Issue 010 was about controls arriving. This fortnight the question moved on again, and it is a more awkward one: the agents are no longer something a finance team decides to buy. They are already inside the software you pay for, and in a growing number of cases they are on unless somebody turns them off.
Xero made that explicit at Xerocon US in Denver on 19–20 August. Its JAX platform gained cash flow actions that spot a gap before it arrives and propose a plan, payment follow-ups tuned to how a particular customer has actually paid in the past, and automated chasing of missing paperwork — JAX identifies the transaction, emails the client for the document, and sends the reminders. Alongside it, Xero data now flows into Microsoft 365 Copilot, ChatGPT and Claude, which quietly changes what a ledger is: not a place you go, but a source other tools read from.
Microsoft is further down the same road. Business Central now ships a Sales Order Agent and a Payables Agent generally available, with an Expense Agent in production-ready preview, and Copilot is included with every Business Central licence at no extra cost. Its MCP server exposes more than 650,000 actions across finance, sales, supply chain and HR to Copilot Studio, GitHub Copilot, Claude and ChatGPT. The decision in front of a finance team is not whether to adopt agents. It is which ones are switched on, with what permissions, and who approved that.
Anthropic spent the fortnight making the same shift. Computer use, the Skills API and the Files API all reached general availability on 20 August; a built-in browser arrived in the desktop app and Claude in Chrome went generally available on all paid plans on 26 August; and on 25 August memory started working across chat and Cowork — on by default for Free, Pro and Max, off by default for Team and Enterprise. That asymmetry is the whole story in one line. The consumer default is convenience; the enterprise default is consent.
And then the counterweight. Protiviti's Global Finance Trends Survey, published 26 August, found 77% of finance organisations now employ AI — and 14% doing so under a defined strategy. Rillion's report the following day found 68% of finance teams using AI daily, but only 39% of CFOs comfortable letting it act independently. Adoption is close to universal. Deliberate adoption is not.
For a finance team of any size, the useful piece of work this autumn is not a strategy document. It is a list: every finance system you run, which AI features are enabled in it, who turned them on, and who approves what they do. Most teams cannot produce that list today. It takes an afternoon.
"77% of finance organisations employ AI. 14% employ it pursuant to a defined strategy."
Protiviti's Global Finance Trends Survey, published on 26 August, found 77% of finance organisations employing AI, but only 14% doing so under a defined strategy and only 35% confident they can measure the return. Use for financial forecasting jumped from 58% to 76% year on year, with 67% using AI for risk assessment and 56% for process automation.
The finding underneath those numbers is the one to take to a board: data security and privacy was named the top finance priority for the third consecutive year, on the argument that no organisation can scale AI without confidence in the quality, security and governance of its data. Separately, 83% of CFOs put cash management in their top three priorities.
Rillion's "Finance AI Illusion" report, published 27 August from a Sapio survey of 250 US CFOs and finance leaders, found 68% of finance teams using AI in daily work while only 39% of CFOs were comfortable letting it operate independently. Forty-five per cent still require a human review after invoice processing, and 21% named a lack of internal AI expertise as their main barrier.
The most interesting number is the split it exposes: teams already using AI heavily were three times more likely to expect transformative change than the rest (51% against 16%). Confidence appears to come from use, not from planning to use.
At Xerocon in Denver on 19–20 August, Xero set out the next round of JAX capabilities: cash flow actions that identify a gap before it lands and build a plan around it, such as deferring non-critical bills to protect payroll; payment follow-ups built from a customer's actual payment behaviour rather than a generic reminder schedule; and Bill Protection, which flags unusual amounts, altered invoice details and unfamiliar suppliers before payment.
The one to watch is document chasing. Over the coming months JAX will identify a transaction with missing paperwork, email the client to request it, send reminders when nothing arrives, and ask clarifying questions if what comes back is unclear. That is not a drafting assistant. That is a member of staff doing the follow-up nobody enjoys.
The same announcement brought integrations that push live Xero data into Microsoft 365 — Excel, Word and PowerPoint through Copilot — and a connector taking Xero data into ChatGPT, alongside Claude. XeroForce, the natural-language agent builder announced at Xerocon London in July, gains a month-end agent among its pre-built templates.
For a finance team the practical change is that the ledger stops being somewhere you log in to. It becomes a source that whatever you are already working in can query — which is convenient, and which is also a permissions question nobody has been asked yet.
Business Central now ships three agents. The Sales Order Agent, which drafts orders from customer emails, and the Payables Agent, which reads vendor invoices and prepares entries for posting, are generally available; the Expense Agent, which processes employee receipts, is in production-ready preview and reached the UK in July. Copilot comes with every Business Central licence at no additional cost.
The Payables Agent is the one that matters for financial control. An agent that prepares entries for posting sits directly inside the segregation of duties you already have written down somewhere — and if it was switched on without that conversation, the written-down version is now wrong.
Microsoft runs an MCP server for Business Central at mcp.businesscentral.dynamics.com, accepting connections from Copilot Studio, GitHub Copilot, Claude and ChatGPT, and exposing more than 650,000 actions across sales, finance, supply chain, human resources, field service, customer service and project operations. What is actually exposed depends on how your environment is configured.
That last sentence is the control. The surface area is enormous by default, and the work is deciding what a connected model is allowed to reach — before somebody connects one.
