Why Agentic AI is Not RPA With a Language Model

In enterprise meetings, agentic AI often gets translated as “RPA, but the bot can read unstructured email.” That translation is comforting. It is also wrong. RPA executes scripted UI or API paths. Agentic systems propose paths under uncertainty. Glue an LLM onto a bot farm and you still have RPA with a smarter parser — until someone loosens the script and discovers side effects the CoE never budgeted for.

What RPA actually is#

Robotic process automation runs deterministic procedures against brittle interfaces: open screen, click, copy field, paste, if error then retry. Strengths: auditability, enumerable paths, familiar controls. Weaknesses: UI churn breaks bots; exceptions explode into human queues; unstructured input needs brittle rules or upstream ML.

Swapping the regex extractor for an LLM does not change the control philosophy. The procedure still owns the next step.

What agentic AI actually is#

Agentic AI puts a model in the proposal seat for control flow: which tool, whether to continue, whether to ask. Your harness still owns allowlists, budgets, and commits. The point is handling work where the procedure cannot be fully written in advance — not faster clicking.

If every production run traces the same click path with different extracted strings, you built LLM-enhanced RPA. Say that out loud. Finance will relax.

The misconception’s favorite slide#

“Before: 40 RPA bots. After: one agent.” The slide implies headcount collapse and cognitive magic. Reality check:

• RPA estates fail on maintenance and exception volume, not on missing poetry.
• One unbounded agent fails on cost, tool abuse, and non-deterministic compliance evidence.
• Many RPA jobs should stay RPA — or become plain APIs — not agents.

The useful migration is selective: keep deterministic cores; add LLM extraction at the edges; add bounded agentic slices only where discovery is real.

Failure modes do not transfer 1:1#

Training an RPA CoE to “operate agents” without teaching trajectory evals and allowlists is how you end up forcing RPA change management onto a fundamentally different system.

A concrete contrast#

Invoice email → payment system

RPA+LLM version:

1. Bot watches inbox
2. LLM extracts fields into a schema
3. Bot enters fields into ERP via known screens
4. If validation fails, ticket to AP

Agentic version:

1. Observe email + attachments
2. Model may call fetch_po, match_vendor, request_clarification, create_draft_payment
3. Harness blocks release_payment without dual control
4. Loop stops on budget or escalate

Same business goal. Different control planes. The second needs injection defenses on email content, tool allowlists, and evals that score whether the right tools were chosen — not only field accuracy.

# RPA-shaped: procedure owns control flow
def invoice_bot(email: str, extract_llm, erp) -> None:
    fields = extract_llm(email)          # language model as parser
    erp.enter_invoice(fields)            # fixed path
    if not erp.validate():
        erp.open_ticket("AP_EXCEPTION")

# Agentic-shaped: model proposes; policy owns danger
ALLOWED = {"fetch_po", "match_vendor", "ask_vendor", "draft_payment"}

def invoice_agent(observe, propose, run_tool, gate, max_steps=6) -> str:
    for _ in range(max_steps):
        obs = observe()
        step = propose(obs)  # structured tool | finish | escalate
        if step.kind != "tool":
            return step.kind
        if step.tool not in ALLOWED:
            return "escalate"
        if step.tool == "draft_payment" and not gate.human_ok(step):
            return "await_human"
        run_tool(step.tool, step.args)
    return "budget_stop"

Where LLM-enhanced RPA is the right call#

Choose it when:

• The happy path is stable and known
• UI or API automation already works
• Unstructured input was the only pain
• Regulators want a fixed script ID for each case type

Do not apologize for that choice. A reliable bot with an LLM parser beats a theatrical agent that sometimes invents vendors.

Where agentic earns its keep#

Choose agentic slices when:

• Evidence location varies case to case
• Tool choice depends on intermediate results
• Human procedures are “investigate until confident”
• You can staff bounds, traces, and trajectory evals

Even then, wrap the slice in a workflow: deterministic intake → agentic middle → deterministic commit.

Org implications#

RPA CoEs optimize for bot lifecycle, selector health, and license packs. Agentic platforms need model gateways, eval harnesses, tool catalogs, and incident playbooks for runaway loops. You can house both under one “automation” umbrella only if leadership accepts two operating models.

Force a taxonomy in the portfolio: RPA, LLM-enhanced RPA, workflow+LLM, bounded agent. Portfolio reviews get shorter when labels match machinery.

Procurement and vendor traps#

Vendors know the RPA comfort zone. Watch for demos that:

• Show a happy-path UI walkthrough with an LLM reading a PDF, then call the whole thing “autonomous agents”
• Hide max-step and allowlist settings three menus deep
• Offer “use your existing bot credentials” as the default tool identity

Ask for: trajectory samples from messy inputs, injection test results, and a written list of tools that can mutate money, access, or customer communications. If the answer is a shrug and a GPT logo, you are buying a parser with ambitions.

Internal build traps mirror the vendors: cloning UiPath-style calendars for “agent health” while ignoring token burn and repeated tool failures. Build the dashboards for the failure modes you actually have.

A migration story that works#

One shared-services team had 120 RPA bots. They did not “replace them with one agent.” They classified each bot: 70 stayed RPA; 35 became API automations; 12 got LLM extraction at the inbox edge; 3 investigation-heavy processes earned a bounded agent behind a workflow. Cycle time improved where discovery hurt. Audit stayed clean where scripts already worked. That portfolio math is dull — and it ships.

If your transformation plan has a single bar chart sloping to zero bots and one mega-agent, challenge the chart. Agentic AI is a surgical tool, not a landfill for every legacy selector.

Summary#

Agentic AI is not RPA with a language model. RPA scripts the path; agentic systems propose paths under harness constraints. Use LLMs to harden extraction inside bots when the path is known. Reserve agentic loops for genuine discovery — and never inherit RPA’s control assumptions for a system that can choose its next tool.