“AI” has become something of a blanket term for a range of different technologies and use cases. In spite of this, they do share some common ground; Each AI tool asks you to hand something over, whether that’s data to work from or the right to act inside your systems.
In a department that looks after payroll and supplier contracts, and has to get through an audit, that element of operations is far more important a consideration than which brand of AI is involved.
This guide sorts the tools by how much control you give up when you switch them on, starting at the low-risk end. The framework was put together with input from the expense management team at Webexpenses.
Level 1: AI that stays within your system
The AI finance teams tend to get the most from is, thankfully, the one with the least risk. It’s built into software you already pay for, and it gets a little better at one narrow job over time and continued use.
Expense auto-categorisation is a good example to draw from. An employee photographs a receipt, the software extracts the merchant, date and amount, turns them into structured data, then checks them against your organisation’s past claims. If the match is strong, it fills in the category. If it is unsure, it leaves the field blank for a person to decide.
Two things keep the risk low. A well-built version only learns from your organisation’s own claims history, so your data isn’t feeding a generic model or anyone else’s product. Beyond that, the confidence threshold means a human still makes the call on anything that is unclear.
Keeping it narrow helps accuracy too. After a few months of being fed your team’s claims, it will know to segment the train ticket to Manchester is a travel expense, and the sandwich bought on the platform as a subsistence.
If you’re shopping in this category of AI, you should ask potential vendors two things: is the model trained on your data alone, and does that data ever leave your account?
A Note on Support assistants
Chat assistants built into software sit at the same low-risk level, provided they are designed to help, rather than to decide. The best ones answer routine “how do I” questions instantly and hand anything complex to a person.
In practice, they’re most useful when they’re covering staffing gaps. A vendor with support teams in different time zones might only lean on the assistant for a few hours while nobody’s online, so a simple question asked on a Sunday evening doesn’t have to wait until Monday to receive a response.
Level 2: AI that reads your documents
When an enterprise AI tool says it “knows” your expense policy or supplier contracts, it is almost always using retrieval-augmented generation, or RAG.
The model isn’t retrained on your files; When someone asks a question, the system searches your document library, picks out the passages that look most relevant and passes them to the model along with the question. The answer is then written from those passages.
That has a couple of advantages for finance. Your documents are read when a question is asked and then left alone; they aren’t absorbed into the model for later use.
What’s more, answers can also be checked. A decent RAG tool shows which document an answer came from, so a reviewer can go back to the source.
As with most things in life, there are some limits. RAG is only as good as its search step and the documents behind it. An out-of-date policy, or three conflicting versions of one, will produce confident answers built on the wrong text.
It is also worth checking where the work happens. Some RAG tools run inside your own environment; many are hosted by the vendor, and the retrieved passages are still sent to a model to generate the answer. Neither is automatically wrong, but you should know which one you are buying.
Level 3: AI where your data leaves the building
This is the level most people picture when they hear “AI”: ChatGPT, Claude, Gemini and the other large language models (LLMs). They’re good at drafting a chaser email to a late-paying client or sanity-checking the logic of a business case, and they can save a lot of time.
The catch is that every prompt goes to an outside provider. Depending on the product and your plan, what you type may be kept and used to train future models.
How much that matters depends on the plan. Free and personal accounts are more likely to use your inputs for training, though most let you switch it off. Business and enterprise plans usually exclude training by default.
Either way, policies change. A setting or policy that exists today might work differently next year, and an opt-out is only as good as the provider’s word. Even giving a response a thumbs up or down can share that conversation in ways the main setting doesn’t cover, so read the terms for your specific plan.
The safest assumption is that anything you paste in, whether staff names, salaries, bank details or contract terms, could end up outside the controls your GDPR obligations rely on. A rough rule: if you wouldn’t post it in an open company Slack channel, don’t put it into a public chatbot.
The alternative: run the model yourself
A local LLM runs on your own hardware or your own servers, not in someone else’s cloud. Free tools such as Ollama, LM Studio and llama.cpp let you run open models, including Meta’s Llama family and Mistral, so prompts never travel to a third party.
For one person, this is now realistic. Machines with unified memory, where the processor and graphics chip share one pool of RAM (Apple’s Mac Studio and a growing range of mini PCs), can run surprisingly large models without a dedicated graphics card.
For a whole department, it’s a different matter. Once several people are querying the same model, or you need it to handle long financial documents reliably, you’re looking at proper GPU hardware and someone to look after it. A local model is also only as secure as the server it runs on.
