AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Neither is legally required for most small businesses. The NIST AI Risk Management Framework is a free, voluntary guide organised around four functions, Govern, Map, Measure and Manage, and is a useful checklist at any size. ISO/IEC 42001 is a certifiable management-system standard, worth pursuing mainly if customers or partners ask for formal assurance.
Two different kinds of document
Owners who start reading about AI governance quickly meet two names. They are often mentioned together but do different jobs.
- NIST AI RMF
- A voluntary framework from the US National Institute of Standards and Technology, released on 26 January 2023, for managing risks across the design, development, use and evaluation of AI. Free to download and use.
- ISO/IEC 42001:2023
- An international standard that specifies requirements for an AI management system: the policies, roles, processes and records an organisation uses to govern AI. An organisation can be independently certified against it. The standard itself is sold by ISO and national standards bodies.
In short: NIST tells you what to think about; ISO 42001 tells you how to run a system that proves you thought about it.
The NIST framework in plain terms
The core of the AI RMF is four functions. A small business can use them as a checklist for each AI agent.
| Function | What it asks | Small-business version |
|---|---|---|
| Govern | Is there a culture, policy and accountability for AI risk? | Who owns each agent? What is it allowed to do? Who can change that? |
| Map | What is the context, purpose and possible impact? | What data does the agent read, who is affected, what could go wrong? |
| Measure | How are risks assessed and tracked? | What numbers do we watch, and how often do we sample its work? |
| Manage | How are risks prioritised and acted on? | What do we do when something goes wrong, and how do we pause the agent? |
NIST has also published a Generative AI Profile (NIST AI 600-1) that applies the framework to generative AI, describing risks such as confabulation (confidently stated false content), information security and data privacy, with suggested actions for each.
What ISO 42001 adds
ISO 42001 follows the structure of other ISO management-system standards, such as those for information security and quality. It expects an organisation to set an AI policy, define roles, assess AI risks and impacts, set objectives, operate controls, monitor performance, audit itself and improve. Certification means an accredited body has audited that system.
For a small business, the main costs are time to set up the system and the fees for certification audits. The main benefit is external assurance: a certificate a customer's procurement team can rely on without investigating you themselves.
Which is right for you
| Your situation | Sensible approach |
|---|---|
| Sole trader or small team using a few agents | Use NIST's four functions as a checklist; keep a short written record per agent |
| Selling to large companies that ask about AI governance | Align with NIST now; consider ISO 42001 if questionnaires keep asking for it |
| Building AI products for others | ISO 42001 is more likely to be expected; also check EU AI Act provider duties |
| Already certified to ISO 27001 | ISO 42001 may be a manageable extension of an existing system |
Worked example (illustrative)
A three-person bookkeeping firm in Leeds uses agents for client queries and bank reconciliation. It writes one page per agent following NIST's functions: owner and mandate (Govern); data read and who is affected (Map); weekly override rate and a ten-item sample (Measure); pause procedure and incident contact (Manage). It takes an afternoon. When a larger client's supplier questionnaire asks how the firm governs AI, it attaches the pages. ISO 42001 certification is noted as something to revisit if a client makes it a condition.
Neither replaces the law
Following a framework does not by itself satisfy legal duties. Data protection law, the EU AI Act where it applies, and sector rules still need their own attention. A framework helps you organise that work. See EU AI Act risk levels and key dates and do you need a DPIA before deploying an AI agent. For what to record as evidence, see audit trails for AI agents.
Getting started in an afternoon
Whichever route you choose, the first steps are the same and cost nothing.
- List every AI tool and agent in use, including ones staff adopted on their own.
- Name an owner for each, and write down what it may do and where it must stop.
- Note the data each one reads and who could be affected if it goes wrong.
- Choose two or three numbers to watch and a weekly sample size.
- Write down how to pause each agent and who to call if something goes wrong.
- Set a date to review the whole list, at least every six months.
That list is also the starting point for ISO 42001 if you later decide to pursue it, so none of the effort is wasted.
Where Pryme fits
Pryme Business agents are certified by Pryme Intelligence before they act, and must re-earn certification when their mandate or data changes. That is the provider's certification of its agents, not an ISO certificate for your business. Each agent works inside a mandate with a ceiling and records every action with its source, which supplies much of the evidence a NIST-style review asks for. See how it works.
Questions people ask
Is the NIST AI RMF mandatory?
No. It is a voluntary framework. Some organisations ask suppliers to align with it, and it is widely used as a reference, but no general law requires small businesses to follow it.
Is ISO 42001 certification worth it for a small business?
Usually only if customers, partners or tenders ask for it, or if you build AI products for others. Otherwise a framework-based written approach gives most of the benefit at far lower cost.
Can I use NIST if I am not in the US?
Yes. The framework is free and not tied to US law. Businesses in the UK, Canada, Nigeria and elsewhere use it as a structured checklist.
Does a provider's certification cover my business?
No. A provider certifying its own agents tells you about their testing. Your business still needs its own oversight, records and legal compliance for how you use them.
Sources
- NIST: AI Risk Management Framework · accessed Oct 2026
- NIST AI 100-1: AI Risk Management Framework 1.0 · accessed Oct 2026
- NIST AI 600-1: Generative AI Profile · accessed Oct 2026
- ISO/IEC 42001:2023 - AI management systems · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.