Automation, AI agents or custom apps: what to build first

In short: a company has three main tools for digitizing a process. An automation repeats the same steps every time, an AI agent decides on its own how to complete a task, and a custom app gives people an interface for shared data. Start with the simplest option that works, with minimal permissions and controls from day one.

Key takeaways

Process first, then tool: what matters is frequency, clear rules and data that is already digital.
Repetitive workflows almost always need only an automation; an AI agent earns its place when the input is free text or changes every time.
Every connection between systems is a way in: dedicated credentials, least privilege and logging belong in the design.
If a system has no API, RPA or a browser-based agent can fill the gap, but both need more maintenance and oversight.
Refunds, discounts and messages to customers go through human approval.

For an online store or a B2B company, "digital products" are not courses to sell but tools that take time and errors out of internal processes, from order to invoice. According to Eurostat, 19.95% of EU enterprises with 10 or more employees used at least one AI technology in 2025, up 6.47 percentage points on 2024. Company size makes a big difference: 17% of small enterprises, 30.36% of medium-sized ones and 55.03% of large ones. Italy, where Istat puts the figure at 16.4%, doubled its share in a single year.

Among EU businesses that considered AI but did not adopt it, Eurostat finds the main barriers are lack of relevant expertise (70.89%), unclear legal consequences (52.52%) and data protection concerns (48.83%): problems of method more than technology.

What are digital products for businesses?

A business digital product is a piece of software, a workflow or an interface built to run a process faster and with fewer errors, replacing email, spreadsheets and copy-paste. It is not for sale: it works inside the company or with customers and suppliers.

There are four main families:

Automation (workflow): a sequence of predefined steps triggered by an event, such as "new paid order", that moves or transforms data between systems. Typical tools: n8n, Make, Zapier.
AI agent: a system built on a language model that receives a goal, decides which steps to take and uses the tools it has access to, such as the CRM or the product catalog.
Custom app or portal: an interface, often built on a database such as Supabase, for people who need to look up, approve or enter data.
Integration: a stable API connection between two systems that currently do not talk to each other, such as the online store and the ERP.

They are often combined. How to choose which processes to start with is covered in the guide to business process automation.

What is the difference between an automation and an AI agent?

An automation follows a fixed path; an agent chooses its own. Anthropic's guide to building effective agents draws the line clearly: in workflows, models and tools follow predefined code paths, while in agents the model directs its own process and tool use. It also recommends the simplest solution possible, because agents trade latency and cost for better task performance.

	Automation	AI agent	Custom app
How it works	Fixed steps, triggered by an event	Chooses its steps based on the request	People work on shared data
Best input	Structured data: orders, forms, rows in a file	Free text, emails, documents that differ from each other	Requests that involve several teams or outside customers
Predictability	High: same input, same result	Medium: needs tests and logs	High
E-commerce example	Paid order, invoice, warehouse alert	Reads return emails and drafts the reply	Returns dashboard for customer service
B2B example	Website lead, CRM record, assignment to a sales rep	Draft quote from a request written in free form	Ordering and price-list portal for resellers
Main risk	Breaks when a field or an API changes	Wrong actions if it has too many permissions	Exposed data if access is badly configured

A rule of thumb: if the process reads as "when X happens, do Y, then Z", an automation is enough; if it turns into "it depends on what the customer writes", consider an agent, ideally inside an automation that limits what it can do. Further reading: what AI agents change for SaaS buyers and AI agents that work in the browser.

What if a system has no API?

When an API exists, it is the most stable way to connect two systems, because it is a channel built specifically for exchanging data. Sometimes, though, an on-premise ERP or a supplier portal can only be used through screens designed for people. In that case there are two options:

RPA (Robotic Process Automation): according to Google Cloud's guide, it uses software robots that mimic human actions on digital systems, following predefined instructions and triggers, and works best for repetitive, predictable tasks such as creating invoices. The same guide lists integration with systems not designed for automation, security and ongoing maintenance among its challenges.
AI agent using the browser: it reads the page and decides where to act, so it can handle pages or documents that change every time, at the cost of lower predictability and more oversight.

A practical order of preference: the API when there is one, RPA when the on-screen path is always the same, a browser agent only when the input genuinely varies. Before choosing, ask your ERP vendor whether there is an API or an automatic data export: it is the easiest option to maintain, because it does not depend on how the screens look. In every case the same rules apply: dedicated credentials and a log of every operation.

Which processes should you digitize first?

The frequent ones, with clear rules and data that already lives in a system. A process that runs dozens of times a week pays back quickly; one that happens twice a year rarely justifies the effort.

Score each candidate from 1 to 3 on four criteria: frequency, clarity of the rule, cost of an error, data already digital. The most common candidates:

E-commerce: sending orders to the ERP and the carrier, low-stock alerts, returns handling, abandoned-cart recovery, payment reconciliation.
B2B companies: routing leads into the CRM, quotes from price lists and customer terms, onboarding new accounts, management reports, payment reminders.

Shipping, tracking and returns have their own guide to logistics digitalization.

A hypothetical scenario: a B2B distributor receives quote requests by email, each written differently. An automation logs them in the CRM, an AI agent extracts product codes and quantities and prepares a draft, and the sales rep checks prices and terms before sending. The repetitive part is automatic; the decision stays with a person.

Off-the-shelf software or a custom build?

For many processes the first move is not to build anything but to adopt standard software and connect it to the rest. In Italy, according to Istat, 48.8% of SMEs used ERP software in 2025, against 85.9% of large enterprises, and 21.1% of SMEs used a CRM, against 56.5% of large ones. If customer contacts still live in spreadsheets and inboxes, the first digital product to introduce is a CRM: with no data in a system, there is little to automate.

