AI features increasingly arrive in finance software through routine updates rather than a deliberate decision. Using a tool does not transfer responsibility: the company and its directors remain responsible for its financial records and for the personal data it handles.
Classify uses by consequence
A practical way to govern AI is to ask what happens if the output is wrong. Drafting routine, non-sensitive internal text may be lower risk. Uses involving confidential or personal data, financial statements, tax filings, payments or decisions about individuals call for stronger safeguards and review by a person who understands the subject. Verification can then be proportionate to consequence. Payment instructions and changes to bank details are best confirmed through an independent channel already on file, whatever tool produced or received them.
Personal data
Entering personal data, such as payroll or customer details, into an external tool raises data protection questions. The Personal Data Protection Department's page on the Act publishes the Personal Data Protection Act 2010, the Personal Data Protection (Amendment) Act 2024 and related guidance, including guidelines on data breach notification, the appointment of a data protection officer and cross-border transfer of personal data. Checking each tool's data retention and usage terms before it is used for sensitive work is a sensible step.
Controls that hold
Effective governance combines technical safeguards with working procedures: approved tools and access permissions, appropriate security and retention settings, a clear record of permitted uses, review of consequential outputs, and a response plan when something goes wrong. For a related perspective, see our article on audit technology and data analytics.
Finance-process advice can help define permitted uses, review responsibilities and evidence requirements. Technical security settings, integrations and privacy-law questions require the appropriate technology or privacy specialists and a separate scope.
This article is general information only. Requirements depend on each organisation's circumstances; please refer to the Personal Data Protection Department’s official material, and see Saifudin & Co's accounting and financial reporting services if you would like assistance.
For software implementation and business-process automation, see SNCO Consulting’s technology services.