Invoice processing (accounts payable)

• Every invoice is read within minutes of arriving, whatever the channel, and its header, lines, VAT breakdown and bank details are extracted with a confidence for each field.
• VAT invoice checks run before anything else: required details present, VAT number checked with HMRC, VAT arithmetic correct. Invoices that fail go back to the supplier with a specific reason, not into the ledger.
• Two- and three-way matching still runs in your finance system, under its own tolerances. The AI takes what fails: it finds the likely cause, such as a price change, a part delivery or a missing receipt, and drafts the fix or the query.
• Suggested GL, cost centre and VAT codes come from your coding rules and how similar invoices were coded before, each with a reason. A person accepts or corrects them.
• Any invoice whose bank details differ from the supplier master is stopped and sent to the supplier master data team. The AI never changes bank details, and never approves or releases a payment.
• Possible duplicates are caught across channels and legal entities, and the payment practices data (received date, due date, paid date, disputes) is captured as the work is done.

• HMRCMaking Tax Digital for VAT (VAT Notice 700/22)
  →

  VAT records must be kept digitally, and data must move between the programs that make up your VAT system through digital links: API transfers, file imports, linked cells. Copy and paste and re-keying don't count. So the AI posts extracted invoice data to your finance system through its API, never via a person copying totals across, and the VAT return still comes from your finance system's MTD-compatible software.

• HMRCVAT invoice content and record keeping (VAT Notice 700/21)
  →

  A full VAT invoice must show, among other things, a unique sequential number, the time of supply, the supplier's name, address and VAT number, a description, and the VAT rate and amount for each item; simplified invoices are only allowed for supplies of £250 or less. The invoice is the main evidence for reclaiming input tax, so the AI checks every required field and flags gaps. A person in AP or tax decides what to do with an invalid invoice, and VAT records are kept for at least six years.

• Department for Business and TradeReporting on Payment Practices and Performance Regulations 2017 (as amended in 2024)
  →

  Large companies and LLPs report every six months on how long they take to pay, the share of invoices paid within 30, 31–60 and over 60 days, the share paid late and, since the 2024 amendments, the share of disputed invoices paid outside terms. The duty now runs to 6 April 2031. The design captures received, due, disputed and paid dates as data, so the report comes from the system rather than a spreadsheet.

• Home Office and SFOFailure to prevent fraud (Economic Crime and Corporate Transparency Act 2023, in force 1 September 2025)
  →

  Large organisations can be liable when an employee or someone acting for them commits fraud intended to benefit the organisation, such as false accounting, unless they had reasonable procedures (Home Office guidance, November 2024). It doesn't cover fraud where the organisation is the victim, such as bank detail change fraud, which is controlled for its own sake. AP evidence matters either way: who changed what, who approved it, and segregation of duties enforced by the finance system.

• Payment Systems RegulatorConfirmation of Payee (Specific Direction 17, varied October 2026)
  →

  Banks check the payee's name against the account before a Faster Payment or CHAPS payment, and the PSR removed the direction's expiry date in October 2026. Use it, through your bank, whenever a supplier's account is set up or changed. It checks the name matches the account; it doesn't prove the change request is genuine, so a call-back to a number you already hold is still required.

• ICOUK GDPR and the Data Protection Act 2018
  →

  Invoices from sole traders and partnerships, and supplier contacts and bank details, are personal data. That means a DPIA, processing in UK regions, a clear retention period, access limited by role, and a contract that stops providers training their models on your data.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• Segregation of duties written down and enforced in the finance system: whoever processes an invoice can't approve it, and nobody in AP can change bank details and release payments.
• A bank detail change procedure that never relies on email: a call-back to a number already held, a Confirmation of Payee check, and a second approver, whatever the AI says.
• An exception queue with a named owner per reason, and an ageing target linked to supplier payment terms.
• A weekly sample review of accepted coding and VAT suggestions, with tax involved for reverse charge and partial exemption cases.
• A named owner for the coding policy, each prompt and the extraction tests, with change control like any other financial control.
• AP and budget holders trained before go-live, including what the AI can't see: a phone call with the supplier, or a contract change not yet in the PO.

1. 3 weeks

   Discovery

   Map today's channels, exception reasons and approval routes, measure cycle time and paid-on-time, review bank change controls, and pick the first legal entity.

2. Gate · must be true to passBaseline agreed, finance system API access confirmed, DPIA started, tax and internal audit involved.

3. 6–8 weeks

   Pilot

   PO-backed invoices for one entity in shadow mode: the AI extracts, matches and codes, AP works as normal, and the two are compared.

4. Gate · must be true to passField accuracy and coding acceptance within agreed limits, no bank change missed, and internal audit content with the evidence.

5. 4–6 weeks

   Production

   Extraction and the agent go live for the pilot entity, posting parked invoices through the API, with monitoring and a rollback plan.

6. Gate · must be true to passMonitoring, support model, rollback plan, updated procedures and AP training in place.

7. Ongoing

   Scale

   Add entities, then non-PO invoices and credit notes, then structured e-invoices as suppliers move to them.

8. Gate · must be true to passEach new entity or invoice type passes the same shadow-mode gate.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   A fraudster's invoice carries new bank details, and the automated flow pays them.

   How the design avoids it

   Bank details on an invoice are never used to pay. Any difference from the supplier master stops the invoice, and only the master data team can change details, after a call-back and a second approval.

2. 2

   Goes wrong

   The AI is given approval rights to hit a touchless target, and segregation of duties quietly disappears.

   How the design avoids it

   No approval, payment or master data permissions for the agent, enforced by the finance system. Touchless means matched and coded, not approved.

3. 3

   Goes wrong

   The demo used clean PDFs. Real invoices are multi-page scans with credit notes mixed in.

   How the design avoids it

   Pilot on last month's real invoices from every channel, with field-level accuracy measured per supplier.

4. 4

   Goes wrong

   Extracted data is copied into the finance system by hand, breaking the MTD digital link and adding errors.

   How the design avoids it

   Post through the finance system's API, keep the original file, and reconcile extracted totals to posted totals daily.

5. 5

   Goes wrong

   Exceptions get faster, but invoices still wait weeks for a budget holder, so paid-on-time doesn't move.

   How the design avoids it

   Measure the whole cycle, chase approvers automatically, and report ageing by approver as well as by reason.

1. Late 2026–2027
   The Commercial Payments Bill: introduced in the Lords on 19 May 2026, it finished its Lords stages in October 2026 and is going through the Commons. It would cap payment terms at 60 days with limited exemptions, make interest on late payment at 8% above Bank of England base rate mandatory, give suppliers a fixed sum when a dispute is raised late or without enough information, and let the Small Business Commissioner investigate, adjudicate and fine persistent late payers. Detail will follow in secondary legislation after Royal Assent.

   Hold payment terms as data in the supplier master, raise disputes as soon as the AI finds a mismatch, and make sure the dispute date and reason are recorded, not just the hold.

2. From 1 April 2029
   Mandatory B2B and B2G e-invoicing on a Peppol model (HMRC roadmap, 28 October 2026).

   Design intake so structured e-invoices skip document reading and go straight to the same VAT checks, matching and controls. Document AI stays for the long tail of paper and PDF. See the e-invoicing readiness playbook.

3. November 2026 onwards
   Companies House identity verification: mandatory for new directors and people with significant control since 18 November 2025, with existing ones verifying at their company's next confirmation statement during a 12-month transition.

   When a new supplier is set up, check its Companies House record, the UK Sanctions List and its VAT number as standard, and record the checks against the supplier master.