Two vendors can pitch the same operations team in the same week and both say the word automation. One sells a bot that clicks through your billing screen at night. The other sells an agent that reads an unfamiliar invoice and decides what to do with it. The demos look similar. The obligations that come with them are not similar at all, and the clearest statement of where the line falls was not written by either vendor. It was written by the federal government.

What a bot is, in the government's own words

The General Services Administration describes robotic process automation as software that, in its phrasing, is built to "mimic basic human-computer interactions." Digital.gov, the federal guide for agency teams, puts the working instruction even more plainly: "Configure bots to automate repetitive tasks so users can focus on higher-value work." Both descriptions are about imitation. Neither is about judgement.

That is not a criticism. Imitation at volume is worth real money. One GSA acquisition bot, by the agency's own count, "has processed about 15,000 transactions and closed 6,000 awards, saving over 17,000 hours" since its rollout. If your process is stable, if the rules are already written down, and if the screen never moves, a bot is often the correct and cheapest answer. Nothing in this article argues otherwise.

The comfortable assumption that does not survive an audit

The usual reason buyers prefer rule-based bots is safety. A bot only does what it was told, so the reasoning goes, and therefore carries less risk. The GSA inspector general tested that assumption inside the agency running the bots and found the agency "did not comply with its own IT security requirements to ensure that bots are operating securely and properly," including access left in place for bots that had already been decommissioned.

Predictable behaviour and a governed deployment are two different properties. A bot inherits the discipline of whoever manages its credentials, its change log and its retirement. Rule-following buys you none of that for free.

Where the actual line is

The federal memorandum governing agency use of artificial intelligence, OMB M-24-10, does not treat robotic process automation as artificial intelligence at all. Its definition says so in one sentence: "This definition of AI does not include robotic process automation or other systems whose behavior is defined only by human-defined rules or that learn solely by repeating an observed practice exactly as it was conducted."

Read what that excludes and what it does not. The line is not drawn at how modern the software looks, or how much it costs, or whether a model is involved somewhere in the stack. It is drawn at one question: does the system follow rules a person wrote, or does it produce an output that a person did not specify in advance? Everything on the first side of that line is a bot, however impressive the interface. Everything on the second side is a deciding system, however small.

What crossing the line actually costs

Once a system decides, federal policy attaches duties to it. The same memorandum requires agencies to "provide additional human oversight, intervention, and accountability as part of decisions or actions that could result in a significant impact on rights or safety," and to maintain a fail-safe where immediate human intervention is not practicable.

The national risk framework then turns that duty into something you can hand to an auditor rather than something you intend. NIST AI 100-1 requires that processes for human oversight be defined, assessed and documented in line with the organisation's own governance policies. Documented is the operative word. An oversight arrangement that exists only in the head of the person who built the workflow does not satisfy it.

This is the part buyers most often price at zero. The agent licence is on the quote. The review step, the escalation path, the record of who checked what and when, and the person whose job includes looking at the exceptions are not on the quote, and they are the difference between a deciding system you can defend and one you cannot.

How early this actually is

It helps to know how much of the market has moved. The Federal Reserve's tracking of adoption in the United States economy put use at about 18 percent of firms at the end of 2025. The Census Bureau found the weight sits with larger companies: 37 percent of firms with at least 250 employees reported using artificial intelligence in their business operations.

Roughly four firms in five have not adopted, and the ones that have skew large. If you are a mid-sized company being told you are late, the federal numbers say you are not. You are early enough to choose the right tool rather than the loudest one.

The decision, stated plainly

Take the process you were about to automate and answer one question about it. Can you write down, today, every rule the work follows, including what to do with the awkward cases? If yes, buy a bot, and spend the savings on the credential hygiene the inspector general found missing. If no, and the work requires someone to look at an input that varies and decide, then you are buying a deciding system, and the oversight artifact is part of the purchase, not an afterthought.

PATech Labs builds the second kind, and says out loud when a client needs the first. The question we ask before any build is the one above, because a company that answers it honestly saves more than either tool does.