AI agents vs chatbots for business: what operators actually need

Most owner-operators need two of these, not one. A chatbot is fine for answering common questions on your website. For back-office work (follow-ups, receipting, reminders, CRM updates, research) you want agents that can act in your systems, with a person approving anything that goes out. The mistake is buying the first and expecting the second.

This article sits under our guide to what an AI execution layer is. Here we define the four tiers by capability, show how each one fails, and give you a quick test for matching a task to the right tier.

Four kinds of business AI, defined by what they can touch

Marketing labels blur together, so ignore them. Ask what the system can read, what it can change, what it remembers and who finishes the job.

Notice that the tiers are not "good, better, best". A chatbot that answers "What are your opening hours?" is the right tool. Putting an agent with write access to your CRM behind that question would be overkill and a security risk.

When a chatbot is genuinely enough

Don't let anyone upsell you past this. A well-scoped chatbot is cheap, predictable and useful if all of these are true:

• The questions repeat: hours, pricing bands, service areas, how to book, what to bring.
• The answers are stable and you can write them down in one document.
• A wrong answer is an inconvenience, not a financial or legal problem.
• There is a clear hand-off to a person (a form, a phone number, a booking link) for everything else.

If a question needs a lookup in a customer's record, a judgement call or an action, it has outgrown the chatbot.

Where chatbots break: the Air Canada lesson

The best-known cautionary tale is Moffatt v. Air Canada, a 2024 decision of British Columbia's Civil Resolution Tribunal. The airline's website chatbot told a grieving customer he could apply for a bereavement fare after travelling. The airline's actual policy said otherwise. Air Canada argued, in effect, that the chatbot was responsible for its own words. The tribunal rejected that and found the airline had not taken reasonable care to make sure its chatbot was accurate.

It is a Canadian small-claims decision, not Australian law, but the lesson travels: if an AI speaks to customers on your behalf, customers will reasonably treat what it says as what your business says. For Australian operators that means two rules. First, any customer-facing AI that states policy, prices or entitlements must answer from your approved source documents, not from general knowledge. Second, anything that commits the business (a refund, a discount, a booking change) should be drafted for a person to approve, not promised in the chat.

How agents fail, and why it is different

Chatbots fail by saying the wrong thing. Agents fail by doing the wrong thing, which is more expensive. The common patterns:

Acting on stale or partial data

An agent drafts an overdue-payment reminder from last week's export because nobody told it the customer paid on Friday. Fix: agents should read from the live system of record at the time of the task, and say which source and timestamp they used.

Being manipulated by the content they read

An agent that reads email or web pages can be steered by instructions hidden in that content. OWASP lists prompt injection as the first risk in its LLM top ten. Fix: treat everything an agent reads as data, limit which tools it can call, and keep approvals in front of outward actions. Our security writers cover this in depth in prompt injection through email.

Doing too much

Given a vague brief like "tidy up the CRM", an over-eager agent merges records you wanted separate. Fix: scope every task with a definition of done and stop conditions, and keep deletes and merges behind approval.

Running up cost quietly

An agent that retries a failing task in a loop can burn model usage for hours. Fix: budgets, timeouts and an orchestrator that notices when a task is stuck and asks a person.

What an execution layer adds on top of agents

Single agents are useful. They become dependable when something sits above them: an orchestrator that splits work and assigns owners, specialists with narrow access, a shared record, and approval steps. That is the difference between "an AI that can send email" and "a team that drafts the email, logs it in the CRM, and waits for you". We explain the orchestration part in how an orchestrator splits work across agents, and the approval design in approval gates for autonomous agents.

Whether you assemble that yourself or buy it is a separate decision with real trade-offs. We set out the components and their hidden costs in build your own AI agents vs buy.

A quick test: which tier does this task need?

Run each task you are considering through five questions. The first "yes" from the top tells you the minimum tier.

1. Does the task need to act across two or more systems, or keep a record of who approved what? Execution layer.
2. Does it need to change something in one system (draft an email, update a record, book a slot)? Agent, with approval if it touches a customer.
3. Does it need your context (a document, a client file) to produce writing or analysis that you will act on yourself? Assistant.
4. Is it a repeated question with a stable, written answer? Chatbot.
5. None of the above? It may not need AI at all.

Mistakes we see when businesses pick the wrong tier

• Buying a website chatbot to fix a back-office problem. The enquiries get answered faster, but nobody follows them up.
• Using a general assistant as an agent. The owner becomes the integration, pasting between ChatGPT, the inbox and the CRM. We call this the copy-paste tax and quantify it in ChatGPT vs AI agents for business.
• Giving an agent broad access without approvals because the demo looked good. The first wrong email to a customer costs more than a year of approvals.
• Measuring the wrong thing. Counting messages sent rather than work accepted. Our method for measuring hours saved counts only finished, approved work and includes review time.

If your work crosses email, CRM and phone and you want to stay the one who signs off, the Fulcrum Cortex platform is built for that tier. If a chatbot is genuinely enough, start there and come back when it isn't.