What agentic AI means for accounts payable

Almost every finance software vendor now describes its product as “agentic AI.” The label has moved faster than the technology behind it. In Deloitte’s Q4 2025 CFO Signals Survey, 87% of CFOs said they expect AI to be extremely or very important to their finance operations in 2026, and 54% named integrating AI agents into finance as a transformation priority. Buyers are ready to spend, and most cannot yet tell a real agent from a chatbot with a new name.

That confusion already shows up in outcomes. Gartner predicts that more than 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value, and inadequate risk controls. Gartner also named the source of the confusion: “agent washing,” the rebranding of assistants, robotic process automation, and chatbots as agents without the capability underneath. In accounts payable, an agent’s action can move money, so the difference between marketing language and real capability matters before anything reaches a payment run.

This article explains what an AI agent actually is, what it can and cannot do inside an AP process today, and how to test any vendor’s “agentic” claim.

An AI agent is software that works through a loop: it reads the current situation, reasons about what to do, takes an action using the tools it has been given, then observes the result and decides the next step. The action is the part that separates an agent from everything else.

A model that only produces text is answering. An agent uses that reasoning to do something — post a database entry, request a document, update a record — and then checks whether it worked.

This is different from the two technologies most often mislabelled as agents. A chatbot or assistant responds to a prompt and stops; the person still does the work. Robotic process automation follows a fixed script and breaks the moment the screen or the file format changes. An agent handles variation, because it reasons about each case instead of replaying one path.

This distinction has financial consequences. Gartner’s cancellation forecast points to organizations that bought “agent washing” — a chatbot or an RPA bot with a new label — and found it could not carry the work at scale.

For a finance team, the test is simple: if the tool cannot take an action and account for it, it is an assistant, and it should be evaluated as one. The rest of this article uses “agent” to mean software that reasons, acts within defined limits, and records what it did.

The work agents are good at in AP and payables in general sits between what automation can script and what needs a person’s judgment — high in volume, governed by clear rules, but varied enough that a rigid script breaks on the exceptions.

In an AP function that describes much of the daily workload, and agents are handling a growing set of these tasks today.

Coding and classification: An agent reads an invoice, determines the general ledger account, cost centre, and tax treatment, and applies them. Where the coding is clear, it completes the entry. Where it is ambiguous, it routes the invoice to a person with its reasoning attached.

This matters because manual coding is where cost sits: APQC’s Open Standards Benchmarking has found the cost to process a single invoice ranges from $2.07 or less among top performers to $10 or more among the bottom quartile, and the gap is mostly labour.

Exception handling: Most invoices match their purchase order and receipt automatically. The remainder — whether it is a price variance, a missing receipt, or a quantity mismatch — is where AP teams lose hours. An agent investigates the exception, gathers the related documents, proposes a resolution, and either applies it within tolerance or hands it up with the evidence assembled.

Supplier data chasing When an invoice arrives without a PO number or with incorrect bank details, an agent drafts and sends the request to the supplier, tracks the reply, and updates the record once the answer arrives.

Detecting duplicates and anomalies: An agent checks each invoice against prior payments and flags a likely duplicate, a charge that departs from the contract, or a supplier whose bank details have changed since the last run. It holds the item for review with the reason attached before any payment leaves.

Answering questions from live data: A CFO asking about supplier concentration, upcoming obligations, or exposure in one currency can get an answer read from current payables across the connected systems, instead of waiting for a report.

In each case, the agent operates inside a defined domain and every action is traceable to the record it came from. That boundary is what makes the work safe to automate, and it is also what separates a real agent from a demo.

The overclaims cluster in four places, and each one is worth naming plainly.

It does not run without a human in the loop. No credible AP agent pays invoices autonomously with no approval and no limits. The governed model gives an agent authority over low-risk, high-confidence actions and escalates everything else. A vendor that markets full autonomy is describing a risk to your payment controls.

It is not always right. Models make mistakes, and we have to assume they will. “Our AI never gets it wrong” is a claim no one can stand behind. The correct design makes every recommendation and action traceable to its source so errors surface and get corrected, instead of promising they never happen.

It does not replace your controls. Segregation of duties, approval thresholds, and payment authorisation exist because money is at stake. An agent works inside those controls.

The case for keeping them is in the fraud data: the ACFE’s Occupational Fraud 2026 Report to the Nations examined 2,402 cases across 143 countries with more than $3.4 billion in losses and a median loss of $104,000 per case.

Separately, the AFP Payments Fraud and Control Survey found 79% of organizations were hit by attempted or actual payments fraud in 2024, with vendor-imposter schemes rising to 45%. An agent that changes payee bank details without a human check widens that opening.

It does not replace the ERP. The ERP stays the system of record. An agent reads from it and writes back to it under supervision; it does not become the ledger.

The gap in the market is governance. Deloitte found that only 21% of organizations have a mature governance model for agentic AI — one with clear boundaries on which decisions an agent can make alone, real-time monitoring, and audit trails. Deployment is running ahead of the controls, and that is what stalls projects.

