AI agents · Process automation · Custom software · Košice, Slovakia
+421 903 921 243 info@easytrade.sk
Free consultation SK
Home · Blog · How to prepare your company and data for an AI agent: 6 steps

How to prepare your company and data for an AI agent: 6 steps

Six steps a company with 20–150 employees can take to get its process, data, access rights, approvals, people and metrics ready before an AI agent pilot.

7 min read AI agentsdata readinessguide
A manager and an IT administrator at a desk going through a checklist before an AI agent pilot

You have decided to trial an AI agent and are looking for a supplier. Yet the work that matters most for the pilot is yours, not the supplier’s – and most of it takes two to three weeks and little money. This guide shows what to prepare and what to keep in your own hands.

Why pilots fail because of the company, not the AI

In June 2025, Gartner predicted that more than 40% of agentic AI projects will be cancelled by the end of 2027. It named three reasons: escalating costs, unclear business value and inadequate risk controls. None of them concerns the quality of the model.

MIT NANDA’s July 2025 report “The GenAI Divide” paints a similar picture: 95% of organisations see no measurable return on their investment in generative AI. The findings are preliminary and the methodology modest (interviews in 52 organisations, 153 survey responses and a review of more than 300 public projects), so treat the figure as a signal rather than a precise statistic. More important is why the authors say pilots stall: brittle workflows, no learning from the company’s own context, and a poor fit with day-to-day operations.

McKinsey’s survey “The state of AI in 2025” (November 2025) found that the companies gaining the most from AI (around 6% of respondents) were almost three times more likely than the rest to have fundamentally redesigned their workflows instead of layering AI onto an existing process.

The common denominator is company readiness – something you can build in advance, on your own and cheaply.

Step 1: Pick one process and describe it as it actually runs

Not as the internal policy describes it. Sit down with the people who do the work and note who, what, when, in which system, which exceptions occur and what happens when something is missing. One or two pages plus a list of exceptions is enough.

What makes a good pilot candidate:

  • it repeats daily or weekly,
  • it has enough volume (dozens of cases a week),
  • it has a clear start and end,
  • it has a measurable outcome,
  • a mistake by the agent has minor consequences and can be corrected.

Take a company with 40 employees that receives enquiries via a web form and email. A sales rep reads them, re-types them into the CRM, assigns them to a colleague and replies. The process has clear boundaries and daily volume, and a mistake (a misfiled enquiry) can be put right. A description like this is the core of a free process audit.

A closing question: if the person who runs this process left for a month, could someone else take it over from your description?

Step 2: Get the data the agent will see in order

Where the data lives and what state it is in

List your sources: mailboxes, CRM, ERP, shared drives, Excel spreadsheets. For each, note the owner, the number of records and the known problems – duplicate customers, incomplete fields, a price list in three versions. An agent will not fix these errors; it will only make them faster.

What the agent needs and what it does not

Article 5(1)(c) of the GDPR requires personal data to be “adequate, relevant and limited to what is necessary” for the purpose. For an agent this means a simple rule: it sees only what its task requires, not everything. Mark which fields contain personal data and which documents are sensitive (contracts, payroll, health data). Article 25 (data protection by design and by default) demands the same at the design stage. If you keep records of processing activities under Article 30, add a new line.

Knowledge base

If the agent is to answer from documents, prepare current versions only. Give every document an owner and a last-review date. Move old price lists and superseded terms and conditions to an archive the agent cannot reach.

Concrete step: one spreadsheet with the columns source, owner, contains personal data (yes/no), agent needs it (yes/no).

Step 3: Access and permissions – a dedicated account for the agent

The agent must not run under the managing director’s account or a shared team password. It needs its own service account with the fewest permissions it can work with. NIST defines this principle (least privilege) as an architecture in which each entity is granted the minimum system resources and authorisations it needs to perform its function. It applies to people and automated processes alike.

In practice this means:

  • a service account for the agent in every system it uses (CRM, email, ERP),
  • API keys with a limited scope (for instance read contacts only, no deletion),
  • a separate test environment, or at least a test mailbox and a test list in the CRM,
  • a log of every agent action, stored with you and not only with the supplier.

Questions for your IT administrator or external IT provider: Do our systems have an API, and who has the documentation? Who can create an account with restricted rights? Where will logs be stored, and for how long? Who will read them?

Step 4: Decide what the agent may do alone and what a human approves

This decision is yours, not the supplier’s. Sort actions by the consequences a mistake would have, and set who approves them and by when.