The protocol's updated roadmap, published 22 August, sets five priorities. The consequential one for finance is agent identity and enterprise security: Demonstrating Proof of Possession, and Workload Identity Federation for agents running as cloud services. The shift is from browser-based approval, where a person clicks to authorise, to agents holding their own cryptographic identity — no long-lived API keys, and delegation that can be traced.
Also on the list: server-initiated events so a system can push to an agent rather than only answer it, a maturing Tasks extension for longer-running work, and progressive discovery to stop a large tool catalogue eating the context window.
On 20 August, Anthropic moved computer use, the Skills API and the Files API to general availability for production agents, with multi-action turns so a task finishes in fewer calls, a new browser-use tool, versioning for skills, 1TB of file storage per organisation, and HIPAA eligibility for computer use.
The Skills API is the quiet one. Versioned, distributable skills mean a finance team's way of doing a bank reconciliation can be written once, tested, and rolled out — which is the difference between AI as a personal habit and AI as a documented process.
From 25 August, Claude's memory works across chat and Cowork with user-editable topics, and organisations can control whether sensitive topics are stored at all. Memory is on by default for Free, Pro and Max, and off by default for Team and Enterprise.
That split is worth understanding rather than just noting. If your team uses personal Pro accounts for work — and in most charity finance teams somebody does — the retention default on those accounts is the opposite of the one your organisation would have chosen.
On 26 August Claude gained a built-in browser in the desktop app, letting it open sites in a side panel and read, click and type its way through a web task, with login import; the Claude in Chrome extension went generally available across paid plans the same day. Both run a classifier that checks each action against what the user originally asked for, and Anthropic reports 0% attack success rates against newer models with the safeguards deployed. Enterprise admins can restrict the browser to approved domains.
An assistant that can log in and click is a different risk object from one that can only write text. The domain allow-list is not an optional refinement — it is the control.
Through August the FCA, alongside the Bank of England, HM Treasury and the Digital Regulation Cooperation Forum, set out a coordinated position on AI adoption: it should not be treated solely as a technology initiative, but requires board oversight and risk management aligned to existing regulatory obligations. The named priority areas are governance, accountability, consumer protection, operational resilience, cyber security, third-party oversight and transparency.
Nothing in that list is new law. All of it is what a regulator will expect to see evidenced, and the third-party oversight item is the one most finance teams have least of — because the AI arrived inside a system they already had.
The FCA's AI Input Zone closed on 19 June, gathering examples of good and poor practice in AI use across UK financial services. The publication is still described as coming "later in 2026" and has not appeared. This was flagged as a watch item in Issue 010 and remains one.
Worth noting rather than skipping: when it lands, it will be the most concrete statement of UK regulatory expectations on AI that finance functions have had, and it will be worth reading even for organisations outside the FCA's perimeter.
Everything above points at the same task. Take each finance system you run — ledger, banking, payroll, purchase-to-pay, expenses, CRM — and record four things: which AI features exist, which are enabled, who enabled them, and who approves what they produce. Add any personal accounts staff use on work data, because that is where the defaults are set for convenience rather than for you.
It is a one-page output. It is also the single most useful thing you can put in front of an audit committee this autumn, because it converts "are we using AI responsibly?" from an opinion into a list somebody has actually checked.
The Charity Governance Code's November 2025 refresh added a recommendation that charities have a policy covering the use of technology and AI tools. That is the standard a trustee board is measured against, and it predates every product release above.
The gap between that recommendation and practice is well documented: sector research this year has consistently found most AI use in charities is informal, invisible to trustees, and unsupported by approved tools, policies or training. If your board has not seen an AI item, the switch-on audit above is a better first paper than a policy draft — you cannot write a policy for a landscape you have not mapped.
| Finding | Source | Date |
|---|---|---|
| 77% of finance organisations employ AI — but only 14% do so pursuant to a defined strategy | Protiviti Global Finance Trends Survey | Aug 2026 |
| Only 35% of finance leaders say they can effectively measure AI ROI | Protiviti, via CFO Dive | Aug 2026 |
| AI use for financial forecasting rose from 58% to 76% year on year | Protiviti | Aug 2026 |
| 68% of finance teams use AI daily; only 39% of CFOs are comfortable letting it act independently | Rillion / Sapio, 250 US finance leaders | Aug 2026 |
| 45% of finance functions still require a human review after invoice processing | Rillion / Sapio | Aug 2026 |
| Heavy AI users are 3x more likely to expect transformative change — 51% against 16% | Rillion / Sapio | Aug 2026 |
| Business Central's MCP server exposes more than 650,000 actions across finance, sales, supply chain and HR | ERP Software Blog | Aug 2026 |
Ian Schnoor of the Financial Modeling Institute makes the argument this fortnight's product news needs: a CFO should be able to ask of any piece of work, "tell me how much AI was used, and tell me what human interaction the team did". His point that AI cannot be left to choose inflation rates, interest rates or cost assumptions without oversight is the practical version of everything the surveys measure.
Anthropic opened Claude Academy on 20 August: 31 free courses, no sign-in required, from five-minute explainers on hallucinations through to multi-hour material on agents and MCP. The foundation course is built on four skills — Delegation, Description, Discernment and Diligence — and that vocabulary is genuinely useful in a finance team, because it separates "what should we hand over" from "how do we check what came back".
Published in April rather than this fortnight, and included because it remains the clearest picture of where charity AI governance actually sits. It rates all three board-level AI governance controls — strategic assessment, named trustee responsibility, and organisation-wide training and compliance — as red, and finds fewer than one in four charities with approved tools, policies or training in place. Read it before writing your first AI paper for trustees.