A workable governance model for AP has four parts. First, bounded authority: the agent acts alone only on low-risk actions above a confidence threshold, and everything else routes to a person.

Second, an audit trail: every action links back to the invoice, the rule, and the data that produced it, so a reviewer can reconstruct any decision.

Third, confidence scoring: the agent reports how sure it is, and the threshold for autonomous action is set by the finance team, not the vendor.

Fourth, segregation of duties carried into the automation, so the agent that codes an invoice is not the one that releases the payment.

E-invoicing is converging on a small set of shared standards. The UAE runs on PINT-AE, the local Peppol invoice specification, with reporting to the Federal Tax Authority. Europe is moving the same way under ViDA (VAT in the Digital Age), which extends structured e-invoicing and digital reporting across member states. Australia shows what adoption looks like at scale: more than 400,000 businesses are registered on the Peppol e-invoicing network.

These frameworks share the same core: structured, machine-readable invoices with a reporting obligation to a tax authority. That is good input for an agent, because the data arrives in a predictable format. It also raises the bar: an agent operating inside a regulated flow has to be auditable by design, because a regulator can ask how a figure was produced.

In accounts payable, the agent that codes and posts an invoice has to leave the trail a tax auditor would expect to find. An agent that cannot show its working is a compliance exposure.

Gartner’s “agent washing” warning gives buyers a practical filter. A few questions separate an agent from a relabelled assistant.

Can it take an action, or only make a suggestion? An assistant drafts; an agent posts, sends, or updates. Ask to see it complete a task end to end, not describe one.

What are its limits, and who sets them? A real agent has defined boundaries and a confidence threshold you control. If the vendor cannot show where the agent stops and a human takes over, the controls do not exist yet.

Can it show its working? Every action should trace back to the invoice, the rule, and the data behind it. Ask to see the audit trail for a decision the agent made.

What happens when it is unsure or wrong? The honest answer is that it escalates and the mistake is visible and correctable. Treat “it doesn’t get things wrong” as a warning sign.

The most reliable way to tell is a live demo, where the vendor shows each of these working instead of describing it.

SpendConsole builds Enterprise Payables Orchestration, an intelligence and orchestration layer above the ERP environments an enterprise already runs.

Its AI layer, Oli, reads across the connected ERPs, reasons over live payables data, and takes defined actions under supervision: coding invoices, working matching exceptions, requesting missing data from suppliers, and answering finance questions from current data. Every action traces back to the record it came from.

The design follows the governance model above. The ERP remains the system of record; Oli orchestrates and adds intelligence above it, and does not replace it. Actions sit inside the enterprise’s own approval thresholds and segregation of duties, with a confidence threshold the finance team sets.

Where a case is ambiguous or high-risk, Oli routes it to a person with its reasoning attached. Receivables and treasury are on the near-term roadmap, on the same architecture; a unified layer across all of enterprise finance is a longer-term horizon, not a current claim.

The problem SpendConsole addresses is fragmentation: payables data scattered across disconnected systems, which is the same condition that makes ungoverned automation dangerous. An agent is only as safe as the data model and the controls around it. Orchestrating the payables data and enforcing those controls is what SpendConsole does.

What is the difference between agentic AI and a chatbot in accounts payable?

A chatbot answers questions and leaves the work to a person. An agent reasons about a specific invoice or exception, takes a defined action such as coding it or requesting a missing document, and records what it did. A tool that only responds and never acts is an assistant.

Is agentic AI safe to use for paying invoices?

It is safe when it operates inside a governance model: bounded authority over low-risk actions, a confidence threshold the finance team controls, an audit trail on every action, and segregation of duties carried into the automation. No credible system pays invoices fully autonomously with no approval or limits.

Will AI agents replace accounts payable teams?

No. Agents take on bounded, high-volume work — coding, exception handling, data chasing — and escalate anything ambiguous or high-risk to a person. The team shifts toward review, exceptions, and control instead of data entry.

How does agentic AI handle invoices from multiple ERPs?

A real agent reads across the connected ERP environments instead of assuming one system. Most enterprises run more than one ERP, so the ability to reason over fragmented data is a core test of whether a tool is built for the real environment.

What is “agent washing”?

It is Gartner’s term for vendors rebranding existing products — assistants, chatbots, and robotic process automation — as “agentic AI” without the underlying capability to reason and act.

Does agentic AI help with e-invoicing compliance in the UAE?

It can, provided it is auditable. UAE e-invoicing runs on structured, machine-readable data with a reporting obligation to the FTA, which is well suited to an agent. The requirement is that every action the agent takes can be traced and reconstructed, because the mandate carries fixed penalties for non-compliance.

How do I know if a vendor’s agent is real?

Ask it to complete a task end to end, show its limits and who sets them, produce the audit trail for a decision, explain what it does when unsure, and prove it works across more than one ERP. Concrete answers indicate an agent; adjectives indicate a label.