AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
Part of the guideAI agents for business finance: what they can and can't do
The short answer
For most finance teams the EU AI Act asks for less than feared: reconciliation, close, collections and forecasting tools are not high-risk. The duties that apply now are supporting staff AI literacy and, from 2 August 2026, telling people when they are dealing with an AI system. AI that scores the creditworthiness of individuals, or prices life and health insurance, is high-risk and faces full obligations from 2 December 2027.
The EU AI Act regulates AI by what it is used for, not by the technology inside it. That makes the first question for a finance team simple: what do our AI tools actually decide? This article answers it for common finance uses. For the wider regulatory picture across the UK, US and Canada, see the regulation section of our guide to AI agents for business finance.
The dates that matter, as of October 2026
The Act entered into force on 1 August 2024 and applies in stages. In 2026 the EU adopted a Digital Omnibus on AI that moved the high-risk dates back and softened the AI literacy duty.
| Date | What applies |
|---|---|
| 2 February 2025 | Banned practices; AI literacy duty (since reworded by the Omnibus as a duty to take measures to support staff AI literacy, with no set level required) |
| 2 August 2025 | Rules for providers of general-purpose AI models; national authorities and penalty regimes in place |
| 2 August 2026 | Most remaining rules and enforcement, including Article 50 transparency duties |
| 2 December 2026 | End of a grace period for some providers of synthetic-content systems already on the market |
| 2 December 2027 | High-risk rules for standalone systems listed in Annex III, including credit scoring of individuals |
| 2 August 2028 | High-risk rules for AI built into products covered by other EU product law |
Does it apply to you?
The Act reaches beyond EU companies. It covers providers who place AI systems on the EU market and organisations that use AI where the output is used in the EU. A UK or US business using an AI agent to serve EU customers can fall within it as a "deployer". The Act distinguishes two main roles:
- Provider
- The organisation that develops an AI system, or has it developed, and puts it on the market under its own name. Most duties for high-risk systems sit here.
- Deployer
- An organisation that uses an AI system under its authority in a professional context. A finance team using a vendor's AI tool is usually a deployer.
If you build your own model for credit decisions, you may be both.
Classifying common finance uses
The table below sorts typical finance tools into the Act's categories. It is a guide, not legal advice; the details of how a tool is used can change the answer.
| Finance use | Likely category | Main duties |
|---|---|---|
| Bank reconciliation, bookkeeping, month-end close | Minimal risk | AI literacy support |
| Invoice chasing and collections from businesses | Minimal risk, plus transparency if it talks to people | AI literacy; tell people they are dealing with AI where Article 50 applies |
| Customer support chatbot | Transparency | Make clear the person is interacting with an AI system, unless obvious |
| Fraud detection | Not high-risk under the credit category, which carves out fraud detection | AI literacy; general law such as data protection |
| Creditworthiness or credit scoring of individuals | High-risk (Annex III) | Full high-risk regime from 2 December 2027 |
| Risk assessment and pricing for life and health insurance | High-risk (Annex III) | Full high-risk regime from 2 December 2027 |
| Credit assessment of companies | Not listed as high-risk | AI literacy; general law |
Most of the tools covered in this series, such as reconciliation and month-end close, sit in the first row. AI customer support sits in the transparency row.
If you deploy a high-risk system
A lender using AI to assess individuals will have deployer duties under Article 26 from 2 December 2027. In summary:
- Use the system according to the provider's instructions for use.
- Assign human oversight to people with the competence, training and authority to exercise it.
- Make sure input data under your control is relevant and representative for the purpose.
- Monitor the system in operation and, if it presents a risk or a serious incident occurs, inform the provider and authorities and suspend use where needed.
- Keep the logs it generates, where under your control, for at least six months unless other law sets a different period.
- Inform workers' representatives and affected staff before using a high-risk system at work.
- Certain deployers, including those assessing creditworthiness, must carry out a fundamental rights impact assessment before first use.
The log duty links directly to our article on what an AI audit trail should record; a good trail meets it with room to spare.
Penalties, with an example
Breaching the operator duties, including deployer duties and Article 50 transparency, can bring fines of up to €15 million or 3% of worldwide annual turnover. For larger companies the cap is generally the higher of the two; for SMEs and start-ups it is the lower. Take two lenders that each breach a deployer duty:
- A lender with €2 billion turnover: 3% is €60 million, which is higher than €15 million, so the cap is €60 million.
- An SME lender with €20 million turnover: 3% is €600,000, which is lower than €15 million, so the cap is €600,000.
These are maximums. Actual fines take account of the nature, gravity and duration of the breach.
What a finance team should do now
- List every AI tool in finance, what it decides and whose data it uses.
- Classify each one using the categories above, and note whether you are provider or deployer.
- Give staff who use or oversee AI practical training on what the tools do and where they fail.
- Add AI disclosure to any customer-facing chat, email or voice agent serving EU customers.
- If any tool touches credit decisions about individuals, start preparing for 2 December 2027 now: oversight roles, logs, data checks and the impact assessment.
- Write each agent's mandate and ceiling down, as set out in the parent guide on governing AI agents. It is useful evidence whatever your risk category.
Where Pryme fits
Pryme's business agents (a Chief of Staff and Finance, Compliance, Sales and Customer Support agents) prepare work, and above each agent's ceiling a person decides. Whether any AI tool is high-risk depends on what it is used for: routine tasks such as payment matching and customer queries generally sit outside the Act's high-risk list, while anything feeding credit decisions about individuals needs a closer look. A written mandate, a ceiling and an audit trail are the kind of controls the Act's oversight and record-keeping duties point towards. The agents are built and certified by Pryme Intelligence, a separate company. See the Compliance agent.
Outside Nigeria, Pryme's activities are carried out through regulated partners. This article is general information, not legal advice.
Questions people ask
Is AI bookkeeping high-risk under the EU AI Act?
No. Bookkeeping, reconciliation and close tools are not in the Act's high-risk list. The main duty is to support AI literacy among staff who use them.
When do the EU AI Act high-risk rules apply to credit scoring?
Following the 2026 Digital Omnibus, the high-risk rules for standalone systems in Annex III, which include creditworthiness assessment of individuals, apply from 2 December 2027.
Does the EU AI Act apply to UK companies?
It can. It applies to providers placing AI on the EU market and to organisations whose AI output is used in the EU, wherever they are based. A UK firm serving EU customers with an AI agent should check its position.
Do I have to tell customers they are talking to an AI?
Under Article 50, which applies from 2 August 2026, systems that interact directly with people must make clear they are AI, unless it is obvious from the context. Building the disclosure into the first message is the simplest approach.
What is the AI literacy requirement?
Organisations that provide or deploy AI must take measures to support the AI literacy of staff who operate or use it, taking account of their role and experience. After the Omnibus, no specific level of literacy is required of any individual.
Sources
- European Commission AI Act Service Desk: Timeline for the implementation of the EU AI Act · accessed Oct 2026
- Addleshaw Goddard: EU AI Act - AI Omnibus formally adopted (July 2026) · accessed Oct 2026
- European Commission AI Act Service Desk: Article 26, obligations of deployers of high-risk AI systems · accessed Oct 2026
- EU Artificial Intelligence Act: Article 4, AI literacy · accessed Oct 2026
- EU Artificial Intelligence Act: Article 99, penalties · accessed Oct 2026
- William Fry: High-risk AI in financial services · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.