Type of action Who approves How quickly
Reading data, sorting, summarising Nobody – the agent acts alone Continuously
Drafting a reply to a customer The employee who sends the reply Within one working day
Creating or changing a CRM record Process owner, sample checks Continuously, review once a week
Sending an email to a customer Employee – human approval Within four hours
Payment, price change, discount, contract Managing director or department head – always As needed, never automatically

Rule for the pilot: start in “agent drafts, human sends” mode. Release low-consequence actions only once several weeks of logs show a low error rate. Never release payments and contracts.

Step 5: Prepare your people – who works with the agent and who owns it

The agent’s owner should be someone from operations who knows the process – not IT. IT provides the accounts and logs; the owner decides what the agent does and whether it does it well. Write one page on what changes in the team’s work (re-typing into the CRM disappears) and what stays (pricing decisions, customer contact).

Article 4 of the EU Artificial Intelligence Act (AI Act) – the duty to promote AI literacy – has applied since 2 February 2025. A company deploying an AI system must take measures to support the AI literacy of its staff and of others who work with the system on its behalf. The European Commission states that no certificate is required; an internal training record is enough. The 2026 amendment (the Digital Omnibus on AI, Regulation (EU) 2026/1744) softened the wording of Article 4: the obligation remains, but the company need not guarantee a specific level of knowledge in any individual. National supervisory authorities will enforce the rules from 2 August 2026. For a small company this means a short session on what the agent does, where it makes mistakes and how to report them – plus a dated record with names.

Address the team’s concerns openly. People will ask whether they will lose their jobs and who answers for the agent’s mistakes. Give concrete answers before the pilot, not after.

Step 6: Measure the “before” so you know whether it paid off

Without “before” figures, the post-pilot debate will be about feelings. For two weeks before launch, measure:

  1. time per case (from the enquiry arriving to the reply),
  2. number of cases per week,
  3. share of errors or returned cases,
  4. response time to the customer,
  5. hours per month the team spends on the process.

A shared spreadsheet and some discipline are all it takes. Track the same metrics during the pilot (3–6 weeks) and compare. Add two questions for the team: what does the agent do well, and where did they have to correct it?

Checklist before your first meeting with a supplier

  • One process described as it actually runs, exceptions included.
  • Criteria confirmed: repetition, volume, clear boundaries, measurable outcome, minor consequences of a mistake.
  • An inventory of data sources with owners and known problems.
  • Personal data and sensitive documents marked; decided what the agent will not see.
  • A knowledge base of current documents only, each with a review date.
  • A service account for the agent with minimum rights and API keys with a limited scope.
  • A test environment and a place to store the logs.
  • A table of actions: what the agent may do alone, what a human approves and by when.
  • A process owner from operations, not from IT.
  • A short team training session and a record of it (Article 4 of the AI Act).
  • Two weeks of measured “before” metrics.
  • A decision on where the data is processed – in the EU, at the model provider or on your own infrastructure – and who approved it.

Key takeaway: AI agent pilots fail more often on an unprepared company than on the model. A process described as it really runs, a data inventory, a dedicated agent account with minimum rights, clear approval rules, an owner from operations and “before” metrics – you can do all of it yourselves in two to three weeks. You then hand the supplier a specific task, not chaos. The key decisions – access, data and what the agent may do – stay with you.

To go through these steps with the Easytrade team, which has already deployed agents into CRM and email workflows, book a free consultation – we will review your process together and decide whether a free process audit is the right first step.

Sources

Easytrade

A software and AI company from Košice, Slovakia – since 2011 we have helped companies integrate AI agents, automate processes and build custom software.

All articles
Blog

More articles

7 min read

Securing AI agents at work: permissions, logs, GDPR and the AI Act

A chatbot answers; an AI agent acts – it reads emails, searches your CRM, fills in orders and sends messages. If you are piloting one or about to go live, you need to know what it can break, how to fence it in, and what GDPR and the AI Act require you to have on paper. Below are four layers, each with its typical threat and its legal duty.

AI agentssecurityGDPR
7 min read

Custom software or off-the-shelf? A decision framework for SMBs

Companies with 10 to 200 employees sooner or later run into the limits of spreadsheets or a cheap subscription. Then comes a decision that will shape how people work for years: buy a ready-made system, or have one built. This article gives you a framework for comparing the two options honestly – including the costs that never make it into the quotes.

custom softwaredecision-makingtotal cost
7 min read

Why keep servers and software updated: risks and patch management

Most small businesses have a server that “has run for years without a problem”. That is exactly why it deserves attention: software that never changes does not get safer, while attackers change every day. Below: the data, three well-known incidents with one shared pattern, and how to update without downtime.

securityserversmaintenance

Want to put one of these topics into practice?

The first consultation is free and without obligation. We will walk through your process and tell you what makes sense to automate first.

Book a free consultation