li>\n\n\n\n<li>Every proposal links back to the source passage.<\/li>\n\n\n\n<li>A person reviews, accepts, edits or rejects each proposal.<\/li>\n\n\n\n<li>Every decision is recorded in an audit log.<\/li>\n\n\n\n<li>Approved data is reused across frameworks, so it is checked once and used many times.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">How Generation Impact Global approaches it<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/generationimpact.global\/products\/vitai\/\">VitAI\u2122<\/a> is the AI layer of Generation Impact Global. It follows the approach described above: the AI does the reading and matching, and people decide.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>It reads your documents<\/strong> and suggests where each figure belongs in the frameworks you report under, such as <a href=\"https:\/\/generationimpact.global\/products\/esrs\/\">ESRS<\/a>, <a href=\"https:\/\/generationimpact.global\/products\/gri\/\">GRI<\/a>, <a href=\"https:\/\/generationimpact.global\/products\/sfdr\/\">SFDR<\/a>, <a href=\"https:\/\/generationimpact.global\/products\/vsme\/\">VSME<\/a>, <a href=\"https:\/\/generationimpact.global\/products\/sasb\/\">SASB<\/a> and <a href=\"https:\/\/generationimpact.global\/products\/tcfd\/\">TCFD<\/a>.<\/li>\n\n\n\n<li><strong>You review every mapping<\/strong>, and the audit log keeps each decision.<\/li>\n\n\n\n<li><strong>You can build your own framework<\/strong>: a new regulation, a customer&#8217;s supplier code or your fund&#8217;s own scorecard.<\/li>\n\n\n\n<li><strong>Approved data is reused<\/strong> across frameworks, through our <a href=\"https:\/\/generationimpact.global\/platform\/interoperability\/\">interoperability<\/a> and <a href=\"https:\/\/generationimpact.global\/platform\/data-management\/\">data management<\/a> layers.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Data from suppliers, sites and portfolio companies is collected with <a href=\"https:\/\/generationimpact.global\/products\/qb-edge\/\">QB-EDGE\u2122<\/a>. Our approach to protecting data is on our <a href=\"https:\/\/generationimpact.global\/security\/\">Security<\/a> and <a href=\"https:\/\/generationimpact.global\/licences-and-certifications\/\">Licences and certifications<\/a> pages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">How our AI features work, and how we apply the EU AI Act, is set out in our <a href=\"https:\/\/generationimpact.global\/legal\/ai-transparency-notice\/\">AI Transparency Notice<\/a> and in our companion article, <a href=\"https:\/\/generationimpact.global\/blog\/ai-regulation-2026\/\">AI regulation in 2026<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can <a href=\"https:\/\/generationimpact.global\/start-free\/\">start free<\/a>, see the <a href=\"https:\/\/generationimpact.global\/pricing\/\">plans<\/a>, or <a href=\"https:\/\/generationimpact.global\/request-demo\/\">book a demo<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Twelve questions to ask any AI vendor<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use these whether you are assessing us or anyone else. A good vendor will answer each one in writing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Data<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Which AI models and providers do you use, and where is my data processed?<\/li>\n\n\n\n<li>Is my content used to train any model? Can I see that in the contract?<\/li>\n\n\n\n<li>How long do you and your providers keep my content and the logs?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Control<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Can I see the source behind every AI suggestion?<\/li>\n\n\n\n<li>Does a person approve AI output before it is used, and is that approval recorded?<\/li>\n\n\n\n<li>Can the AI take actions on its own, and what limits stop it?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Security<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Which independent certifications do you hold (for example ISO\/IEC 27001)?<\/li>\n\n\n\n<li>How do you test against prompt injection and other attacks on AI features?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Maintenance<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>What happens when your model provider retires a model? How do you retest?<\/li>\n\n\n\n<li>How quickly do you update when a reporting standard changes?