AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
If a personal data breach is likely to result in a risk to people's rights and freedoms, UK GDPR requires you to report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. If the risk is high, you must also tell the people affected. Every breach, reported or not, should be recorded with its facts, effects and the action taken.
What counts as a breach
A personal data breach is wider than a hack. It includes sending one customer's invoice to another, losing a laptop with client files, an employee looking at records they have no reason to see, or a supplier exposing your customer list. Loss of availability counts too, such as ransomware locking your bookings system. The question is whether personal data was lost, destroyed, altered, disclosed or accessed without authorisation.
The clock and what it measures
The 72 hours run from when you become aware of the breach, not from when you finish investigating. You are aware when you have a reasonable degree of certainty that a security incident has led to personal data being compromised. The ICO accepts that you may not have every detail within 72 hours and allows information to be provided in phases, as long as the first report is made on time.
| Time | What should be happening |
|---|---|
| Hour 0 | Someone notices. Open a breach record with the time and who reported it |
| Hours 0 to 4 | Contain it: recall the email, reset passwords, disable access, contact the supplier |
| Hours 4 to 24 | Establish what data, how many people, which categories, and whether special category data is involved |
| Hours 24 to 48 | Assess the risk to people. Decide whether it is reportable and whether individuals must be told |
| By hour 72 | Report to the ICO if required, using its online form, and note any information still to follow |
| After | Tell affected people if the risk is high, fix the cause and close the record |
This timeline is a planning aid for a small firm, not a legal standard. The legal requirement is the report, without undue delay and where feasible within 72 hours.
What an AI agent can do in the first hours
- Open the breach record the moment it is reported, so the time of awareness is fixed and visible.
- Pull the facts it can see: which records were in the email, how many customers, which fields.
- Run a checklist of containment steps and log who did each one and when.
- Draft the ICO report fields from the record, leaving the risk assessment for a person.
- Draft a notice to affected customers in plain language, for approval.
- Keep the record for breaches that are not reported, with the reasons, which the ICO expects you to be able to show.
What a person must decide
Two decisions carry legal weight: whether the breach is likely to result in a risk to people, and whether that risk is high. They depend on context the records do not hold. A list of names and emails sent to one trusted client is different from bank details sent to an unknown address. A person should make and sign those calls, and the agent should record the reasoning. If an AI agent itself caused the breach, for example by sending data to the wrong customer, the same rules apply, and the mandate that allowed it should be reviewed.
Worked example
Example only. At 16:10 on a Tuesday, a recruitment firm's administrator emails a spreadsheet of 40 candidates, with phone numbers and salary expectations, to the wrong client. She tells the owner at 16:25. The compliance agent opens a breach record at 16:25, which becomes the time of awareness. By 17:00 the client has confirmed deletion in writing, which the agent attaches. On Wednesday morning the owner reviews the facts: no special category data, a known business recipient, deletion confirmed. She decides the risk is low and the breach is not reportable, and records why. The agent closes the record with that reasoning and a note to add a recipient check for outgoing attachments.
What the ICO report asks for
The ICO's reporting process asks for broadly the same facts each time, so a business that records them as it goes is ready to report. Expect to describe:
- What happened, when it happened and when you found out.
- The categories and approximate number of people and records concerned.
- The likely consequences for the people affected.
- The measures taken or proposed to deal with the breach and reduce its effects.
- A contact who can answer questions, often the owner or data protection lead.
An agent that has kept the breach record from hour zero can fill most of these fields directly. The consequences and the measures proposed are where a person adds judgement. If you are not sure whether to report, the ICO offers a self-assessment tool and a helpline. Reporting a breach that later proves low risk is generally better than missing the deadline on one that was not, and the record of your reasoning protects you either way.
Where Pryme fits
The Pryme Compliance agent keeps breach records alongside its obligations register, with each step recorded with its source. The Chief of Staff brings the reportability decision to the owner rather than letting it sit. See also subject access requests and audit trails for AI agents. Security controls for the account itself are described on the security page.
Questions people ask
Do I have to report every breach to the ICO?
No. You must report a breach that is likely to result in a risk to people's rights and freedoms. You should still record every breach and your reasons for not reporting.
What if I do not have all the facts within 72 hours?
Report what you know on time and provide the rest in phases. The ICO accepts that investigations take time.
When must I tell the people affected?
When the breach is likely to result in a high risk to their rights and freedoms, without undue delay.
Can an AI agent decide a breach is not reportable?
It should not. It can assemble the facts and draft the assessment, but the decision on risk should be made and recorded by a person.
Sources
- ICO: Report a breach · accessed Oct 2026
- ICO: UK GDPR guidance and resources · accessed Oct 2026
- NCSC: Small Business Guide · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.