AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Where a decision about a person is made solely by automated means and has a legal or similarly significant effect, such as refusing credit or a service, UK, EU and Nigerian data protection law gives that person rights, including to human intervention and to contest the decision. The simplest safe design is for agents to approve within limits but send adverse significant decisions to a person.
Which decisions are covered
Most of what an AI agent does is not an "automated decision" in the legal sense. Answering a question about opening hours, drafting an invoice or reminding a customer about a payment does not decide anything significant about them. The rules bite when two things are true: the decision is made solely by automated means, with no meaningful human involvement, and it has a legal or similarly significant effect on the person.
- Refusing credit, a pay-later plan or an account.
- Refusing a refund or closing an account in a way that affects someone's money or access to a service.
- Screening job applicants out of a process.
- Setting a materially different price or term for one person based on profiling.
This is general information, not legal advice. Whether a particular decision is covered depends on the facts.
The rules by jurisdiction
| Where | Law | Core position |
|---|---|---|
| UK | UK GDPR articles 22A to 22D, inserted by the Data (Use and Access) Act 2025 | Restrictions on significant decisions based solely on automated processing, with required safeguards; the ICO is consulting on updated guidance |
| EU | GDPR article 22; AI Act Article 26(11) for some high-risk uses | Right not to be subject to solely automated significant decisions, with exceptions and safeguards; duty to inform people where high-risk AI is used to decide about them |
| Nigeria | Nigeria Data Protection Act 2023, section 37 | Right not to be subject to a decision based solely on automated processing with legal or similarly significant effects; safeguards include human intervention and the right to contest |
| Canada | PIPEDA, with OPC guidance on generative AI | Principles of openness, accountability and appropriate purposes apply; Quebec has its own specific rules |
| United States | No single federal rule; state privacy laws, for example California's ADMT regulations | California has adopted rules on automated decisionmaking technology under the CCPA; obligations vary by state |
The safeguards that apply
Under the UK rules, as the ICO describes them, the safeguards for significant automated decisions include giving people information about the decision, letting them make representations, enabling them to obtain human intervention and letting them contest the decision. Section 37 of Nigeria's Act requires similar safeguards: human intervention, the chance to express a view and to contest. In practice, a business using agents should be able to:
- Tell customers, in its privacy information, that automated processing is used and for what.
- Explain, in plain words, the main reasons for a particular decision.
- Give people an easy route to a person who can look at the case again.
- Have that person able, and willing, to change the outcome.
Design so the hard cases reach a person
The most practical approach for a small business is asymmetric: let the agent say yes within limits, but not say no alone. Approving a refund within policy is rarely a problem for the customer. Refusing one may be a significant decision. If every adverse significant decision is reviewed by a person who can change it, the decision is no longer solely automated.
Worked example (illustrative)
A Lagos electronics retailer offers instalment plans. Its agent checks applications against the written policy. Where the policy is met, the agent approves plans up to ₦400,000. Where it is not, the agent does not decline: it prepares a summary of the reasons and sends the case to a credit officer, who decides within one working day and can call the customer. The privacy notice explains that applications are first assessed automatically and that any refusal is made by a person.
That person must be real oversight, not a click. The ICO is clear that a decision is solely automated if there is no meaningful human involvement. See human in the loop or on the loop and approval fatigue.
Related obligations
- Decisions involving profiling or automated decision-making are on the ICO's list of processing likely to need a DPIA; see do you need a DPIA before deploying an AI agent.
- Under the EU AI Act, credit scoring of individuals is listed among high-risk uses, with obligations applying from 2 December 2027.
- Customers in Nigeria have wider rights under the NDPA; see your data rights under the Nigeria Data Protection Act.
A short checklist
- List every decision your agents make or shape about a customer, applicant or employee.
- Mark which could have a legal or similarly significant effect on the person.
- For those, make sure an adverse outcome is decided or reviewed by a person who can change it.
- Update your privacy information to describe the automated processing in plain words.
- Keep a record of each significant decision, its reasons and any review, so you can answer a challenge.
Where Pryme fits
Pryme Business agents work inside a mandate with a ceiling: above it, they stop and a person decides. The Customer Support agent settles what policy allows and escalates disputes and exceptions; it cannot grant an exception or change a policy. Every action is recorded with its source, so a person reviewing a case can see what the agent saw.
Questions people ask
Is every AI decision about a customer an automated decision in law?
No. The main rules apply to decisions made solely by automated means that have a legal or similarly significant effect, such as refusing credit or a service. Routine answers and reminders are not usually covered.
Does a human approval step take a decision out of the rules?
Only if the human involvement is meaningful: the reviewer understands the case, has the information and can change the outcome. A rubber stamp does not count.
What must I tell customers?
That automated processing is used, what it is for, and how they can reach a person and contest a decision. For a particular decision, the main reasons in plain words.
Do US businesses have automated decision rules?
There is no single federal rule, but several states regulate it. California has adopted regulations on automated decisionmaking technology under the CCPA. Check the states where your customers live.
Sources
- ICO: Automated decision-making, including profiling · accessed Oct 2026
- Data (Use and Access) Act 2025 (legislation.gov.uk) · accessed Oct 2026
- Nigeria Data Protection Act 2023, full text (KPMG Nigeria copy) · accessed Oct 2026
- AI Act Service Desk: Article 26, Obligations of deployers · accessed Oct 2026
- OPC: Principles for responsible, trustworthy and privacy-protective generative AI · accessed Oct 2026
- California Privacy Protection Agency: laws and regulations (incl. ADMT rules) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.