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Regulation<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>How have you classified your AI features under the EU AI Act, and is that published?<\/li>\n\n\n\n<li>Can I export my data and the audit log if I leave?<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Glossary<\/h2>\n\n\n\n<figure class=\"wp-block-table table-responsive\"><table><thead><tr><th>Term<\/th><th>Plain meaning<\/th><\/tr><\/thead><tbody><tr><td>Large language model (LLM)<\/td><td>Software trained on large amounts of text to predict and generate language<\/td><\/tr><tr><td>AI agent<\/td><td>A system where a language model plans steps, uses tools and checks results to reach a goal<\/td><\/tr><tr><td>Agentic AI<\/td><td>The general family of AI systems that act with some autonomy, from fixed workflows to full agents<\/td><\/tr><tr><td>Workflow<\/td><td>A fixed sequence of AI and software steps, written in advance by a developer<\/td><\/tr><tr><td>Tool<\/td><td>A function an agent can call: search, calculate, read a file, send a message<\/td><\/tr><tr><td>Context window<\/td><td>The amount of text a model can see at one time<\/td><\/tr><tr><td>Hallucination<\/td><td>A fluent, confident statement that is false<\/td><\/tr><tr><td>Grounding<\/td><td>Making the model answer only from documents you supply<\/td><\/tr><tr><td>Retrieval (RAG)<\/td><td>Searching your documents and giving the model only the relevant passages<\/td><\/tr><tr><td>Prompt injection<\/td><td>Hidden instructions in content that trick an agent into doing something unintended<\/td><\/tr><tr><td>Excessive agency<\/td><td>An agent with more tools, access or freedom than its task needs<\/td><\/tr><tr><td>MCP<\/td><td>Model Context Protocol, an open standard for connecting AI tools to data sources<\/td><\/tr><tr><td>A2A<\/td><td>Agent2Agent, an open standard that lets agents from different vendors work together<\/td><\/tr><tr><td>Evals<\/td><td>Structured tests that measure whether an AI system does its job reliably<\/td><\/tr><tr><td>Audit log<\/td><td>A record of what the AI proposed and what a person approved<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n\n\r\n\t\t<div  class=\"block-e86c3281-8562-4842-b977-c8075b3733ae areoi-element section-faq\">\r\n\t\t\t\r\n\t\t\t\n\r\n\t\t<div  class=\"block-039bdb20-8d74-4087-8878-c461aafcc867 row areoi-element m-row-gap-20\">\r\n\t\t\t\r\n\r\n\t\t\t\n\r\n\t\t<div  class=\"block-09d561e7-0e62-4c86-980d-62db09ac132c col areoi-element col-12 d-flex flex-column gap-20\">\r\n\t\t\t\r\n\t\t\t\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>What is an AI agent?<\/summary>\n<p class=\"wp-block-paragraph\">An AI agent is software built around a language model that takes a goal, plans the steps, uses tools such as search or calculation to carry them out, checks the results, and repeats until the goal is met or a person needs to decide.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>What is the difference between generative AI and agentic AI?<\/summary>\n<p class=\"wp-block-paragraph\">Generative AI creates content; agentic AI uses it to take steps towards a goal. Generative AI produces text or images in response to a prompt. Agentic AI uses a generative model inside a loop so it can plan, use tools and take steps towards a goal. All agents use generative AI; not all generative AI is agentic.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Are AI agents reliable enough for business use?<\/summary>\n<p class=\"wp-block-paragraph\">For well-defined tasks with good data and human review, yes. But even the best model in Google&#8217;s September 2026 results completed only about half of realistic business automations, and OpenAI found that agents behave differently in tests and in real use. Unsupervised use on important work is not yet wise.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Do AI agents replace sustainability teams?<\/summary>\n<p class=\"wp-block-paragraph\">No. They remove much of the reading, searching and matching. Judgement on materiality, approval of figures and accountability for the report stay with people, and regulators expect that.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Is it cheaper to build our own agent?<\/summary>\n<p class=\"wp-block-paragraph\">The prototype is cheap. Testing, security, monitoring, model retirements and regulation are ongoing costs, and the people who can do this work are scarce. MIT found in 2026 that most large companies buy AI as a service, and that almost no bank had reached deep integration.