Off-the-shelf software (SaaS) when the process works the same way as in many other companies: invoicing, newsletters, help desk, catalog management. You start fast for a subscription fee, but you adapt to the way of working the vendor has in mind.
Automation between existing systems when the tools are already in place and the problem is moving data from one to the other: the typical case of an online store with separate platform, ERP and carrier.
Custom app or portal when the process is part of your competitive edge, for example different price lists and terms for each reseller, or when data must stay on your own servers. It costs more to build and maintain, so it only pays off where off-the-shelf software would force you to work worse.

The answer is often a mix: off-the-shelf tools for standard functions, automations to connect them, a small custom app only where it is needed. How an ordering portal for resellers works is covered in the guide to B2B e-commerce.

Can AI help forecast sales, stock and leads?

Yes, if reliable historical data is available. Eurostat counts machine learning for data analysis among AI technologies and describes AI as technologies that use data to predict, recommend or decide, with varying levels of autonomy. In 2025, among EU enterprises using AI, 34.70% used it for marketing or sales and 31.05% for organizing business administration processes or management; logistics, at 6.08%, was the least common use.

Examples for the companies this guide is written for:

E-commerce: suggesting when to reorder a product based on recent weeks' sales and seasonality; flagging unusual orders for a check before shipping.
B2B: ranking leads by how closely they resemble existing customers (lead scoring, covered in the guide to B2B lead generation); flagging customers who are reordering less than usual.

Two conditions always apply. The history must be complete and consistent: in Italy, Istat lists missing or poor-quality data among the main barriers to adopting AI. And the forecast suggests, a person decides: a wrong reorder ties up stock, and a lead discarded by mistake is a lost opportunity.

What security risks do agents and automations bring?

Every automation adds credentials, API keys and links to outside vendors, which means extra attack surface. Verizon's 2026 Data Breach Investigations Report records a 60% rise in breaches involving a third party, which now account for 48% of the total. Exploiting vulnerabilities has become the leading initial access vector, at 31% of cases.

AI agents add two risks listed in the OWASP Top 10 for applications built on language models:

Indirect prompt injection: instructions hidden in content the agent reads, such as an email, a PDF or a web page, that change its behavior (OWASP LLM01).
Excessive agency: the agent has more functions, permissions or autonomy than the task requires, so a mistake or an attack turns into a real action (OWASP LLM06).

The countermeasures cost less when planned early: one service account per workflow with only the permissions it needs, credentials in a vault and never in code, a log of every action, and human approval for high-impact actions, as OWASP itself recommends. On the regulatory side, the European Commission points out that under the AI Act people talking to a chatbot must be told they are dealing with a machine, and that the transparency rules apply from August 2026. Ransomware, fraud and backups are covered in the guide to e-commerce security.

How to apply it in your company: first steps

Map one process on a single page: who does what, in which tools, how many times a week and how many minutes each time.
Choose the simplest tool that covers it, using the table above: automation, agent, app or integration.
Record two or three baseline numbers, such as handling time, errors per month and response time, to compare after 30 days (see how to measure the ROI of AI projects).
Build a pilot on a single workflow, with dedicated credentials, least privilege, logging and an owner who monitors it.
Scale only after review: if the numbers improve and errors stay manageable, move on to the next process.

Widely used tools are enough to start: n8n or Make for workflows, Supabase for data, models from OpenAI or other vendors for the AI part. Both n8n and Supabase can also run on your own servers; the trade-offs are covered in the business guide to n8n. This mapping is where the automation solutions I design for e-commerce and B2B companies start; more guides are in the Automation category.

Mistakes to avoid

Starting from the tool ("we need an AI agent") instead of the process and the number you want to improve.
Automating a messy process: the mess just gets faster, not tidier.
Giving an agent an admin account to save time.
No error alerts, or no one who receives them, when a workflow stops.

Frequently asked questions (FAQ)

What counts as a digital product for a business?

It is any software, workflow or interface built to run an internal process with fewer manual steps: an automation that pushes orders into the ERP, an AI agent that drafts replies, a portal for resellers. Its value is measured in time saved and errors avoided.

When do you need an AI agent and when is an automation enough?

An automation is enough when the process always follows the same rule and data arrives in a structured form, such as an order or a form submission. An AI agent makes sense when the input is free text or changes every time, for example customer emails or documents from different suppliers.

How much does it cost to digitize a business process?

It depends on how many systems need connecting, how clean the data is and how much adaptation is required. On top of the build come licenses, AI model usage (usually billed per use) and maintenance when APIs change. A pilot on a single workflow keeps spending under control. Some projects qualify for public funding: how to read an Italian grant call is explained in the guide to digitalization grants.

Can an AI agent safely access my CRM or online store?

Yes, if it runs on a dedicated account with only the permissions it needs, credentials sit in a secure vault and every action is logged. Refunds, discounts and messages to customers should require human approval, as OWASP recommends against excessive agency.

Do we need in-house technical skills to run automations and agents?

You do not need an IT department, but you do need someone who knows the process and checks results, error alerts and logs. Lack of expertise is the top reason EU companies that considered AI give for not adopting it, according to Eurostat.

Are AI automations compatible with GDPR and the AI Act?

Yes, as long as personal data has a legal basis, vendors sign a data processing agreement, any transfers outside the EU have adequate safeguards and access is kept to the minimum. The AI Act adds transparency duties: people talking to a chatbot must know they are dealing with a machine, a rule that applies from August 2026 according to the European Commission.

Can an AI agent replace RPA?

Not always. According to Google Cloud, RPA works best for repetitive, predictable tasks, while AI is better suited to tasks that require understanding unstructured data such as text and images, and making decisions. They often work together: the agent interprets the request, and the automation or bot runs the fixed steps.

Sources

If you want to find out which process in your company is worth digitizing first, start with a free diagnosis.