The vendor letter in a chatbot
On the second day of close, an accounts payable specialist receives a letter from a supplier announcing new bank details. She pastes it into a free chatbot on her phone and asks for a polite reply requesting confirmation. Down the hall, a senior accountant runs forty lease agreements through a browser extension that summarizes PDFs. In FP&A, an analyst uploads the draft board pack to a personal AI account to tighten the commentary on a margin miss that has not yet been announced.
None of this is malicious. All three people are trying to finish faster. But in one afternoon, a vendor's banking details, forty contracts and unreleased financial results have gone to services the company has never reviewed, under terms nobody has read, with no record of what came back. The example is illustrative.
COSO has a name for this. Its February 2026 publication, Achieving Effective Internal Control Over Generative AI (GenAI), describes "shadow AI" as unauthorized or ungoverned AI implementations operating outside formal IT oversight, and notes that adoption is easy enough for it to start outside formal channels. A finance AI policy exists to bring that use inside the lines without stopping it.
Three frameworks, one short policy
You do not need to choose a single framework. Each of the three main references does a different job, and a finance policy can borrow from all of them.
COSO for controls auditors recognize
COSO released the publication on 23 February 2026. It does not create a new governance model. It adapts the five components and 17 principles of the 2013 Internal Control, Integrated Framework to generative AI, and groups common uses into eight capability types, from data extraction and ingestion through automated transaction processing, workflow orchestration by AI agents, and human and AI collaboration. It closes with a six-step roadmap: establish a governance structure, inventory use cases, assess risks by COSO component, design and map controls, implement and communicate, then monitor and adapt.
For a finance team, COSO's value is that it speaks the language of internal control over financial reporting. Its guidance on reliance is the most useful paragraph for a controller. Reliance occurs, in COSO's working definition, when management depends on AI outputs as part of the evidence supporting an ICFR control's design or operating effectiveness. When that happens, COSO expects documented prompts, configuration and model version, a clear sampling rationale, and retained evidence.
NIST AI RMF for risk vocabulary
NIST released AI RMF 1.0 on 26 January 2023, organized around four functions: Govern, Map, Measure and Manage. Its Generative AI Profile, NIST AI 600-1, followed on 26 July 2024. As of November 2026, NIST says AI RMF 1.0 is being revised as part of the White House AI Action Plan, so cite the version you used.
ISO/IEC 42001 for a management system
ISO/IEC 42001:2023, published in December 2023, specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. It applies to organizations of any size that provide or use AI. A finance team does not need to adopt it to write a good policy, but it matters when a large customer or investor asks whether the company runs a formal AI management system.
Why prosecutors care too
The DOJ's Evaluation of Corporate Compliance Programs, updated in September 2024, asks how a company governs AI in its business, whether controls ensure AI is used only for its intended purposes, and "What baseline of human decision-making is used to assess AI?" A written policy with named owners is the simplest way to answer.
Find the shadow AI first
COSO's roadmap puts the inventory second, ahead of risk assessment, and says it should include periodic scans or surveys to detect shadow AI. Rules written before the inventory tend to ban things nobody does and miss things everybody does.
Four sources give a reasonable first picture:
- A short survey with an amnesty. Ask every finance employee which AI tools they used in the last 90 days, for what, and with what data. Promise that honest answers will not lead to discipline.
- Card and expense data. Search for subscriptions to AI services charged to company cards or claimed as expenses.
- Single sign-on and browser extension reports. IT can usually list the AI apps people have connected or installed.
- Vendor release notes. Your ERP, AP automation and close software may have switched on AI features in a routine update.
Shadow AI inventory template
Record one row per use, not per tool. The same chatbot used for drafting emails and for reviewing contracts is two uses with different risks. The fields below build on the attributes COSO lists for its inventory step.
| Field | What to record | Example |
|---|---|---|
| Use case | What the AI does, in one line | Summarize lease terms for ASC 842 schedule |
| Capability type | COSO's category | Knowledge retrieval and summarization |
| Owner | Named person accountable for output | Senior accountant, lease accounting |
| Tool and model | Product, vendor and model, if known | Browser extension, third-party model |
| Account type | Personal, team or enterprise license | Personal free account |
| Data used | Inputs, with their classification | Executed leases (confidential) |
| Output feeds | Where the result goes | Lease schedule, then journal entries |
| Reliance | Is the output used as control evidence? | Yes, until review is added |
| Human review | Who checks, how, and how often | None today |
| Criticality | Low, moderate or high | High |
| Status | Approved, conditional, retire or prohibited | Conditional: move to enterprise tool, add review |
| Last reviewed | Date and reviewer | 28 October 2026, controller |
A policy in thirteen short sections
Keep the policy to four or five pages. COSO recommends that use policies be role-based and risk-based, defining allowed tools, prohibited data uploads and high-risk uses that need pre-clearance, and that they be reviewed more often than other policies because the technology changes quickly.
- Purpose and scope. Covers every AI tool used for finance work, including features embedded in existing software and personal accounts used for company work.
- Roles. Name a policy owner, usually the controller or CFO. Each approved use has a named owner. A small review group (finance, IT, legal) approves high-risk uses.
- Tool tiers. Approved enterprise tools; tools allowed for non-confidential work only; prohibited tools. Publish the list and date it.
- Data rules. A short list of data that never goes into an AI tool outside approved tiers: bank details, payroll and personal data, customer data, unreleased results, credentials and anything under a confidentiality agreement.
- Use approval. New uses are added to the inventory before production use. High-criticality uses need pre-clearance.
- Human review and reliance. For each use, state who reviews output and at what depth. Decide whether management relies on it as control evidence; if so, apply COSO's evidence expectations.
- Configuration and change control. Treat prompts, thresholds and connected data sources as controlled settings, with version history and approval. Separate who can configure a tool from who approves its output, as COSO's guidance recommends.
- AI agents. Any agent that can post, approve or pay is a system user subject to the same access and segregation rules as a person. See the companion article on agent controls.
- Vendor due diligence. Before approval, confirm data retention, training use of your data, model update notice and available audit reports.
- Logging and retention. For high-criticality uses, keep inputs, outputs, model version and reviewer sign-off for the same period as other close evidence.
- Training. Role-based: acceptable use for everyone, deeper training for configurators and reviewers.
- Incidents and exceptions. How to report a data leak, a wrong output that reached the books, or a needed exception, and who decides.
- Review. At least twice a year, and after any significant vendor or model change.
Where to start
Run the inventory before drafting a word of policy, and give it two weeks. The rows marked high criticality with no human review are your first controls. If agents are already posting entries or routing invoices, read the controls to put in writing before AI agents run the close next. For help building the inventory, policy and controls together, see AI Governance for Finance.