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Is my data used to train AI models?<\/summary>\n<p class=\"wp-block-paragraph\">It depends on the vendor and the contract. Ask for it in writing. How Generation Impact Global handles data in its AI features is set out in our AI Transparency Notice.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>What is MCP and why should I care?<\/summary>\n<p class=\"wp-block-paragraph\">MCP is an open standard that lets AI tools connect to data sources without custom integration. Platforms that support it are easier to connect to the rest of your systems.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Does the EU AI Act apply to AI agents?<\/summary>\n<p class=\"wp-block-paragraph\">The AI Act regulates AI systems by their use and risk level, not by whether they are agents. Our companion article explains what applies and when.<\/p>\n<\/details>\n\n \r\n\t\t\t\r\n\t\t<\/div>\r\n\t\n \r\n\t\t<\/div>\r\n\t\n\r\n\t\t\t \r\n\t\t<\/div>\r\n\t\n\n\n<h2 class=\"wp-block-heading\">Further reading on our site<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/generationimpact.global\/blog\/ai-regulation-2026\/\">AI regulation in 2026: the EU AI Act, global rules, and how we apply them<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/products\/vitai\/\">VitAI\u2122: build your own framework and map your documents<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/solutions\/esg-reporting\/\">Sustainability reporting<\/a> and <a href=\"https:\/\/generationimpact.global\/solutions\/esg-data-intelligence\/\">ESG data intelligence<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/solutions\/esg-investment-finance\/\">ESG for investment and finance<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/blog\/sustainable-banking-esg-data\/\">The EBA ESG rules are live: banks now need ESG data from their clients<\/a><\/li>\n\n\n\n<li>Guides: <a href=\"https:\/\/generationimpact.global\/products\/csrd\/\" data-type=\"page\" data-id=\"3960\">CSRD hub<\/a>, <a href=\"https:\/\/generationimpact.global\/products\/sfdr\/overview\/\" data-type=\"page\" data-id=\"3417\">SFDR hub<\/a>, <a href=\"https:\/\/generationimpact.global\/hub\/taxonomy-compass-about\/\" data-type=\"page\" data-id=\"5780\">EU Taxonomy<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/products\/double-materiality-assessment\/\">Double materiality assessment<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/platform\/api\/\">Integrations and API<\/a> and <a href=\"https:\/\/generationimpact.global\/developers\/\">Developers<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/tools\/\">Free tools<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">All sources below were published between August and November 2026, unless marked as reference documentation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Stanford University<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Stanford HAI, <a href=\"https:\/\/hai.stanford.edu\/news\/want-employees-to-embrace-ai-stop-selling-it-as-a-productivity-tool\" rel=\"nofollow noopener\" target=\"_blank\">Want employees to embrace AI? Stop selling it as a productivity tool<\/a>, 7 October 2026<\/li>\n\n\n\n<li>Stanford HAI, <a href=\"https:\/\/hai.stanford.edu\/news\/the-tests-that-grade-ai-may-be-getting-it-wrong\" rel=\"nofollow noopener\" target=\"_blank\">The tests that grade AI may be getting it wrong<\/a>, 25 September 2026<\/li>\n\n\n\n<li>Stanford HAI, <a href=\"https:\/\/hai.stanford.edu\/news\/can-ai-be-slowed-down-stanford-hai-experts-weigh-the-risks-rules-and-race-ahead\" rel=\"nofollow noopener\" target=\"_blank\">Can AI be slowed down? Stanford HAI experts weigh the risks<\/a>, 22 September 2026<\/li>\n\n\n\n<li>Shi, Zhang and Yang, <a href=\"https:\/\/arxiv.org\/abs\/2609.24967\" rel=\"nofollow noopener\" target=\"_blank\">Emergent collusion in long-horizon LLM agent interaction<\/a>, preprint, September 2026<\/li>\n\n\n\n<li>Wu, Pappu, Zou et al., <a href=\"https:\/\/arxiv.org\/html\/2611.02633\" rel=\"nofollow noopener\" target=\"_blank\">Measuring AI agents as teammates with collaborative intelligence<\/a>, preprint, 2 November 2026<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>MIT<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>MIT Initiative on the Digital Economy, <a