A POC running for six months is not a product.
31% of companies have at least one AI agent in production. They see a 171% median return on investment. The other 69% are at zero - because a POC returns nothing, by construction.
Why 40% of projects will be scrapped
The use case was never costed
It started because AI had to happen, not because a task cost €400,000 a year and 60% of it could be absorbed. With no denominator, there is no way to say whether the project succeeded.
The demo was mistaken for the product
A demo shows the happy path. Production is 80% awkward cases: the corrupted attachment, the customer replying in three languages, the third-party API returning 503 for two hours.
Nobody planned the exit
No plan if the vendor changes its pricing, no cost-per-task measurement, no threshold at which you stop. The project dies of budget exhaustion, not technical failure.
The six missing pieces
An agent that answers is a demo. An agent that acts is a system. Here is what separates them, and what we install.
Tools, not text
A useful agent calls functions: issue a credit note, book a slot, trigger a refund. If it produces text someone has to retype elsewhere, you have automated the writing, not the task.
Least privilege, actually applied
An agent holds the permissions of whoever wired it up. That is the most common and most serious flaw. Minimal scope per tool, and explicit confirmation on irreversible actions.
Defence against prompt injection
Every piece of content read is untrusted input: email, web page, PDF, ticket. Instructions come from the system, never from the data read. Non-negotiable.
Continuous evaluation
A probabilistic system tested once before go-live says nothing about its behaviour three weeks later, after the vendor ships a new model version.
Usable traces
When the agent gets it wrong - and it will - you have to reconstruct the scene: prompt, model version, retrieved documents, tools called. It is also what the AI Act expects.
Cost per task and a kill switch
Two metrics permanently visible: cost per task handled and human takeover rate. Plus a switch operable without a deployment. An agent without a kill switch is not deployable.
We start with a single task
Costly, repetitive, measurable. We establish its baseline - how many times a month, how long, how many errors today - then build the narrowest possible path to production. The temptation to widen comes fast; resisting it is the job.
Scope my first agent