Part of the AI in finance series.
An AI agent that can read financial records, propose journal entries, or post to the ledger sits inside the group's control environment from the moment it is granted access. The generic IT security questionnaire your procurement team sends was written for software that executes deterministic logic. It was not written for an agent that reasons, acts autonomously, and may interact with several systems in a single workflow. Before a group CFO signs, five areas need written answers from the vendor - specific enough to be auditable and contractually binding.
This page covers the pre-contract, vendor-facing decision. Questions about internal access, segregation of duties, and joiner-mover-leaver processes for agents are at /resources/ai-agent-access-controls-finance. What an audit trail must capture once the tool is live is at /resources/ai-governance-finance-audit-trail. Running costs and budgeting are at /resources/how-to-budget-for-ai-costs-group.
1. Authority: what can the agent actually do, and who approves each action?
The vendor must supply a written capability map showing every action the agent can perform - read, classify, propose, or post - and which of those actions requires a named human to approve before execution. Any action that touches a financial record or initiates a payment should be gated behind explicit human approval; the agent's output in those cases is a proposal, not an instruction. Ask the vendor to distinguish between read-only access, draft-and-recommend workflows, and autonomous posting, and confirm in writing which permissions each deployment profile carries. If the vendor cannot produce this map, the product is not ready for a finance control environment.
2. Logging: what is recorded, and can the external auditor see it?
Adequate logging for a finance-grade AI tool means capturing the full chain: the input submitted, the context actually sent to the model, the model's output, any action taken, and the identity of the human approver where one was required. The gap between input and context matters. One IT leader on r/CIO noted that 'most vendors log user input and final response but not the actual context sent' (r/CIO, reddit.com/r/CIO/comments/1t02cn5). For audit purposes, that gap is significant - the external auditor needs to reconstruct what information the agent was working with when it produced a recommendation or took an action. Ask the vendor to confirm log completeness in writing, specify the retention period, confirm whether logs can be exported in a format the external auditor can access independently, and confirm who controls deletion.
3. Assurance: what can the vendor evidence today, and what will it commit to as standards develop?
Ask whether the vendor holds a SOC 2 report and, critically, whether the AI component - the agent's decision logic, its tool-calling behaviour, its memory or retrieval mechanisms - falls within the SOC 2 scope. Many vendors hold a SOC 2 that covers their infrastructure and access controls but excludes the AI layer. That scope gap is material for a finance deployment. The assurance landscape for AI agents is developing. The AICPA is piloting, with an AI assurance firm, a programme pairing a SOC 2 report with certification of agent behaviour; launch is targeted for Q1 2027 and the programme is still in pilot as of mid-2026, originating in the US market (CFO Dive, cfodive.com/news/aicpa-assurance-firm-team-up-certify-ai-agents/833403). Ask the vendor to commit contractually to obtaining agent-specific assurance as recognised frameworks become available, and to notify you if the scope of any existing assurance report changes.
4. Data use: training, retention, subprocessors, location, and exit
The questions to put in writing are: Does the vendor train its models on data submitted by your group, and if so under what conditions and with what opt-out? What is the data retention period, and where is data stored? Which subprocessors handle the group's data, and in which jurisdictions? What happens to the group's data at contract exit - is deletion confirmed in writing, and on what timeline? For a group with subsidiaries in multiple countries, cross-border personal data carries UK GDPR implications; that is a matter for your legal team, but the vendor's answers on location and subprocessors are the inputs your legal team needs before they can form a view.
5. Contract terms: where the risk actually lives
CFO Dive's October 2026 reporting on AI agent risk noted that legal and procurement should review data use, incident notification, liability for harm, and access to audit records, and that agents should be auditable, revocable, and recoverable (CFO Dive, cfodive.com/news/why-ai-agents-go-rogue-means-cfos-tech-cybersecurity/833441). Translate that into specific contract provisions. Incident notification: what is the vendor's obligation to notify the group in the event of a breach or unexpected agent behaviour, and what is the maximum notification window? Liability for harm: does the contract address the vendor's liability for a wrong posting made autonomously by the agent? Access to audit records: does the group retain the right to request logs and records, including in the context of a regulatory review? Revocation: can the group suspend or revoke the agent's access immediately, without vendor involvement, and is that confirmed technically and contractually? Recovery: what is the process if an agent action needs to be unwound? Exit: can the group terminate and retrieve all data within a defined period, with confirmation of deletion?
The group layer: which entity contracts, and does every subsidiary's data fall inside the scope?
Group CFOs should confirm which legal entity signs the vendor contract and whether that entity's indemnities and data-processing terms extend to every subsidiary whose data the agent will touch. A contract signed by the holding company does not automatically cover a subsidiary in a different jurisdiction, and the vendor's data-processing addendum may name only the contracting entity. If the agent will access data across the group, the scope of the data-processing agreement needs to match the deployment scope. Agree this before signature, not during an audit.
How to use this checklist
The five areas above are structured as written questions to put to the vendor before contract. Frame them as a vendor questionnaire with a column for the vendor's written response and a column for your team's assessment. The answers should be specific enough to be auditable - a response that says 'we take security seriously' does not constitute a written answer to a control question. Where the vendor cannot answer a question, that is itself material information about the product's readiness for a finance deployment.
Common questions
What makes an AI vendor due diligence checklist for finance different from a standard IT security questionnaire?
A standard IT security questionnaire addresses infrastructure, access controls, and data handling for deterministic software. An AI agent in a finance context can reason autonomously, call external tools, and take actions across multiple systems in a single workflow. The finance-specific checklist must address the agent's authority to act, the completeness of its audit log including context sent to the model, and vendor liability for autonomous actions such as wrong postings - none of which appear in a generic IT questionnaire.
Does a SOC 2 report cover an AI agent deployed in a finance function?
Not necessarily. Many vendors hold a SOC 2 report that covers infrastructure and access controls but excludes the AI component - the agent's decision logic, tool-calling behaviour, and memory or retrieval mechanisms. A group CFO should ask the vendor to confirm in writing whether the AI layer falls within the SOC 2 scope. The AICPA is piloting a programme to pair SOC 2 with certification of agent behaviour, with a launch targeted for Q1 2027, but that programme was still in pilot as of mid-2026 (CFO Dive).
What logging should a group CFO require from an AI vendor before signing?
Finance-grade logging means recording the input submitted, the context actually sent to the model, the model's output, any action taken, and the identity of any human approver. One IT leader on r/CIO noted that most vendors log user input and final response but not the actual context sent - a gap that matters for external audit. The external auditor needs to reconstruct what information the agent was working with when it produced a recommendation or took an autonomous action.
Which contract terms carry the most risk when deploying an AI agent in a group finance function?
CFO Dive's October 2026 reporting identified incident notification, liability for harm including wrong postings, and access to audit records as the primary contract-level risks. Equally important are revocation rights - the ability to suspend agent access immediately without vendor involvement - and exit terms confirming data deletion on a defined timeline. An agent should be auditable, revocable, and recoverable; those three properties should each have a corresponding contract provision.
Does the group-level contract cover every subsidiary's data when an AI agent is deployed across the group?
A contract signed by the holding company does not automatically extend its data-processing terms to every subsidiary, particularly those in different jurisdictions. The vendor's data-processing addendum typically names only the contracting entity. Group CFOs should confirm before signature that the scope of the data-processing agreement matches the deployment scope, and that cross-border personal data flows are identified for legal review.