In 2026 an AI agent can run multi-step back-office work in a small firm, provided the rules are clear and every action can be undone. It should not yet act alone on money, on anything irreversible, or on anything a regulator would recognise as advice. Most of the disappointment we see comes from ignoring that second sentence, not from the technology failing at the first.
The distinction matters more for a 20-person fiduciary or a 40-person insurance broker than for a bank. A small firm has no operational risk team watching for an agent that quietly does the wrong thing a few hundred times, so the control model has to be simple enough to run alongside a day job.
What is an AI agent, in plain language?
An AI agent is a language model that can take actions through tools instead of only answering questions. A chatbot tells you what to do with a supplier invoice; an agent opens the invoice, finds the purchase order, compares the amounts and books it or hands it to a person. The difference is permission to act, so the risk sits in the permissions rather than in the model.
In practice an agent is three things: a model, a set of tools it is allowed to call, such as your mailbox, accounting system, CRM or document store, and a loop that lets it plan and carry out several steps. Every action runs through an account with rights. That account, and what it can touch, is what you govern.
What can AI agents realistically automate in an SME today?
AI agents work today on multi-step back-office flows with clear rules and a reversible outcome. In a small firm that means matching supplier invoices to orders and routing the exceptions, assembling client onboarding paperwork, qualifying inbound leads and keeping CRM records clean, and handling first-line IT requests such as password resets. In each case a mistake is visible and can be corrected before it costs money.
Invoice matching and exception routing. At a 25-person Treuhand firm handling clients' supplier invoices, an agent matches each invoice to the order and delivery note, puts clean matches into a draft booking batch, and sends mismatches to a named person with the reason. Releasing payment stays human.
Onboarding paperwork. At a 15-person wealth boutique, an agent can collect a new client's documents, check them against the onboarding checklist and list what is missing. It does not decide whether the client is accepted. If your firm is supervised by FINMA or affiliated to an anti-money-laundering self-regulatory organisation, that decision and its documentation stay with you, and FINMA's current publications on AI are worth reading before you deploy.
Lead qualification and CRM hygiene. For a 40-person insurance broker, an agent can read inbound enquiries, check the company against the commercial register, score it against criteria you wrote, and create or merge the CRM record. It is tidy, reversible work nobody gets round to.
First-line IT helpdesk. Password resets, access requests against a predefined list of roles, and routine software tickets. Anything outside the list goes to a person. An agent with administrative rights is also a target, so read the cybersecurity priorities for Swiss SMEs before granting them.
If you have not yet used generative AI for drafting, start with the generative AI use cases that pay back first.
Where should an AI agent never act alone?
An AI agent should not act alone on payments, on anything that cannot be reversed, or on regulated advice. That covers releasing a payment run, changing a supplier's bank details, deleting records, sending a contract or a termination notice, and telling a client what cover, allocation or tax treatment they need. An agent can prepare that work, but a named person approves it.
Two reasons. Errors made at machine speed compound before anyone looks. And an agent that reads inbound email can be instructed by inbound email: a forged supplier message asking for new bank details is already a familiar fraud route for small firms, and an agent with write access to vendor data makes that route faster. Keep the irreversible step behind a human, every time.
A control model a small firm can actually run
Autonomy is earned in stages, with evidence at each.
- Read-only first. The agent sees, summarises and suggests. For a few weeks, compare its suggestions with what your people actually did. It is the same shadow mode we describe for getting AI past the pilot stage.
- Then draft and approve. The agent prepares the action and a person approves or edits it. Track how often approvals need edits.
- Then act within limits. Only reversible actions, an amount cap, a list of allowed actions and a daily volume cap. A person reviews a weekly sample and every exception.
Three controls apply at every stage. Logging: every action, its input and the tool call, kept where the owner can read it. If you cannot reconstruct why the agent did something, you cannot defend it to a client or an auditor. One named owner: the person whose process it is, not "IT". A kill switch: one action that revokes the agent's credentials, known to at least two people and tested before you need it.
The free NIST AI Risk Management Framework groups the work into govern, map, measure and manage; a small firm can use those four headings as a one-page checklist.
The four autonomy levels compared
| Autonomy level | Example task | Human role | When appropriate for an SME |
|---|---|---|---|
| Assist | Summarise inbound mail and suggest a category | Reads and decides everything | From day one, for almost any process |
| Draft and approve | Prepare a booking batch from matched invoices | Approves or edits each action | Once read-only suggestions consistently match staff decisions |
| Act within limits | Reset passwords, merge duplicate CRM records | Reviews a weekly sample and all exceptions | When actions are reversible, capped and logged, and approvals rarely need edits |
| Fully autonomous | Release payments, advise clients | None until something goes wrong | Not for a 10 to 80 person firm today |
Most firms of this size will stay in the middle two rows for a long time, and that is fine.
A note for Swiss firms serving EU clients
The EU AI Act, Regulation (EU) 2024/1689, can apply to providers and deployers outside the EU when the output of their AI system is used in the EU. A Swiss broker or fiduciary with EU clients may therefore be in scope without an EU office. Most back-office agents are unlikely to fall into the high-risk categories, but the Act lists creditworthiness assessment of individuals and risk pricing in life and health insurance among them. Obligations phase in over several years and parts of the timeline have been under discussion, so check the current application dates before relying on any of them. This is not legal advice.
At home, the revised FADP already applies to any agent that processes personal data, as set out in our revised FADP checklist.
Where to start
Pick one flow that runs at least weekly, has written rules and produces something you can undo. Run it read-only for a month, measure how often the agent agrees with your people, then decide on draft-and-approve. One process in one quarter gives you evidence rather than a demo.
Our AI and machine learning practice follows the same sequence with financial services firms of this size.
Related reading
- Which generative AI use cases actually pay back for a small company?
- Cybersecurity for Swiss SMEs: the five things that actually matter
- AI and machine learning consulting
- Financial services consulting
Working on this right now?
Tell us where you are in two questions. A consulting partner reviews every enquiry within 2 business days.