AI in finance doesn't have a capability problem. It has an authority problem

Ask any finance leader whether AI can process an invoice, resolve a mismatch or route a payment. They’ll say yes. It already does, thousands of times a day, across the UK. The harder question is how much authority it should have, and who answers for what it does with that authority when something goes wrong. 

 

That question is about to get sharper. From 2029, e-invoicing becomes mandatory for VAT invoices between UK businesses, with Peppol as the core network. Once invoices arrive as structured data straight into finance systems, many of the manual checkpoints teams still lean on go with the paper. Regulators are moving the same way. The Financial Conduct Authority’s Supercharged Sandbox includes work on safer agent-led payments, and the Bank of England has acknowledged that a person in every individual action may become unrealistic as these systems take on more work. 

 

So oversight will depend less on someone watching and more on the rules set before the agent acts. 

 

Authority has to match the decision 

A routine invoice that matches its purchase order carries little risk. An exception involving price, quantity or a supplier nobody has seen before is a different situation entirely. Treat them the same, and you will eventually be explaining to an auditor why the exception that mattered got no more scrutiny than everything else. 

 

We call the answer Governed Autonomy. An agent earns authority at three levels: Advisor, where it recommends and a person decides; Collaborator, where it acts inside agreed thresholds while a person reviews the exceptions; and Operator, where it works independently within limits the business has already defined and tested. Think of it as a ladder, not a switch. Each rung is earned one process at a time. 

 

No finance leader would hand a new employee the authority to approve a six-figure payment in their first week. AI should earn trust the same way, gradually and on the record. And the ladder runs both ways, which most plans forget. 

 

Approval is not accountability 

At the Advisor rung, everything goes through a person. But a person approving something is not the same as a person deciding it. Put a few hundred recommendations in front of someone by lunchtime with nothing explaining why they’re there, and they aren’t reviewing anything. They’re clicking. The organisation gets to say a human signed off, and nobody did. 

 

So every escalation needs the reason it was escalated, the reviewer needs real time to look at it, and they have to be free to say no. Otherwise, the human in the loop is just a signature the agent collects on its way through. 

 

Research commissioned from Forrester by Basware found that 67% are using AI in targeted accounts payable processes, but only 39% have built the operating model needed to run it at scale. 

 

The limits have to live in the workflow 

A policy document sets out what the organisation intends. It cannot stop an agent in the middle of a live transaction. The boundary has to exist as a permission inside the ERP and finance systems where the agent works. An ERP such as SAP already defines what a person in a given role can and can’t do. An agent needs the same treatment, and the enforcement has to happen there, not in the prompt. 

 

Most limits move as evidence builds. Some never should, no matter how well the agent performs. It may need to read a supplier record to resolve an invoice. It should not be able to change the bank details on that record or approve the payment. That is why we recently announced our agreement to acquire Trustpair, which independently verifies that a supplier’s bank account belongs to that supplier before money moves. It sits outside the agent: a control no track record learns its way past. When the agent reaches that line, the system stops it and hands the case to a person. 

 

A tolerance designed around UK VAT will not satisfy France, Germany or Poland. Each market’s rules have to govern the transaction at the moment the decision is made. This is where the difference between generalist and specialist AI shows up. A general-purpose model is easy to get and capable. What it doesn’t come with is this: which supplier changes are ordinary and which are the opening move in a fraud, or when a tax identifier can be corrected and when touching it invalidates the invoice. That has to be built around the model, from domain data and from people who spent years learning how the process behaves. Capability is not the same as qualification, and authority should follow a track record in the process, not a performance in a demo. 

 

Performance determines the remit 

Speed is the first metric everyone reaches for, and it’s the wrong one. An agent can process invoices faster while quietly generating more corrections and supplier disputes downstream. The metrics that matter are accuracy and rework. Where they hold up, the agent’s remit for that task can grow. Where they slip, it shrinks. An Operator whose accuracy slips shouldn’t stay an Operator because someone signed it off six months ago. It falls back to Collaborator, or to Advisor, until the evidence says otherwise. Every change is recorded with the evidence and the person who made the call. 

 

That is the whole framework in four words: earned, bounded, observable, reversible. 

 

As AI, or "Super Intelligence" (SI) as the US government now calls it, takes on more work, the focus has to shift from what agents can do to what they must never touch. AI’s capability was never in doubt. What’s been missing is a way to say how much authority it holds and who is accountable for it. When 2029 arrives and many of today’s manual checkpoints are gone, that answer will separate the businesses that can say exactly how their AI is governed from the ones that find out, after the fact, that nobody could say who was in charge. 

 

---

 

Donna Wilczek is Chief Product and Technology Officer at Basware

 

Main image courtesy of iStockPhoto.com and BlackJack3D