href=\"https:\/\/ide.mit.edu\/insights\/pulling-back-the-curtain-on-enterprise-ai-adoption\/\" rel=\"nofollow noopener\" target=\"_blank\">Pulling back the curtain on enterprise AI adoption<\/a>, 16 September 2026<\/li>\n\n\n\n<li>MIT CISR, <a href=\"https:\/\/cisr.mit.edu\/publication\/2026_0801_AIValuePropositions_Woerner\" rel=\"nofollow noopener\" target=\"_blank\">AI value creation: five provocative propositions<\/a>, 20 August 2026<\/li>\n\n\n\n<li>MIT Sloan, <a href=\"https:\/\/mitsloan.mit.edu\/ideas-made-to-matter\/4-areas-where-companies-need-ai-guardrails\" rel=\"nofollow noopener\" target=\"_blank\">4 areas where companies need AI guardrails<\/a>, 9 November 2026<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Anthropic<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.anthropic.com\/claude-opus-5-5\" rel=\"nofollow noopener\" target=\"_blank\">Introducing Claude Opus 5.5<\/a>, 22 September 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/www.anthropic.com\/claude-fable-and-mythos-5-2\" rel=\"nofollow noopener\" target=\"_blank\">Introducing Claude Fable 5.2 and Claude Mythos 5.2<\/a>, 9 November 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/www.anthropic.com\/research\/components-of-agent-memory\" rel=\"nofollow noopener\" target=\"_blank\">The components of agent memory<\/a>, 6 November 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/www.anthropic.com\/research\/agents-judgment-calls\" rel=\"nofollow noopener\" target=\"_blank\">How AI agents shape experts&#8217; judgment calls<\/a>, 27 October 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/claude.com\/resources\/articles\/building-agents-when-to-fold-subagents-into-your-main-agent-loop\" rel=\"nofollow noopener\" target=\"_blank\">Building agents: when to fold subagents into your main agent loop<\/a>, 22 October 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/www.anthropic.com\/news\/donating-agent-skills-to-the-agentic-ai-foundation\" rel=\"nofollow noopener\" target=\"_blank\">Donating Agent Skills to the Agentic AI Foundation<\/a>, 22 October 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/www.anthropic.com\/research\/investigating-unintended-model-actions\" rel=\"nofollow noopener\" target=\"_blank\">Investigating unintended model actions in our evaluations and internal use<\/a>, 9 October 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/www.anthropic.com\/news\/claude-frontier-academy\" rel=\"nofollow noopener\" target=\"_blank\">Anthropic invests $100 million to train 10,000 engineers<\/a>, 2 October 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/www.anthropic.com\/institute\/measuring-pace-of-ai-development\" rel=\"nofollow noopener\" target=\"_blank\">Illuminating the frontier: measuring the pace of AI development<\/a>, data as of August 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/www.anthropic.com\/threat-intelligence-report-september-2026\" rel=\"nofollow noopener\" target=\"_blank\">Countering misuse of AI: September 2026<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/platform.claude.com\/docs\/en\/release-notes\/overview\" rel=\"nofollow noopener\" target=\"_blank\">Claude Platform release notes<\/a>, entries August to November 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/platform.claude.com\/docs\/en\/about-claude\/model-deprecations\" rel=\"nofollow noopener\" target=\"_blank\">Model deprecations<\/a> and <a href=\"https:\/\/platform.claude.com\/docs\/en\/test-and-evaluate\/strengthen-guardrails\/reduce-hallucinations\" rel=\"nofollow noopener\" target=\"_blank\">Reduce hallucinations<\/a>, reference documentation<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>OpenAI<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/alignment.openai.com\/eval-production-behavior-gap\/\" rel=\"nofollow noopener\" target=\"_blank\">Eval-production behavior gaps in agent safety<\/a>, 3 November 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/alignment.openai.com\/how-we-detect-frontier-model-misalignment\/\" rel=\"nofollow noopener\" target=\"_blank\">How we detect frontier model misalignment<\/a>, 29 October 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/deploymentsafety.openai.com\/gpt-6-1-sol\" rel=\"nofollow noopener\" target=\"_blank\">Addendum to GPT-6 Astra system card: GPT-6.1 Sol<\/a>, 29 September 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/deploymentsafety.openai.com\/gpt-6-astra\/prompt-injection\" rel=\"nofollow