Almost any, provided the system exposes data through an interface, a reporting database or scheduled file exports. Cloud ledgers, on-premises ERPs and older accounting packages can all be connected. The deciding question is not which product you run but what each connection lets the agent do: read, draft, or write, and under whose identity.
How do agents connect to accounting systems?
There are four common routes, and most finance teams use more than one.
| Route | Typical systems | Good for | Watch for |
|---|---|---|---|
| Published interface | Cloud ledgers, modern ERPs | Reading and controlled writes | Scopes that bundle read and write together |
| Reporting view or replica | On-premises ERPs, data warehouses | Wide, safe reading | Data that lags the live ledger |
| File exports and imports | Older packages, bank files | Reconciliations, journals for import | Imports that bypass approval rules |
| Screen automation | Systems with no interface | A last resort for reading | Fragile, hard to scope, hard to audit |
A published interface is the best route when it exists, because each call is logged and permissions can be narrow. A read-only reporting replica is often the safest way to give an agent the wide visibility it needs. For the general method, see how you connect an AI agent to your systems.
What about older systems with no interface?
Older ledgers can still work. The usual pattern is a nightly export of the trial balance, open items and supplier master into a store the agent reads, and a journal import file that a person reviews and loads. The agent never touches the old system directly. Our answer on whether AI agents can work with legacy systems covers the trade-offs.
Screen automation, where software clicks through the user interface, should be the exception. It usually runs under a person's login, it breaks when screens change, and it is hard to restrict to one task.
Which neighbouring systems matter as much as the ledger?
A finance agent rarely works from the ledger alone. Coding an invoice needs the purchase order. Forecasting cash needs the treasury position. The connections to your procurement system and your treasury management system are often more valuable than the ledger connection, and they carry their own risks, especially where treasury systems can release payments.
What may the agent do through each connection, and what stays with a person?
| Connection | The agent | Stays with a person |
|---|---|---|
| Ledger, read | Reads balances, entries, history (depth 1) | None |
| Ledger, write | Posts routine journals within limits (depth 3) | Above materiality, closed periods |
| Payables | Drafts invoices for approval and payment runs (depth 2) | Approval and release |
| Supplier master | Reads only | Any change, especially bank details |
| Journal import file | Prepares the file (depth 2) | Reviewing and loading it |
| Treasury system | Reads positions; drafts transfers | Releasing transfers |
A worked example
Take a group with a cloud ledger in its newer subsidiaries and an older on-premises package in the parent. The agent reads the cloud ledger through its interface with a read-only scope and drafts journals through a second scope limited to two journal types. For the parent, IT sets up a nightly export of open items and trial balance. The agent reconciles intercompany balances across both, drafts the elimination journal as an import file, and the group accountant reviews and loads it.
Same agent, three connection types, and in every case the action that changes the parent's books is taken by a person.
Which controls belong on every connection?
- A separate identity per agent. Never a shared finance login.
- Separate read and write scopes. If the system only offers one scope that does both, route writes through an import file instead.
- Logs on both sides. The accounting system's own audit log and the agent platform's record should agree.
- Change notice. An upgrade to the accounting system can change what an interface returns. Retest after upgrades.
- Third-party risk. EU financial firms in scope of DORA should expect the agent platform and its connections to fall under their ICT third-party risk management; DORA vs NIS2 for AI agents explains which regime is likely to apply.
The topic guide AI agents for finance: books you can audit shows how connections feed the audit trail.
Questions people ask
Does the accounting vendor need to approve the connection?
Usually not for its published interface, but check your licence terms, especially for reporting replicas and for the number of named users a service identity counts as.
Can one agent work across several ledgers at once?
Yes, and consolidation is a good use. Each ledger still needs its own scoped connection and its own record of what the agent read and drafted.
Is a spreadsheet a system the agent can connect to?
It can read one, but a spreadsheet is not a system of record. Treat figures from it as declared or external until they are tied back to the ledger.