AI Agents for Business: How to Avoid Creating Tomorrow's Shadow IT
Teams are already building their own agents. Without ownership, documentation and a route back into your core systems, you don't avoid the messy middle, you rebuild it with better tech.
If you've been in business long enough, you remember it. Somewhere in the late 90s or early 2000s, someone in your office built a Microsoft Access database to track inventory, or a wildly complicated Excel spreadsheet, stitched together with VBA macros, that somehow ran quoting, scheduling and payroll summaries, all living in a workbook only one person understood.
For a while it was brilliant: fast, tailored exactly to your business and cheap compared to "proper" software. Then that person left, and suddenly nobody could open the thing without breaking it. Formulas failed silently. Macros threw errors nobody could decode. The business had built its operations on a single point of failure without realising it.
We call that era of technology the messy middle, and most businesses that lived through it swore they'd never repeat it.
Today's AI agents create a similar opportunity, but they also create a similar risk if they're not implemented with the right governance.
We've been here before
That era gave way to standardised ERP systems. For many small and mid-sized businesses, that meant migrating to systems like Microsoft Business Central, or Microsoft NAV as it was called back then, Sage, or NetSuite more recently. These systems were built to survive the departure of any one employee, with proper support, audit trails and role-based access. Less bespoke, sometimes more rigid, but durable.
Why AI agents can recreate the same problem
Now AI agents are creating a very similar temptation. With a bit of prompting skill, a business can spin up an agent that automates a genuinely unique workflow, one no off-the-shelf vendor would build because it's specific to your customers and your way of doing things. It feels like the Access database all over again: fast, cheap and perfectly fitted.
But the risk wears the same outfit. If that agent lives in someone's personal account, built with prompts only they understand, and dependent on API keys nobody else can access, you haven't avoided the messy middle. You've just rebuilt it with better tech.
Microsoft already provides the foundation
Here's the twist. Many businesses building AI agents today already run on Microsoft. That's good news, because Microsoft gives you the stability and security, while tools like Microsoft Business Central provide the structure and auditing the Access era never had.
But the new bespoke layer, an agent drafting purchase orders or chasing overdue invoices, often gets bolted on outside that core in exactly the same ungoverned way the old spreadsheets were.
Copilot, custom AI agents or Power Automate?
Part of avoiding the mess is knowing when not to build something bespoke. Microsoft has already put real thought into how AI should sit inside Business Central. Copilot can draft customer emails, summarise cash flow, generate financial reports and suggest reorder points, all natively inside the system of record with the same permissions and audit trail as everything else.
If Copilot already does the job, building a custom agent to replicate it just recreates the shadow IT problem you're trying to avoid, with extra maintenance cost attached. The skill isn't "use AI everywhere". It's matching the tool to the task.
Copilot in Business Central
For the well-trodden paths: reporting, summarisation, drafting, and anything Microsoft has already built and supports.
A custom AI agent
For genuinely unique workflows, such as your pricing model, supplier quirks or customer follow-up process, where no packaged tool fits. Built in Copilot Studio, inside company infrastructure.
Neither
For anything simple enough to be a standard Power Automate workflow, where AI simply adds cost and unpredictability without delivering additional value.
Getting this triage right is, in many ways, more important than the engineering itself. It's the difference between AI adoption that fits in cleanly, securely and cost-effectively, and AI adoption that quietly becomes tomorrow's Access database.
Building AI that lasts
This is exactly the gap we built Truly SMB to close. Small and mid-sized businesses shouldn't have to choose between bespoke and durable. Our approach gets you the tailored automation AI agents make possible, built on foundations that outlast any single person.
AI agents are a genuine unlock for smaller businesses, giving them capabilities once reserved for enterprises with large IT budgets. We just don't want businesses relearning the lessons of the Access database era to get there.
That's the whole point of Truly SMB: helping you get the bespoke without the mess.
Thinking about AI agents?
Book a discovery call and we'll help you work out what Copilot already covers, what genuinely needs building, and how to keep both governed.
Frequently asked questions
What are AI agents for business?
AI agents for business automate tasks and workflows using artificial intelligence. They can handle everything from customer communications to finance processes, helping businesses improve efficiency while reducing manual work.
When should I use Microsoft Copilot instead of a custom AI agent?
If Microsoft Copilot already provides the functionality you need, such as drafting emails, summarising reports or assisting within Business Central, it's usually the best place to start. Custom AI agents are most valuable when your workflow is unique to your business.
How can businesses avoid creating shadow IT with AI?
The key is governance. AI agents should be documented, owned by the business rather than an individual, integrated with core systems wherever possible, and built with security, permissions and long-term maintenance in mind.