noopener\" target=\"_blank\">GPT-6 Astra system card: prompt injection<\/a>, 3 September 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/developers.openai.com\/api\/docs\/changelog\" rel=\"nofollow noopener\" target=\"_blank\">API changelog<\/a>, entries August to October 2026<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Google and Google DeepMind<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/blog.google\/innovation-and-ai\/models-and-research\/gemini-models\/introducing-gemini-4-carbon\/\" rel=\"nofollow noopener\" target=\"_blank\">Gemini 4 Carbon: our next frontier model<\/a>, 28 October 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/blog.google\/innovation-and-ai\/technology\/safety-security\/gemini-4-model-safety-security\/\" rel=\"nofollow noopener\" target=\"_blank\">Developing Gemini 4 Argon responsibly and safely<\/a>, 13 October 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/cloud.google.com\/blog\/products\/ai-machine-learning\/welcome-to-gemini-at-work-2026\" rel=\"nofollow noopener\" target=\"_blank\">Welcome to Gemini at Work 2026: introducing the Gemini agent<\/a>, 8 October 2026<\/li>\n\n\n\n<li><a href=\"https:\/\/blog.google\/innovation-and-ai\/models-and-research\/gemini-models\/gemini-4-argon\/\" rel=\"nofollow noopener\" target=\"_blank\">Gemini 4 Argon: our next era of frontier intelligence<\/a>, 30 September 2026<\/li>\n\n\n\n<li>Mandiant, <a href=\"https:\/\/cloud.google.com\/security\/resources\/ai-risk-and-resilience-2026\" rel=\"nofollow noopener\" target=\"_blank\">AI risk and resilience in 2026<\/a>, September 2026<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Standards and independent research<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OWASP GenAI Security Project, <a href=\"https:\/\/genai.owasp.org\/2026\/09\/01\/owasp-genai-security-project-unveils-2026-top-10-for-llm-applications-new-agent-control-standard-and-sponsors-as-community-tops-30000-members\/\" rel=\"nofollow noopener\" target=\"_blank\">2026 Top 10 for LLM applications and Agent Control Standard<\/a>, 1 September 2026<\/li>\n\n\n\n<li>OWASP GenAI Security Project, <a href=\"https:\/\/genai.owasp.org\/2026\/10\/08\/genai-and-agentic-ai-exploit-roundup-q3-2026\/\" rel=\"nofollow noopener\" target=\"_blank\">GenAI and agentic AI exploit roundup Q3 2026<\/a>, 8 October 2026<\/li>\n\n\n\n<li>Agentic AI Foundation, <a href=\"https:\/\/aaif.io\/blog\/a2a-joins-aaif\" rel=\"nofollow noopener\" target=\"_blank\">A2A joins AAIF<\/a>, 17 August 2026<\/li>\n\n\n\n<li>Linux Foundation, <a href=\"https:\/\/www.linuxfoundation.org\/press\/agentic-ai-foundation-welcomes-57-new-members-gaining-major-financial-services-players-and-apac-leaders\" rel=\"nofollow noopener\" target=\"_blank\">Agentic AI Foundation welcomes 57 new members<\/a>, 13 August 2026<\/li>\n\n\n\n<li>Model Context Protocol, <a href=\"https:\/\/blog.modelcontextprotocol.io\/posts\/mcp-roadmap\/\" rel=\"nofollow noopener\" target=\"_blank\">The new MCP roadmap<\/a>, 22 August 2026<\/li>\n\n\n\n<li>METR, <a href=\"https:\/\/metr.org\/blog\/2026-11-05-anthropic-ai-rd-acceleration-assessment\/\" rel=\"nofollow noopener\" target=\"_blank\">Independent assessment of AI R&amp;D acceleration at Anthropic<\/a>, 5 November 2026, and <a href=\"https:\/\/metr.org\/time-horizons\/\" rel=\"nofollow noopener\" target=\"_blank\">Task-completion time horizons<\/a>, updated 8 September 2026<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Generation Impact Global<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/generationimpact.global\/legal\/ai-transparency-notice\/\">AI Transparency Notice<\/a>, last updated 2 September 2026<\/li>\n<\/ul>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"What is an AI agent?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"An AI agent is software built around a language model that takes a goal, plans the steps, uses tools such as search or calculation to carry them out, checks the results, and repeats until the goal is met or a person needs to decide.\"}}, {\"@type\": \"Question\", \"name\": \"What is the difference between generative AI and agentic AI?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Generative AI creates content; agentic AI uses it to take steps towards a goal. Generative AI produces text or images in response to a prompt. Agentic AI uses a generative model inside a loop so it can plan, use tools and take steps towards a goal. All agents use generative AI; not all generative AI is agentic.