The 3-tier model for AI agents: which task belongs on which tier

Why many AI initiatives start in the wrong place

The picture in many mid-sized companies: there was a workshop and a few licences, and individual employees have drafts and summaries written for them. In day-to-day operations, little has changed. AI has been tried out. Nobody runs it in operations.

The figures from the Statistisches Bundesamt (Federal Statistical Office) show how early many companies still are: in 2025, 26% of companies in Germany with at least ten employees used AI (in German). Among companies with 50 to 249 employees, it was 36%.

There are many reasons for the gap between trying AI out and running it. One weighs particularly heavily: every task is treated the same way. That produces two mistakes that point in opposite directions.

The first: small helpers get over-planned. An assistant that drafts the text of quotes ends up in the same process as a new ERP system, with a requirements specification, a tender and a steering committee. After six months nothing is running, and the team has lost interest.

The second: critical processes get automated too casually. Someone in a business unit builds an agent that answers customer enquiries or changes data in the CRM. There is no permissions check, no logging and nobody who answers for the result. That goes well until the first error that customers or partners notice.

Both mistakes have the same cause: people ask what the software can do. The better questions are: what does an error cost in this task, which data is affected, and who answers for the result?

The task determines the right level of effort, whatever the tool.

The model at a glance

The following model is a working aid for exactly this classification. It is not an industry standard.

First, two terms. In its guide to building agents, the AI provider Anthropic distinguishes between two designs. In a workflow, the AI follows a fixed, programmed sequence. In an agent, the language model decides for itself which steps to take and which tools to use. According to the guide, agents suit open-ended tasks where the number of steps cannot be predicted. They buy better results with longer run times and higher costs. The recommendation that follows: start with the simplest solution and only add complexity when it is needed. Sometimes that means not building an agent at all. This principle carries the whole model. How a hosted agent differs from a harness of your own is shown in the comparison Dots or your own agent harness.

Tier 1: what your employees can build themselves

This tier covers tasks where an error costs little and where it is clear what goes in and what should come out: the first version of a cover letter for a quote or of a job advertisement, a summary of a long email thread, research on a supplier or a standard, a checklist for onboarding.

A person reads the result before it is used further. A weak draft is revised or discarded. The risk stays low as long as the check is done seriously, but it is never zero.

You don't need a development department for this. Today's AI assistants can be set up without programming: your employees store instructions and documents, and the assistant works with them. The quality depends on the material you give the assistant.

The three-folder principle

A practical approach: business context, working data and work instructions are kept separate. The separation forces clarity. If you cannot write down the work instruction in three sentences, you usually have not yet understood the task.

Where tier 1 ends

Building your own only works with clear limits. Two of them should be set down in writing before the first helpers are built.

No customer data without a documented review. As soon as personal data, contract content or confidential customer information flows into a tool, questions arise about data protection, confidentiality, storage location and access, for example about the legal basis and the data processing agreement with the provider. The company answers them, not the individual employee. Until then, such data stays out.

No decisions that reach the outside world. The assistant may draft an email to a customer, but may not send it. It may prepare variants of a quote, but a person sets the price. Whatever reaches customers, suppliers or authorities goes across someone's desk first.

A test question for everyday work: would it bother you if the result landed with the customer unchecked? If so, the task does not belong in tier 1. These limits do not slow anyone down. If you know what is allowed, you can experiment freely.

Tier 2: what professionals should integrate into your systems

In tier 2, the AI no longer works next to your systems. It works inside them. An agent reads enquiries from the ticketing system, matches them against customer data in the CRM, checks the delivery status in the ERP and writes a reply. It carries out a process over several steps and accesses data that your day-to-day business runs on.

As soon as an agent writes to your systems, an error has consequences beyond the drafts folder. Five points decide whether it runs reliably:

• Interfaces: clean, documented access to the CRM, ERP or ticketing system. Copied exports and intermediate spreadsheets are the typical breaking points.
• Permissions: the agent sees and changes only what its task requires. An agent that answers enquiries does not need access to pricing terms or HR data.
• Logging: what the agent read, decided and triggered is recorded in a traceable way, as far as the purpose requires. Decide in advance what gets logged, who may view it and when it is deleted, for data protection reasons too. That way, if something goes wrong, you can work out what happened and answer customer requests properly.
• Tests: the guide recommends extensive testing in sandboxed environments, along with the appropriate guardrails, before agents meet real data.
• Maintenance: interfaces and models change. A tier 2 agent needs someone to look after it, like any other business system.

