AI agents in small business customer support: how to set them up with human review

Carlos Imlau, AI Product Builder · Certified trainer (CCP) · AI applied to work · 2026-10-30

Can an AI agent handle customer support for a small business? It can handle a good share of it: answering frequent questions, giving order status, offering time slots, drafting replies. What it shouldn't do alone is decide anything with consequences, such as refunds, exceptions to the rules or replies to angry customers. That's where human review comes in: the agent prepares, a person approves.

That balance is what makes an agent useful in a small company. In this guide I explain what an AI agent can do in support, what EU law already requires, how to set up human review and where to start without putting customer relationships at risk.

What is an AI agent in customer support?

A traditional chatbot follows a script: questions and answers written by hand. An AI agent uses a language model to understand the question, looks for the answer in your documents and can use tools: check an order in your system, look at the calendar, open a support ticket or send an email.

The ability to act changes everything. An agent that only answers can get a sentence wrong. An agent that acts can get an action wrong: book the wrong slot, promise a refund, send a message it shouldn't. So with an agent, the question isn't just "what does it know?" but also "what can it do without asking?".

Which tasks can an agent handle in a small business?

Repetitive, low-risk tasks with known answers work well:

• FAQs: opening hours, addresses, delivery times, payment methods, return policies.
• Order status: the agent checks the system and answers with real data.
• Bookings: offering free slots, confirming and sending reminders.
• Triage: understanding the topic, collecting missing details (order number, a photo of the defect) and handing over to a person with everything in order.
• Draft replies: the agent writes, a person reviews, edits and sends.

What should not be left to the agent alone: refunds and compensation, policy exceptions, complaints, anything involving health, money or sensitive personal data, and any customer who asks to speak to a person.

Is a company responsible for what its chatbot says?

Yes, and there is a well-known case. In February 2024, a civil resolution tribunal in British Columbia, Canada, ruled for a passenger against Air Canada. The airline's website chatbot had told him he could apply for a bereavement fare after travelling, which the airline's rules did not allow. Air Canada argued it could not be held liable for information provided by the chatbot. The tribunal disagreed and ordered it to pay the customer the difference.

The lesson applies to any small business: what the agent says on your website or your WhatsApp is your company speaking. If the agent promises something, the promise is yours.

What does EU law say about chatbots and agents?

If you serve customers in the EU, two rules matter.

AI Act, Article 50. Regulation (EU) 2024/1689 requires AI systems designed to interact directly with people to be built so that those people know they are dealing with an AI, unless it is obvious. The obligation falls on the system's provider and has applied since 2 August 2026. The Digital Omnibus postponed the high-risk rules but left this date in place. If you use an off-the-shelf tool, check that it tells customers. If you build your own agent, that's on you. Either way, a line like "I'm the shop's virtual assistant; I can hand you over to a person at any time" does the job.

GDPR, Article 22. The General Data Protection Regulation gives people the right not to be subject to decisions based solely on automated processing that significantly affect them. Refusing a refund or a warranty claim fully automatically is delicate ground. One more reason for those decisions to go through a person.

If you haven't dealt with AI training for the people who use it at work, also read the article on AI literacy under the AI Act: whoever reviews the agent's replies needs to know where AI tends to fail.

How does human review work in practice?

Human review ("human in the loop") means the agent stops before certain actions and waits for a person to approve. Automation tools like n8n already include it: in n8n you can require human approval before an agent uses a tool. The workflow pauses, the person gets the request in Slack, Teams, Gmail, Telegram or another channel, sees what the agent wants to do and with what data, and approves or denies. If denied, the action is cancelled and the agent is told.

In practice there are three levels of autonomy, and it pays to climb one at a time:

1. Drafts only. The agent writes, the person sends. Zero risk, and it already saves time.
2. Automatic replies for simple things, approval for the rest. FAQs go out straight away; anything touching money, exceptions or sensitive data waits for approval.
3. Autonomy with sampling. The agent handles the categories that have proven to work, and a person reviews a sample every week.

How to set up a support agent in 6 steps

1. List the questions you get. Export a month of emails or messages and group them by topic. Usually a handful of topics take up most of the time.
2. Write the knowledge base. Return policies, delivery times, prices, opening hours, in one clear, up-to-date document. The agent is only as good as what you give it to read.
3. Define what the agent can and can't do. A short list: "may check orders; may offer slots; never promises refunds; hands over to a person when the customer asks or is upset".
4. Put human review on actions with consequences. Refunds, cancellations and replies to complaints always need approval.
5. Tell the customer and always offer a way out. Say it's an AI and make it clear how to reach a person.
6. Run in draft mode for two to four weeks. See where the agent gets it right and where it fails, fix the knowledge base and only then give it autonomy on simple questions.

If you want to see how to think through an automation before touching any tools, the article on automating tasks with AI without coding goes well with this one.

Which mistakes should you avoid?

• Plugging the agent into your site without a knowledge base. Without documents, it makes up plausible answers.
• Giving it access to everything. The agent should only see the systems and data it needs for the tasks you gave it.
• Hiding that it's an AI. Besides being mandatory, customers find out and trust goes.
• Not measuring. If you don't look at the replies, you don't know whether the agent is helping or creating work.
• Thinking it's "set and forget". Policies and prices change; the knowledge base has to keep up.

Frequently asked questions

Do I need to code to build a customer support agent?

Not necessarily. Tools like n8n let you build the workflow with visual blocks. But you do need to understand the process, write the rules well and test with real cases before opening it to customers.

Can the agent answer on WhatsApp?

Yes, if the tool connects to WhatsApp Business. n8n, for example, has a WhatsApp Business Cloud integration. The rules are the same: say it's an AI, offer a way to reach a person and don't leave decisions with consequences without approval.

How long does it take to get an agent running?

It depends on the number of topics and systems to connect. What takes longest isn't the tool, it's writing the knowledge base and the rules. Starting in draft mode lets you use it early with no risk.

Does an AI agent replace the support person?

In a small business, rarely. What usually changes is the kind of work: fewer repeated replies, more time for the hard cases and for reviewing what the agent proposes.

Where can I learn to set this up in my company?

In the "Automating work with AI" training I work with your company's own cases; a customer support agent with human review is a good place to start. The training is for companies in Portugal. If you need a custom system connected to your data, see MVP development.