Your team is probably already using AI agents. The question is whether anyone chose how.
In most scaling tech businesses, agents arrive in three ways. Staff ask a general AI tool to plan and run a task for them. A supplier sells a ready-made agent for sales, support or finance. Or the business builds its own agent around the way it works.
Each route has a place. Each also carries a different kind of legal and commercial risk. The mistake is treating them all the same, or not noticing which one you are using.
Route one: the improvised agent
This is the agent your team sets up on the fly. Someone gives a general AI tool a goal, it proposes a plan, and it gets on with the work.
It is fast and flexible, which is why people like it. It is also where most unmanaged risk sits.
The plan is different every time. Nobody has checked whether the approach is sound. And the tool is often connected to company systems through an individual's own account, on consumer terms the business never agreed to.
The commercial risks are practical:
- Confidential or customer data going into tools with no business contract behind them
- Work product created under terms that may let the provider reuse your inputs
- No consistent way to check how the work was done or repeat it
- Agents connected to business systems that IT and legal do not know about
Improvised agents suit low-risk, one-off tasks such as research, first drafts and internal analysis. They do not suit work that touches customers, contracts or personal data.
The fix is not a ban. It is a clear AI use policy that sets out which tools are approved, on which accounts, and for what kind of work.
Route two: the ready-made agent
Many software suppliers now sell agents built for a specific job, such as qualifying leads, handling support tickets or reconciling invoices.
The appeal is obvious. Someone else has designed the workflow, tested it and kept it running. You get speed without having to build anything.
The trade-off is control. You are relying on the supplier's view of how the work should be done, and the supplier can change that view.
Before you commit, ask:
- Has the agent been tested for the kind of work you will use it for, or for a generic version of it?
- Can the supplier change how the agent behaves, or the AI model behind it, without telling you?
- Does the contract say what happens when the agent gets it wrong, or does it put all of that on you?
- If you leave, can you take your configurations, data and history with you?
The last point is often missed. Once a ready-made agent is built into your operations, switching suppliers gets expensive. Agree on exit and data portability before you depend on it, not after.
Route three: the agent you build yourself
This is where the value is for many tech businesses. You take your own processes, playbooks, pricing logic and know-how, and build them into an agent that works the way your business works.
Done well, that agent becomes a business asset. It can carry your best practice across the team and set you apart from competitors.
Which makes one question matter more than any other: do you actually own it?
Ownership depends on the contracts behind the build:
- Developers and contractors: Under UK law, a freelancer or agency usually owns the copyright in what they create unless the contract assigns it to you. If an external team built your agent, check the agreement.
- The platform: Agents are usually built on someone else's AI platform. Check what the platform terms say about ownership of your configurations, instructions and outputs, and whether the provider can use them.
- Your know-how: The playbooks and processes you put into the agent are often your most valuable confidential information. Make sure the platform contract protects them as confidential, and that they will not be used to train models that serve your competitors.
- Your staff: Employees who design agents as part of their job will generally create IP for the business, but the position is less clear for consultants, advisers or founders working outside an employment contract.
If you plan to raise investment or sell the business, expect buyers and investors to ask about this. An agent the business relies on but cannot show it owns is a due diligence problem.
Match the route to the work
The right model depends on what the work is and what happens if it goes wrong. A simple rule of thumb:
- Improvised agents for low-risk, internal, one-off work
- Ready-made agents for standard, repeatable tasks where a supplier's approach is good enough and the contract is right
- Custom agents for work that relies on your own know-how, or where how the work is done is part of your competitive edge
Most businesses will use all three. The point is to make that a decision, not something that happens by default.
Summary
AI agents can scale your best work or scale your weakest controls. Which one you get depends on how they come into the business.
- Put an AI use policy in place so improvised agents stay in low-risk work
- Check ready-made agent contracts for liability, change control and exit
- Make sure you own the custom agents you build, including what contractors create
- Protect the know-how you put into agents as confidential information
- Match the type of agent to the risk of the work
Your agents may end up being some of the most valuable assets you build. Make sure the contracts behind them say they are yours.
If you are building, buying or rolling out AI agents and want the ownership and contract position checked, book a free 20-minute call with the Ethiqs team.