\"}}, {\"@type\": \"Question\", \"name\": \"Are AI agents reliable enough for business use?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"For well-defined tasks with good data and human review, yes. But even the best model in Google's September 2026 results completed only about half of realistic business automations, and OpenAI found that agents behave differently in tests and in real use. Unsupervised use on important work is not yet wise.\"}}, {\"@type\": \"Question\", \"name\": \"Do AI agents replace sustainability teams?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. They remove much of the reading, searching and matching. Judgement on materiality, approval of figures and accountability for the report stay with people, and regulators expect that.\"}}, {\"@type\": \"Question\", \"name\": \"Is it cheaper to build our own agent?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"The prototype is cheap. Testing, security, monitoring, model retirements and regulation are ongoing costs, and the people who can do this work are scarce. MIT found in 2026 that most large companies buy AI as a service, and that almost no bank had reached deep integration.\"}}, {\"@type\": \"Question\", \"name\": \"Is my data used to train AI models?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"It depends on the vendor and the contract. Ask for it in writing. How Generation Impact Global handles data in its AI features is set out in our AI Transparency Notice.\"}}, {\"@type\": \"Question\", \"name\": \"What is MCP and why should I care?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"MCP is an open standard that lets AI tools connect to data sources without custom integration. Platforms that support it are easier to connect to the rest of your systems.\"}}, {\"@type\": \"Question\", \"name\": \"Does the EU AI Act apply to AI agents?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"The AI Act regulates AI systems by their use and risk level, not by whether they are agents. Our companion article explains what applies and when.\"}}]}<\/script>\n\n\r\n\t\t\t \r\n\t\t<\/div>\r\n\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":3,"featured_media":28191,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","css_class_manager_body_classes":"","css_class_manager_use_in_post_loop":false},"categories":[1549],"tags":[],"class_list":["post-28149","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>AI agents explained: how they work and when to buy, not build | Generation Impact Global<\/title>\n<meta name=\"description\" content=\"What AI agents are, how they work, what 2026 research says about their limits, and why regulated teams should think twice before building their own.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/generationimpact.global\/it\/blog\/ai-agents-explained\/\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AI agents explained: how they work and when to buy, not build | Generation Impact Global\" \/>\n<meta property=\"og:description\" content=\"What AI agents are, how they work, what 2026 research says about their limits, and why regulated teams should think twice before building their own.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/\" \/>\n<meta property=\"og:site_name\" content=\"Generation Impact Global\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-09T22:49:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-10T14:40:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/generationimpact.global\/wp-content\/uploads\/ai-agents-explained-header-2064x512-1.webp?wsr\" \/>\n\t<meta property=\"og:image:width\" content=\"2064\" \/>\n\t<meta property=\"og:image:height\" content=\"512\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Generation Impact Global SA\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@GenImpactGlobal\" \/>\n<meta name=\"twitter:site\" content=\"@GenImpactGlobal\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/blog\\\/ai-agents-explained\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/blog\\\/ai-agents-explained\\\/\"},\"author\":{\"@type\":\"Organization\",\"name\":\"Generation Impact Global SA\",\"url\":\"https:\\\/\\\/generationimpact.global\\\/about\"},\"headline\":\"AI agents explained: how agentic AI works and why most organisations should not build it