AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Write a policy set for an AI compliance agent as a collection of short, numbered clauses, each stating one rule with its scope, its limits, who decides exceptions and what evidence is needed. Avoid vague words such as "reasonable" or "large" unless a person is named to judge them. A person owns and approves the set, and any change to it should be recorded so the agent's answers can be traced to the version in force.
Why policies written for people often fail agents
Most small-business policies are written to reassure: a page on the website, a section in the staff handbook, a paragraph in the terms. They rely on the reader filling gaps with common sense. A person reading "we may refund in exceptional circumstances" will ask a manager. An AI agent reading the same words either has to refuse every time or guess what "exceptional" means. Neither is useful.
A policy set an agent can use is closer to a rulebook. Each clause says what is allowed, what is not, where the limit sits and who decides beyond it. This makes the policy better for people too. Clear rules are easier to train, easier to audit and easier to defend.
The anatomy of a usable clause
- Identifier
- A number such as PAY-04, so answers can cite it.
- Scope
- What and whom it covers: all supplier payments, UK customers only, staff expenses.
- Rule
- One instruction in plain English.
- Limit
- The amount, time or count above which the rule changes.
- Exception owner
- The named role who decides cases outside the rule.
- Evidence
- What must exist before the action: an invoice, an ID check, a signed form.
- Source
- The law, contract or decision the rule rests on, if any.
- Version and date
- When it took effect and who approved it.
An example in full: PAY-04. Scope: payments to suppliers. Rule: a payment to a supplier whose bank details changed in the last 30 days needs a call-back to a phone number already on file. Limit: applies to all amounts. Exception owner: finance lead. Evidence: call-back note with date and name. Source: internal decision after a fraud attempt, March. Version 2, approved by the owner.
Words to avoid, and what to use instead
| Vague | Testable alternative |
|---|---|
| Large payments | Payments above £2,500 |
| Promptly | Within two working days |
| Trusted suppliers | Suppliers screened in the last 12 months with no open issues |
| Where appropriate | Name the condition, or send it to a person |
| Senior staff | The owner or the finance lead |
| Reasonable request | A request that meets clauses X and Y; anything else goes to a person |
Some judgement cannot be written out, and should not be. The answer is not to force a number onto every decision but to say plainly that a decision belongs to a named person. An agent that knows when to stop is safer than one with a rule for everything.
Building the set in stages
- Start with money. Payment limits, approvals, new payees, refunds. These are the most testable rules and carry the clearest risk.
- Add customers. Who you accept, what identity checks you run, what you will not sell or to whom.
- Add data. What personal data you collect, how long you keep it, who handles requests from individuals.
- Add staff conduct. Gifts, conflicts of interest, expenses.
- Add regulatory duties specific to your sector and countries, with your adviser.
Keep each clause short. If a clause needs three paragraphs, it is probably three clauses. Link related clauses by identifier rather than repeating text, so that when one changes, the others do not drift out of line.
Test it with real cases before you rely on it
Before an agent applies the set, take twenty recent decisions from your own records, such as refunds, payments and customer approvals, and run them through the clauses on paper. Where two people reading the same clause would reach different answers, rewrite it. Where a real case falls outside every clause, decide whether to add one or to send that case to a person. This hour of testing removes most of the ambiguity an agent would otherwise turn into refusals.
Version control matters
When a regulator, auditor or customer asks why an answer was given, you need to show the clause as it stood that day. Keep old versions, date each change and record who approved it. Accountability guidance from the UK Information Commissioner's Office stresses documenting decisions so you can demonstrate compliance; the same discipline serves any policy an agent applies. If you change the policy set materially, expect to re-test the agent against it before it acts on the new rules.
A worked example
Example only. A US cleaning company with 20 staff starts with 18 clauses on payments and refunds. Its old refund policy said "refunds at manager discretion". The new set says refunds up to $150 for a missed or incomplete clean are allowed with a job record; refunds above $150, or without a job record, go to the operations manager. In the first month the agent handles most refund requests within policy and sends a handful to the manager. The manager's time on refunds falls, and every refund now has a clause behind it. See using a refusal log to find gaps for how to grow the set from what the agent is asked.
Where Pryme fits
The Pryme Business Compliance agent answers only from the policy set you load, and the clause travels with each answer. Agents are built, trained and certified by Pryme Intelligence and must re-earn certification when their mandate or data changes. See how it works, and finance decisions a person should make for where the line should sit on money.
Questions people ask
Can I use my existing staff handbook as the policy set?
You can start from it, but expect to rewrite vague sections into short, testable clauses with named exception owners.
How many clauses does a small business need?
Start with the rules that move money and the decisions you are asked most often. Twenty to forty clauses is a common starting point; grow from there.
Who should approve the policy set?
The owner or a director, with advice where clauses rest on law. Record who approved each version.
Should an AI agent write the policy?
It can draft clauses for review, but a person must decide and approve them, because the policy states what the business commits to.
Sources
- ICO: Accountability and governance · accessed Oct 2026
- NIST: AI Risk Management Framework · accessed Oct 2026
- COSO: Internal control · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.