Data Insights · Automation & AI
What can AI decide on its own? Setting boundaries in an automated process
The question of 2026 is not whether AI can do something, but whether you can trust it to. Three levels of mandate, an honest read on what the EU AI Act means for smaller companies, and why governance is a selling point — not a disclaimer.
Definition
Mandate in an automated process is the agreement, set in advance, on which decisions AI may take on its own, which it prepares for a person, and where it must stop and escalate. Den Otter Solutions records that mandate before a process goes live — so the client sets where the line sits, not the software.
"Can AI do this?" almost always answers yes. That is why it is the wrong question. The one that matters is: where do you let AI decide, and where does a person keep the wheel?
That is not a technical call. It is a governance one. And it is exactly the call many smaller companies get stuck on — not because they do not understand the technology, but because nobody has recorded who is responsible when it goes wrong.
Of the companies that considered AI but did not adopt it, 42 percent cite uncertainty about the legal consequences — liability for damage — as a reason not to (Statistics Netherlands, 2025). Privacy weighs on nearly half (49%). So it is not the technology holding them back, but the absence of a clear line.
Three levels of mandate
Not every decision belongs at the same level. The workable approach is to decide, per step in a process, how much freedom AI gets. There are three.
- AI proposes, a person decides Person decides — always AI prepares: a booking, a draft reply, a classification. A person looks and signs. This is the safest level and the right starting point for anything touching money, customers or law. A booking belongs here. Releasing a payment does too.
- AI acts within bounds, a person oversees AI acts — within a fixed frame AI executes on its own, but only within limits agreed in advance: below an amount, with a trusted supplier, within a category. Anything outside becomes an exception that goes to a person. Routing an email fits here. Pushing through an order below a threshold too — if you chose that threshold deliberately.
- AI acts autonomously AI decides — low stakes only Fully without intervention. Only justified for decisions that are cheap and reversible: sending an internal alert, assigning a label, updating a status. Never for anything touching a customer or the cash. This level is rarer than the market suggests.
AI works within boundaries you set. The question is not what it can do, but what you allow it to.
The EU AI Act for smaller companies — honestly
There is a lot of noise around the AI Act. Agencies sell "AI Act compliance" as a mandatory, expensive project for everyone. For most small-business automation that picture is wrong. The honest story is more nuanced — and more reassuring.
The AI Act classifies systems by risk. The heaviest obligations (conformity assessment, CE marking, ongoing risk management) apply only to high-risk AI: systems that decide about people — recruitment, credit scoring, access to education, benefits. Reading an invoice, routing an email, sending a stock alert does not fall under that. So the heaviest rules usually do not bite.
What does apply broadly, and already:
The core: for a company automating invoices or email, the AI Act is not a blocker. AI literacy and — where there is customer contact — transparency are what matter now. The rest is mainly relevant if you let AI decide about people, and that is something you would not do without human oversight anyway.
Governance as an advantage, not a disclaimer
The reversal
Human oversight is often presented as a burden: something the law demands. That is the wrong lens. For high-risk AI it is indeed a legal requirement, but for ordinary process work it is a design choice — and one that makes your business stronger.
A process with a recorded mandate, clear boundaries and an escalation path to a person is not slower or more expensive. It is more reliable. You know exactly what AI may do, where it stops, and who steps in when something deviates. That is not a compliance exercise — it is simply well-organised work.
Den Otter Solutions records that mandate explicitly on every engagement: which decisions AI takes itself, which it prepares, and where it escalates. Not because it is required, but because a process you cannot trust is not a process you want running.
How you record it
In practice this means: before a process goes live, it is set out per step at which level AI operates. Who handles the exceptions. Where the thresholds sit and who may move them. And what happens when the system meets something it does not recognise.
That document is not a formality. It is what turns "a person keeps the wheel" from a slogan into a working agreement. And it is what you can simply show later, when the AI Act phases do start to apply or when a client asks.
Want to know whether your organisation is ready to deploy AI responsibly? Den Otter Solutions delivers this work remotely for clients in the Netherlands and abroad, at a fixed price per process, with the mandate recorded and handed over.
The bottom line
What AI may decide is something you set yourself — per step, across three levels, with a person on the points that matter. The EU AI Act does not make that more complicated for most small-business automation: literacy and transparency count now, the heavy rules mainly touch decisions about people.
And the line underneath it all: process first, tool second, and AI only where it adds something — within boundaries you record. Not everything has to be AI, and certainly not everything has to be decided by AI.
Frequently asked questions
-
That a person decides or intervenes at a recorded point in the process, rather than AI handling it entirely on its own. Concretely: AI prepares, a person approves. Or AI acts within bounds and a person handles the exceptions. Den Otter Solutions sets the level per process step — from "AI only proposes" to "AI acts autonomously" — depending on how serious the consequences of an error are.
-
Usually not. High-risk applies to AI that decides about people: recruitment, credit scoring, access to education, benefits. Invoice processing, email routing and stock alerts do not fall under that and carry none of those heavy obligations. What does apply broadly is the AI literacy obligation (since February 2025) and, for customer-facing chatbots, the transparency obligation (from August 2026).
-
The organisation deploying the process — not the AI and not the model provider. That is why a recorded mandate is not a formality: it sets out which decisions AI was allowed to take and which a person should have approved. A process with clear boundaries and an escalation path to a person keeps responsibility verifiable rather than diffuse.
-
Two things that already apply: ensure staff understand what the AI system does and does not do (AI literacy, mandatory since February 2025), and for a customer-facing chatbot make clear that it is AI (transparency, from August 2026). The GDPR also continues to apply in full where personal data is involved. The heavier high-risk obligations are postponed to December 2027 and do not touch most small-business automation.
-
By setting the mandate level per process step before the process goes live: which decisions AI takes itself, which it prepares for a person, where the thresholds sit and what happens at an exception. Den Otter Solutions delivers this as part of every automation engagement, so the boundary is recorded and demonstrable — to your own team and to a client who asks.
-
Yes. Den Otter Solutions is based in the Netherlands and delivers automation and governance work remotely for clients internationally. The process audit, the build and the recorded mandate all run remotely, in English or Dutch, at a fixed price per process. The EU AI Act applies to AI systems used within the EU regardless of where the provider is based.
Read next
AI automation
Fixed price per process, built on your own accounts, with a recorded mandate.
Pillar 4How to automate invoice processing without losing control
Where AI reads and a person signs — the line from this article, applied.
Pillar 3Agile data governance for SMEs
Agreements about data, without turning it into a project.
Next step
AI within boundaries you set yourself.
Den Otter Solutions starts every engagement with the question of which decisions AI may take and where a person keeps the wheel — and records that mandate before anything goes live. Fixed price per process, built on your own accounts, handed over documented.