alone\",\"datePublished\":\"2026-11-09T22:49:23+00:00\",\"dateModified\":\"2026-11-10T14:40:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/blog\\\/ai-agents-explained\\\/\"},\"wordCount\":5517,\"publisher\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/blog\\\/ai-agents-explained\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/generationimpact.global\\\/wp-content\\\/uploads\\\/ai-agents-explained-header-2064x512-1.webp?wsr\",\"articleSection\":[\"Blog\"],\"inLanguage\":\"it-IT\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/blog\\\/ai-agents-explained\\\/\",\"url\":\"https:\\\/\\\/generationimpact.global\\\/blog\\\/ai-agents-explained\\\/\",\"name\":\"AI agents explained: how they work and when to buy, not build | Generation Impact Global\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/blog\\\/ai-agents-explained\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/blog\\\/ai-agents-explained\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/generationimpact.global\\\/wp-content\\\/uploads\\\/ai-agents-explained-header-2064x512-1.webp?wsr\",\"datePublished\":\"2026-11-09T22:49:23+00:00\",\"dateModified\":\"2026-11-10T14:40:03+00:00\",\"description\":\"What AI agents are, how they work, what 2026 research says about their limits, and why regulated teams should think twice before building their own.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/blog\\\/ai-agents-explained\\\/#breadcrumb\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/generationimpact.global\\\/blog\\\/ai-agents-explained\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/blog\\\/ai-agents-explained\\\/#primaryimage\",\"url\":\"https:\\\/\\\/generationimpact.global\\\/wp-content\\\/uploads\\\/ai-agents-explained-header-2064x512-1.webp?wsr\",\"contentUrl\":\"https:\\\/\\\/generationimpact.global\\\/wp-content\\\/uploads\\\/ai-agents-explained-header-2064x512-1.webp?wsr\",\"width\":2064,\"height\":512,\"caption\":\"Diagram of an AI agent loop: plan, act, observe and check, inside guardrails\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/blog\\\/ai-agents-explained\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"AI agents explained: how agentic AI works and why most organisations should not build it alone\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#website\",\"url\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/\",\"name\":\"Generation Impact Global\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#organization\",\"name\":\"Generation Impact Global SA\",\"alternateName\":\"GIG\",\"url\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/generationimpact.global\\\/wp-content\\\/uploads\\\/2_GIG_Logo_emblem.svg\",\"contentUrl\":\"https:\\\/\\\/generationimpact.global\\\/wp-content\\\/uploads\\\/2_GIG_Logo_emblem.svg\",\"width\":72,\"height\":72,\"caption\":\"Generation Impact Global SA\"},\"image\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/GenImpactGlobal\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/generation-impact-global\\\/\",\"https:\\\/\\\/wa.me\\\/41782224582\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AI agents explained: how they work and when to buy, not build | Generation Impact Global","description":"What AI agents are, how they work, what 2026 research says about their limits, and why regulated teams should think twice before building their own.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/generationimpact.global\/it\/blog\/ai-agents-explained\/","og_locale":"it_IT","og_type":"article","og_title":"AI agents explained: how they work and when to buy, not build | Generation Impact Global","og_description":"What AI agents are, how they work, what 2026 research says about their limits, and why regulated teams should think twice before building their own.","og_url":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/","og_site_name":"Generation Impact Global","article_published_time":"2026-11-09T22:49:23+00:00","article_modified_time":"2026-11-10T14:40:03+00:00","og_image":[{"width":2064,"height":512,"url":"https:\/\/generationimpact.global\/wp-content\/uploads\/ai-agents-explained-header-2064x512-1.webp?wsr","type":"image\/webp"}],"author":"Generation Impact Global SA","twitter_card":"summary_large_image","twitter_creator":"@GenImpactGlobal","twitter_site":"@GenImpactGlobal","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/#article","isPartOf":{"@id":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/"},"author":{"@type":"Organization","name":"Generation