The guide also advises relying on simple, composable building blocks rather than complex frameworks for long-term operation. So ask a service provider how well your team will still be able to understand and check the solution later.

When a home-built helper belongs in tier 2

Many tier 2 agents start out as something an employee built. How such a home-built tool gets into operation safely is settled by the four-eyes principle for vibe coding. That is fine, as long as someone notices the moment the helper leaves its tier. Three signals are typical:

1. It has become a bottleneck. A department's work stalls when the helper fails or when the person who built it is away.
2. Others depend on it. What started as a personal working aid is now used by sales, service or accounting, without them knowing how it works.
3. Real data flows through it. The helper processes customer data, orders or invoices, or its results go out unchecked.

If one of these applies, you don't have to switch the helper off. Set it up again: with controlled access, clear permissions, logging, tests and a responsible person. We see again and again that exactly this transition gets missed. Then a critical process runs on a solution that was never meant for it.

Tier 3: what stays with people

On the third tier, technical feasibility is secondary. What matters here is judgement, a customer relationship or a question of liability. In mid-sized companies, examples include:

• Price negotiations. How far you accommodate a long-standing customer depends on the history of the relationship, the market situation and your strategy. No data record contains all of that.
• Personnel decisions. Hiring, promotion and dismissal affect people directly. This responsibility cannot be handed to a system. In our projects, anyone who wants to use AI in candidate selection or performance assessment has it legally reviewed first. The AI Act and the GDPR have their own rules for this. And a mere confirmation click does not count as a genuine review.
• Critical customer conversations. A complaint escalates, a contract is at risk. What counts here is tone, timing and trust.
• Approvals with legal effect. Contracts, commitments to authorities or declarations with liability consequences are the responsibility of a named person with the authority to sign them.

The rule is: AI prepares, the person decides. For a price negotiation, an agent can compile the revenue history, open complaints and the margins of recent orders. The result remains a briefing. The person has to make the decision, and must be able to justify it without the briefing too.

Technically, this is easy to set up. According to the guide to building agents, agents can be built to pause at defined checkpoints or when they hit obstacles, and wait for human feedback.

Human oversight as an operating rule

The AI Act contains specific rules on human oversight for high-risk systems (Article 14). Whether an agent falls under them is a legal question. We do not answer it ourselves in projects. We have it reviewed.

We still consider the basic idea sensible for any AI operation, including those far below the high-risk class. Whoever approves a result knows the limits of the system and spots anomalies. They know how quickly people come to trust a machine too much. And they can intervene or stop the operation.

The AI Act also regulates AI literacy (Article 4) and transparency in customer contact (Article 50). Your legal counsel clarifies which of this applies to your use. Our position does not depend on it: whoever works with AI gets trained. And customers should know whether they are writing to a machine.

Whoever checks a briefing from the AI and bases a decision on it needs to know where the system typically goes wrong and which data it has seen. That competence only develops when it is settled who does what. So for every tier 3 task, set down in writing:

1. What the AI may prepare, for example compiling data, writing drafts or reviewing documents.
2. Who decides: a named person or role. "The business unit" does not count.
3. What this person needs to know: what limits the tool has and how to recognise a faulty briefing.

Four questions to classify any task

Ask these four questions for each individual task rather than for a tool as a whole, because the same program can support a tier 1 task and a tier 3 task. The strictest answer decides. If three questions point to tier 1 and one to tier 3, the task belongs in tier 3.

The model is an operational classification, and it makes no legal assessment. That is why we flag uses that assess people, make automated decisions about them or analyse emotions with "legal review" in advance. No tier changes that.

1. What does an error cost?

Think of the worst realistic case. A failed internal draft costs minutes, a wrong order confirmation costs trust, and a price you have promised may be impossible to take back.

• Tier 1: the error is noticed before the result leaves the company.
• Tier 2: the error can reach customers or other systems, but logging and tests make it possible to spot and correct.
• Tier 3: the error cannot be reversed or has legal or financial effect outside the company.

2. Which data is affected?

• Tier 1: publicly available or non-critical internal information, such as product texts or templates.
• Tier 2: customer and contract data from the CRM, ERP or ticketing system. Access rights, interfaces and logs must be properly set up.
• Tier 3: data used as the basis for decisions about people, for example in applications or performance reviews.

3. How often does the task occur, and how uniform is it?

A task that runs a hundred times a day following the same pattern often does not need an agent. A fixed workflow is enough (see the distinction above).