Firms with strict data residency rules, such as banks and insurers, should take a close look. For most SME finance teams, though, the cost and upkeep aren’t worth it yet. An enterprise plan from a mainstream provider, with the privacy controls switched on and checked, is the more practical option for now.
One to watch: small language models
Small language models (SLMs) are worth keeping an eye on. Models such as Microsoft’s Phi series and Google’s Gemma are built to run on modest hardware, and one that has been fine-tuned on something narrow, like UK tax rules, can beat a far larger general model at that task for a fraction of the computing cost. Finance-specific SLMs are still early, but they could make running AI in-house realistic for smaller teams.
Level 4: AI that acts on your behalf
Everything so far produces text of some kind. AI agents take actions. Give one a goal, such as matching this month’s card transactions to the ledger, and it works out the steps, queries the systems and gets on with it.
Agent tools aimed at finance are already on the market, covering jobs like accounts payable and reconciling transactions across systems. The appeal is less rekeying and a quicker month-end.
The risk is the mirror image of the benefit. Software that can act can also act wrongly, and do it at scale before anyone notices. Finance depends on being able to show what happened and who approved it. Sage chief executive Steve Hare has made the point that responsibility in finance cannot be handed off, to a colleague or to a machine.
What happened at Amazon
Early in 2026, Amazon’s retail site suffered a run of outages. Business Insider reported, citing internal documents, that AI-assisted code changes were involved:
2 March: a fault in delivery-time data caused around 1.6 million website errors and roughly 120,000 lost orders.
5 March: a further outage led to a reported 99% fall in orders across North American marketplaces, an estimated 6.3 million lost orders.
Amazon has disputed that AI-written code was the cause and described the follow-up as routine governance. Either way, it introduced a 90-day “code safety reset” across around 335 critical retail systems, including two-person review of changes.
Whoever wrote the faulty code, the risk for finance is the same. When automated changes can go live faster than anyone can check them, one mistake can reach millions of transactions. The same goes for “vibe coding”, where staff use AI to knock together scripts or small tools. Before anything goes live, someone needs to know where the data is going and who has reviewed the code.
MCP: the plumbing behind agents
If RAG is how AI reads your documents, Model Context Protocol (MCP) is how it plugs into your systems. It’s an open standard that lets a model call a set list of tools, for example pulling live figures from your accounting software or kicking off an approval workflow.
A model connected this way can only use the tools it’s been given, in the ways those tools allow, which makes scope the main control. A sensible setup gives the AI the same access as the person using it and nothing extra.
Think of it like onboarding a new starter. You would not hand a new hire admin rights to every system on day one, however capable they seemed in the interview. An AI agent deserves the same caution, however smooth the demo. MCP is new and changing quickly, but expect it to sit behind many of the agent tools finance teams are pitched over the next couple of years.
The other side: AI in the hands of fraudsters
Some AI risk comes from outside, through the expense claims your team approves every week.
The image tools that can mock up a slide can also produce a realistic restaurant bill or taxi receipt in seconds. AI-generated receipts made up around 14% of fraudulent documents submitted in 2025, up from almost none a year earlier.
For teams that still approve claims by looking at photos of receipts, that is a serious problem. A convincing fake looks exactly like the real thing to a busy approver.
A better defence is to rely less on the receipt as evidence. When staff pay with a company card, the card network, the payment processor and the merchant all record the transaction before anyone uploads a receipt, so a fabricated receipt has nothing to match against. Someone can still put a personal dinner on a company card, so policy checks are still needed, but faking the paperwork gets much harder.
Before you switch anything on
Almost every finance software vendor is now adding AI, and the sales decks are ahead of the products. Rather than asking whether a tool “has AI”, ask what it would change for your team, and what you would be giving up in return. Five questions cover most of it:
1 Where does our data go? Does it stay in our account, or travel to a third-party model?
2 Is it used for training, and if so whose? Is that written into the contract?
3 Can we see which data or document produced an answer?
4 What can it do without asking, and who approves before anything changes?
5 Would we actually miss it if it went?
The tools that pass tend to be the unglamorous ones, like a category field that fills itself in correctly or a reconciliation that used to take an hour. Be wary of AI added for its own sake. If your team spends its time checking what the software did, it isn’t saving them anything.
If a vendor can’t give you straight answers to those five questions, that’s an answer in itself.