Impact Global SA","url":"https:\/\/generationimpact.global\/about"},"headline":"AI agents explained: how agentic AI works and why most organisations should not build it alone","datePublished":"2026-11-09T22:49:23+00:00","dateModified":"2026-11-10T14:40:03+00:00","mainEntityOfPage":{"@id":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/"},"wordCount":5517,"publisher":{"@id":"https:\/\/generationimpact.global\/it\/#organization"},"image":{"@id":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/#primaryimage"},"thumbnailUrl":"https:\/\/generationimpact.global\/wp-content\/uploads\/ai-agents-explained-header-2064x512-1.webp?wsr","articleSection":["Blog"],"inLanguage":"it-IT"},{"@type":"WebPage","@id":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/","url":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/","name":"AI agents explained: how they work and when to buy, not build | Generation Impact Global","isPartOf":{"@id":"https:\/\/generationimpact.global\/it\/#website"},"primaryImageOfPage":{"@id":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/#primaryimage"},"image":{"@id":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/#primaryimage"},"thumbnailUrl":"https:\/\/generationimpact.global\/wp-content\/uploads\/ai-agents-explained-header-2064x512-1.webp?wsr","datePublished":"2026-11-09T22:49:23+00:00","dateModified":"2026-11-10T14:40:03+00:00","description":"What AI agents are, how they work, what 2026 research says about their limits, and why regulated teams should think twice before building their own.","breadcrumb":{"@id":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/#breadcrumb"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/generationimpact.global\/blog\/ai-agents-explained\/"]}]},{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/#primaryimage","url":"https:\/\/generationimpact.global\/wp-content\/uploads\/ai-agents-explained-header-2064x512-1.webp?wsr","contentUrl":"https:\/\/generationimpact.global\/wp-content\/uploads\/ai-agents-explained-header-2064x512-1.webp?wsr","width":2064,"height":512,"caption":"Diagram of an AI agent loop: plan, act, observe and check, inside guardrails"},{"@type":"BreadcrumbList","@id":"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/generationimpact.global\/it\/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https:\/\/generationimpact.global\/it\/blog\/"},{"@type":"ListItem","position":3,"name":"AI agents explained: how agentic AI works and why most organisations should not build it alone"}]},{"@type":"WebSite","@id":"https:\/\/generationimpact.global\/it\/#website","url":"https:\/\/generationimpact.global\/it\/","name":"Generation Impact Global","description":"","publisher":{"@id":"https:\/\/generationimpact.global\/it\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/generationimpact.global\/it\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"it-IT"},{"@type":"Organization","@id":"https:\/\/generationimpact.global\/it\/#organization","name":"Generation Impact Global SA","alternateName":"GIG","url":"https:\/\/generationimpact.global\/it\/","logo":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/generationimpact.global\/it\/#\/schema\/logo\/image\/","url":"https:\/\/generationimpact.global\/wp-content\/uploads\/2_GIG_Logo_emblem.svg","contentUrl":"https:\/\/generationimpact.global\/wp-content\/uploads\/2_GIG_Logo_emblem.svg","width":72,"height":72,"caption":"Generation Impact Global SA"},"image":{"@id":"https:\/\/generationimpact.global\/it\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/GenImpactGlobal","https:\/\/www.linkedin.com\/company\/generation-impact-global\/","https:\/\/wa.me\/41782224582"]}]}},"permalink_manager":null,"_links":{"self":[{"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/posts\/28149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/comments?post=28149"}],"version-history":[{"count":15,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/posts\/28149\/revisions"}],"predecessor-version":[{"id":28242,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/posts\/28149\/revisions\/28242"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/media\/28191"}],"wp:attachment":[{"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/media?parent=28149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/categories?post=28149"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/tags?post=28149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}