• Tier 1: the task comes up occasionally, one person handles it, and a helper saves them time.
• Tier 2: the task comes up often, involves several people or departments and runs largely the same way each time. This is where a proper integration pays off.
• Tier 3: every case is different and calls for judgement.

4. Who is accountable for the result?

If nobody can answer this question, the task is not yet ready for an agent, on any tier.

• Tier 1: whoever uses the helper is responsible for the result and checks it before passing it on.
• Tier 2: the result feeds into other people's processes. It needs a named person and someone who maintains the solution.
• Tier 3: a signature, a liability or a customer relationship depends on the result.

The checklist to take away

The four questions can be condensed into a matrix, with one row per question and one column per tier. And if you are unsure about a question? Then classify the task one tier higher for now, because usually knowledge of the process is missing or accountability is unclear.

Three decisions for every task

To get started, you don't need a governance handbook. Operationally, three decisions per task are often enough. They do not replace consultation with data protection and, where employees are affected, with the Betriebsrat (works council). In our projects, we start both early.

1. One responsible person

Every task gets a name, not a department. "Sales" is not responsible, but the head of the sales back office is. She decides whether the agent keeps running, reports problems and is the person to talk to when a result was wrong. This responsibility organises the work inside the company. Who is legally responsible is a different question.

2. A review mode

Decide how closely a person checks the results. We work with three review modes that have proved manageable:

Review mode and tier are linked. A home-built helper that only produces internal drafts can do without ongoing review. An integrated agent that sends emails to customers starts with every result checked.

3. A fixed review date

Every classification is an assumption. When you introduce a task, set a date on which the responsible person reviews the tier and the review mode: early for new agents, at longer intervals for proven ones. Then ask the four questions again and add two from operations: how many results had to be corrected? Has anything changed in the data or the users?

Tasks change tier, in both directions

An agent that works reliably for months can move from a full check to spot checks. The path also leads back: if errors become more frequent, a data source changes or a task suddenly reaches the outside world, the review gets tighter or the task goes back to a person. That does not mean the project has failed. It is what working governance looks like.

Typical classification mistakes

Four patterns come up often.

Uncontrolled spread. A helper that summarises incoming enquiries works. Colleagues start using it too, and a few months later half the sales team relies on it. Nobody decided that it had become a tier 2 system, and nobody takes over when the person who built it is on holiday.

Over-planning. A tool for meeting notes goes through a requirements specification and budget approval. By the time it is ready, employees have found their own solutions, without any rules.

Blind automation. An agent works around the clock. That tempts people to leave goodwill decisions or commitments with legal effect to it as well. A single error there can cost more than the automation saved.

Missing accountability. The result is wrong. IT points to the business unit, the business unit to the vendor, the vendor to the configuration. The problem rarely shows with the first agent in the company. It shows with the twentieth.

All four patterns have the same root. The classification is made once and never looked at again.

How to start on Monday

Together with the heads of the departments concerned, collect recurring tasks and classify each one with the four questions. Two decisions follow from this: one tier 1 task that starts immediately, and one tier 2 task that is planned as a pilot with a responsible person before anyone connects systems. For the step from pilot to everyday use, the handover checklist from pilot to routine operation helps.

We go through the complete classification checklist with you in the AI Diagnostic.

Frequently asked questions

How do I know whether a task is suitable for an AI agent? When the number of steps cannot be predicted. If the path is the same every time, a fixed workflow or a single, well-prepared request to a language model is often enough.

When is it worth bringing in external professionals for the integration? As soon as an agent carries out multi-step processes in the CRM, ERP, email or ticketing system, or as soon as a home-built helper shows one of the three signals from tier 2.

Where can I find reliable information on AI Act deadlines? From the EU institutions themselves. In May 2026, the Council announced a provisional agreement to simplify the AI Act. According to the European Parliament, Parliament and Council have since adopted the amendment. The deadlines that apply afterwards are set out there in the current version. Your legal counsel clarifies whether your use counts as high-risk.

This article describes our practical perspective. It does not contain a legal assessment; for that, we refer you to the linked primary sources and your legal counsel.

Sources

• Statistisches Bundesamt (Federal Statistical Office): Companies using artificial intelligence (in German, as of 24 November 2025)
• Anthropic: Building Effective AI Agents (19 December 2024)
• Official Journal of the EU: Regulation (EU) 2024/1689 (AI Act), original version of 12 July 2024, Article 4 (AI literacy), Article 14 (human oversight) and Article 50 (transparency)
• Council of the EU: Press release on the provisional agreement (7 May 2026)
• European Parliament: Legislative Train, Digital Omnibus on AI