AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
A contract with an AI agent provider should say what the agent may do, what happens to your data, who is responsible when something goes wrong, what records you get, and how you leave. Where personal data is involved, data protection law in the UK, EU and Nigeria also requires a written agreement with the processor.
Why the contract matters more with agents
Buying an AI tool that drafts text is one thing. Buying an agent that reads your customer records, sends messages and moves money is closer to outsourcing a job. The contract, together with the terms of service and any data processing agreement, is where the limits of that job are fixed. If it is silent, you may find the provider can use your data in ways you did not expect, or that you cannot get your records back when you leave.
This is general information, not legal advice. Have a lawyer review any agreement that matters to your business.
What data protection law requires
When a provider processes personal data on your behalf, you are usually the controller and the provider is your processor. Several laws then require a written contract:
- UK GDPR article 28 requires a binding contract setting out, among other things, that the processor acts only on your documented instructions, keeps the data confidential, applies appropriate security, uses sub-processors only with your authorisation, helps you meet people's rights, and deletes or returns the data at the end. The ICO's guidance on controller and processor contracts explains each term.
- Nigeria Data Protection Act 2023, section 29, requires processors to follow the Act's principles, help with data subject rights and keep appropriate security, and says these measures include a written agreement between controller and processor.
- EU GDPR contains the same article 28 requirement for businesses serving people in the EU.
If the provider insists it is a controller for some uses, such as improving its own models, find out exactly which data and why. That is a separate decision you should make knowingly.
A checklist of terms to look for
| Area | What to agree | Why it matters |
|---|---|---|
| Scope and mandate | The tasks the agent performs and the limits it works within | Defines what the provider is responsible for |
| Data use | Whether your data is used to train or improve models, and an opt-out | Your customer data may otherwise leave your control |
| Location and transfers | Where data is stored and processed, and the transfer safeguards | Required under UK, EU and Nigerian law for overseas transfers |
| Sub-processors | A list, and notice before changes | You remain accountable for the chain |
| Security | Measures, testing and access controls | UK GDPR article 32 requires appropriate security |
| Logs and records | What is recorded, how long, and your right to export it | You need evidence for audits, disputes and tax |
| Incidents | How quickly the provider tells you of a breach or malfunction | UK GDPR and the NDPA give you 72 hours to notify the regulator once aware |
| Changes | Notice before material changes to models or behaviour | A change can alter how the agent acts |
| Liability | Caps, exclusions and what is covered | Many standard terms cap liability at fees paid |
| Exit | Data return format, deletion, and a transition period | Avoids being locked in or losing records |
Questions to ask before you sign
- Can the agent ever act above a limit I set, and who can change that limit?
- Is every action recorded with its source, and can I export the log?
- Is the agent tested before it is allowed to act, and is it re-tested when its model, mandate or data changes?
- What happens when the agent is uncertain: does it stop, guess or ask?
- Will you tell me before you change the underlying model?
- Who do I call if the agent does something wrong at 2am?
Ask for the answers in writing, ideally in the contract or its schedules rather than in a sales email. If a feature you rely on, such as the spending ceiling or log export, is described only in marketing material, it may not bind the provider. Vague answers are themselves an answer. A provider that cannot say where its agent stops is asking you to carry that risk. For a fuller look at oversight duties, see human in the loop or on the loop and AI agents for business finance: what they can and can't do.
EU AI Act points for deployers
If you use a high-risk AI system in the EU, Article 26 of the AI Act requires you as deployer to use it according to the provider's instructions, assign human oversight to competent people, monitor it, and keep the logs under your control for at least six months unless other law says otherwise. Your contract should make sure you receive those instructions and can access those logs. Most small-business agents will not be high-risk, but the same terms are good practice anyway.
Separately, from August 2026 the AI Act's transparency rules apply, including that people interacting with certain AI systems should be told they are dealing with a machine unless it is obvious. If the agent talks to your customers, agree who is responsible for that disclosure and how it appears.
Where Pryme fits
Pryme Business agents are built, trained and certified by Pryme Intelligence, a separate company that makes a governed agentic operating system. Each agent works inside a mandate with a ceiling, every action is recorded with its source, and agents must re-earn certification when their mandate or data changes. Read the security page and how it works alongside the account terms before you open an account.
Questions people ask
Do I need a data processing agreement with an AI agent provider?
If the provider processes personal data for you, UK GDPR article 28, the EU GDPR and section 29 of Nigeria's Data Protection Act all require a written agreement. Many providers include one in their terms; check it covers the points above.
Can an AI provider train its models on my customer data?
Only if your agreement allows it. Look for a clear statement on training and improvement, and an opt-out. Using customer data for a new purpose may also need its own lawful basis.
Who is liable if the agent makes a costly mistake?
It depends on the contract and the law. Standard terms often cap the provider's liability, so you may carry most of the loss. Limits, approvals and records reduce the chance of a costly mistake in the first place.
What should happen to my data when I leave?
The contract should give you a copy in a usable format, including the action log, and require deletion afterwards, with confirmation. Agree a transition period so you are not cut off mid-month.
Sources
- UK GDPR Article 28: Processor (legislation.gov.uk) · accessed Oct 2026
- ICO: Contracts and liabilities between controllers and processors · accessed Oct 2026
- Nigeria Data Protection Act 2023, full text (KPMG Nigeria copy) · accessed Oct 2026
- UK GDPR Article 32: Security of processing (legislation.gov.uk) · accessed Oct 2026
- AI Act Service Desk: Article 26, Obligations of deployers · accessed Oct 2026
- AI Act Service Desk: Article 50, Transparency obligations · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.