Agentic AI in the finance function — when software starts acting

Most accounting AI proposes. It reads the invoice, suggests the coding, waits for a person.

Agentic systems act. They complete a sequence — receive the document, extract it, code it, match it to the purchase order, post it, schedule the payment, notify the person who needs to know — and only involve a human when something falls outside what they are permitted to handle.

The distinction matters more in finance than almost anywhere else, because the actions have consequences that are hard to reverse.

What acting actually looks like

A concrete example. A supplier invoice arrives by email.

Proposing system: extracts the data, presents a draft, waits. A person checks it, approves, and it posts. Time saved: the typing.

Acting system: extracts the data, recognises the supplier, matches it to an open purchase order, confirms the goods were received, checks the amount is within tolerance of what was ordered, codes it, posts it, and adds it to the payment run for its due date. A person sees it only if something does not line up — no purchase order, a price above tolerance, no goods receipt.

The second removes the review step for routine cases. That is a much larger saving than the typing, and it is also where the risk concentrates.

The four things that must exist first

Acting software without these is not a productivity gain, it is an incident waiting to happen.

A boundary that is not advisory

The system needs hard limits it cannot exceed regardless of how confident it is: amount ceilings, approved supplier lists, tolerance bands, categories it may never touch. These belong in a rules layer that sits outside the model's judgement, because the whole point is that they hold even when the model is wrong.

"The model wouldn't do that" is not a control.

A confidence threshold with somewhere to go

Every automated action needs a defined answer to "what if it is not sure". The answer must be stop and route to a person rather than proceed anyway, and the destination has to be a real queue somebody works — not a folder nobody opens. See the exception queue as a control.

A complete record of what it did and why

For every action: what was done, on what evidence, under which rule or model version, at what confidence, and what the source document said. Without that you cannot answer an auditor, and more immediately you cannot debug your own process when something goes wrong.

A way to undo

Reversal has to be a designed feature, not an improvisation. If an agent processes two hundred invoices under a misconfigured tolerance, you need to identify and reverse exactly those two hundred — cleanly, with the reversal itself on the record.

Where it works well in finance

The pattern is: high volume, clear right answer, cheap to verify, reversible.

• Invoice processing against purchase orders. The PO and goods receipt provide an independent check. Strong candidate.
• Recurring transactions. Rent, subscriptions, standing arrangements. Predictable by definition.
• Bank reconciliation. Deterministic matches, easily reviewed in bulk.
• Marketplace and gateway settlement. Very high volume, rule-driven fee structures, arithmetic-heavy, and a person genuinely cannot check every line — which is precisely the case for automation with a good exception queue.
• Chasing. Reminders, follow-ups, escalations. Low consequence, high nuisance value.

Where it does not

• Anything at a period boundary. Cut-off is judgement, and an agent that decides which period a transaction belongs to will eventually be wrong at the worst moment.
• Estimates and provisions. Not calculations with hidden answers.
• New relationships. First transaction with a supplier or customer, first purchase of a type — the case where the pattern does not exist yet.
• Anything irreversible and material. Payments above a threshold. The saving is not worth the tail risk.
• Anything where being wrong damages a relationship. Automated dunning to your largest customer over a disputed invoice is a bad trade.

The question to ask before switching it on

Not "can it do this?" but: "if this runs wrong for two weeks before anyone notices, what is the damage and can we unwind it?"

If the answer is "a few miscoded transactions we can reclassify" — proceed. If it is "we paid suppliers we should not have" or "we told the auditor something untrue" — that process needs a person in it, regardless of how good the technology is.

The sensible sequence

Nobody should switch on autonomous processing on day one. What works:

1. Run it in propose mode and watch what it would have done
2. Compare its proposals with what your team actually did, for a full cycle
3. Let it act only on the narrow band where it was consistently right — one supplier type, one transaction category
4. Widen the band as the evidence accumulates
5. Keep reviewing the exception queue, because that is where you learn where the boundary should be

The businesses that get burned are the ones that skip to step three on a vendor's assurance.

Common questions

What is agentic AI in accounting?

Agentic AI describes software that completes a sequence of accounting actions on its own — extracting a document, coding it, matching it, posting it, scheduling payment — rather than proposing each step for a human to approve. The defining difference from ordinary automation is that it decides when to involve a person, which is why the boundaries it operates within have to be enforced by hard rules rather than by the model's judgement.

Is it safe to let software post entries without approval?

It can be for high-volume, low-judgement transactions where an independent check exists, such as invoices matched to a purchase order and goods receipt, provided there are hard limits it cannot exceed, a confidence threshold that routes uncertain cases to a person, a complete record of every action, and a designed way to reverse in bulk. It is not safe for period-end judgement, estimates, first transactions with a new counterparty, or anything material and irreversible.

How do I decide which processes to let it run?

Ask what happens if it runs wrong for two weeks before anyone notices. If the damage is a set of miscoded transactions you can reclassify, the process is a reasonable candidate; if the damage is payments that should not have been made or a misstatement given to an auditor, keep a person in the loop regardless of the technology's quality.

What is the difference between automation and agentic AI?

Traditional automation executes a fixed sequence someone configured and stops when it meets anything unanticipated, whereas an agentic system decides how to handle cases nobody configured and judges when to escalate. That flexibility is the benefit and the risk, which is why the controls around it matter more than the capability itself.

Related: agentic ERP — when software acts · keeping a human in the loop · AI in accounting