In May, the two software brands your clients are most likely to use did something quieter than a product launch and more consequential than most of the coverage suggested.

Xero switched on a live connector into Claude and previewed XeroForce, a no-code tool that lets a business build its own AI agents on top of its Xero data. Intuit’s partnership with Anthropic, announced in February and rolling out this spring, lets businesses build custom agents on the Intuit platform. And Basis, which sells agents to accounting firms rather than to their clients, raised $100 million at a $1.15 billion valuation.

The common thread is the part that matters for you. For two years, AI in accounting was a feature inside the software: a button that suggested a category or drafted a reminder. What shipped this spring is different in kind. These are agents that read client financial data and act on it, pulling from bank feeds, payroll, billing, and inboxes, and writing back to the books. Intuit’s own examples are telling: a restaurant group prompting an agent to combine its sales and inventory data with its Intuit data to flag margin variances and surface underperforming locations, or a construction subcontractor connecting project timelines, lien waivers, and payments to a cash-flow forecast. The agent is not suggesting anymore. It is reaching across a client’s systems and producing the answer. That quietly moves a set of problems that used to be the vendor’s onto the firm. This edition is about those problems, and what to do about them before you let an agent near a client’s ledger.

When AI was a suggestion inside QuickBooks, the worst case was a miscategorized transaction that a human would catch on review. When it is an agent reconciling accounts and acting on a client’s live financial data, three older questions come back with sharper teeth.

The first is who you are handing the data to. The second is who is accountable when the agent is confidently wrong. The third is what happens to the data, and to the client, if the vendor disappears. And the firm-facing tools raise the stakes again. A platform like Basis is sold to the firm to run across its entire client base, which means the confidentiality and consent questions below do not apply to a single engagement. They apply to all of them at once.

None of those are hypothetical. In December 2024, the bookkeeping company Bench shut down abruptly two days after Christmas and told its small-business customers to pull their data within days; the company that bought the remains later put the number of stranded active customers near 12,000. This past February, Botkeeper closed after eleven years and about $90 million in funding, which we covered in our first edition. The tools are more capable now than either of those companies ever shipped. The questions they raise are exactly the same.

What follows is the playbook we would hand a firm before it turns any of this on.

The moment you route a client’s financials through an AI vendor, you are sharing confidential client information with a third party, and your professional obligations do not pause for new technology. The AICPA’s Confidential Client Information Rule, Section 1.700.001 of the Code of Professional Conduct, still governs. In practice that means two concrete steps.

Build disclosure and consent into your engagement letters, so the client knows AI tools may process their data and has agreed to it in writing. The question of whether to tell clients you use AI is no longer abstract; the Journal of Accountancywas walking through it more than a year ago. Tax practitioners carry an added duty under the Statements on Standards for Tax Services to make reasonable efforts to protect taxpayer information shared with others.

Then read the vendor’s data terms before you sign, with one question above the rest: is our client’s data used to train the vendor’s models, and can we opt out? Xero says the financial data shared through its Claude connector is used only for that session and is never used to train Claude’s models. Intuit says agents built on its platform draw on customer data only with the customer’s permission. Those are good answers. Not every vendor gives them. Get the answer in writing and keep it in the engagement file.

The demo is the asymptote. The first month is the reality.

AI vendors quote steady-state accuracy, the number a model reaches after it has learned your client’s vendors and chart of accounts. The number you actually get on day one is lower. In our first edition we documented independent reviewers putting first-month accuracy on one leading AP automation tool around 70 to 75 percent, climbing over several months toward the marketed figure. “Autonomous” on a homepage almost always means “autonomous once trained on your data.” None of that is fraud, but it is a budgeting problem. Plan for the ramp, run the agent in parallel with your existing process while it learns, and do not let a polished demo set the expectation you will be held to by a client three weeks later. Even the incumbents’ own agent builders are early. XeroForce launched in alpha, invite-only, with general release promised later in the year. Shipped and ready for a client’s month-end are not the same thing.

This is the single most important control, and it is simple. Use AI to suggest and to draft. Never let it write to the ledger or send a client deliverable without a human reviewing it first.

This is not caution for its own sake. Intuit’s own users have spent the past year on the company’s forums asking how to turn the assistant’s automatic features off, and the consistent advice from experienced accountants is the same: review suggestions before accepting them, and never let the tool auto-post a categorization. The AICPA’s Due Care principle makes the underlying point plainly. Competent use of a tool means understanding what it does, evaluating its output critically, and keeping professional responsibility for the work product. The agent does not sign the return or the financial statements. You do.

Demand the audit trail. The tools worth paying for let you drill from any figure back to the source document or the calculation that produced it. That is the standard set by the lease and audit tools we rated highly in our first edition, and it is the right bar for anything that touches client books.

When a lender, an investor, or an examiner asks how a number was derived, “the AI produced it” is not an answer that protects you or your client. If a tool can act on the books but cannot show its work, it is a liability wearing the costume of a time-saver. Make traceability a requirement of selection, not a feature you hope is there.

Before you route a client’s books through anyone, know exactly how you get the full data out, in a usable format, on short notice. Bench’s customers learned this the hard way when the notice to export years of records arrived with a deadline measured in days.

A young AI bookkeeping startup with an impressive demo and a few quarters of runway is a single point of failure, and you are proposing to attach it to a client relationship you are responsible for. Keep your own copy of the source data. Do not let any one tool become the only place a client’s financial history lives. The firms that got hurt by Bench were not the ones using it. They were the ones using it as their only system of record.

Before you sign anything, get written answers to six questions. Does our data train your models, and can we opt out? Where is the data stored, and what security and compliance standards do you hold? Can we export everything, and how quickly? How is your accuracy measured, and against what baseline? What controls keep a human in the loop on actions that hit the ledger? And who is liable when the agent is wrong? A vendor that answers these cleanly is a fundamentally different proposition from one that changes the subject.

The firms that come out ahead will not be the ones that adopt agents fastest. They will be the ones that adopt them with the gate in place: client consent on file, a human reviewing anything that leaves the building, a real audit trail behind every number, and an exit plan for the day the vendor stops answering email.

The pitch of the last two years was that AI would replace the person doing the books. The shape of 2026 is narrower and more durable than that. The person who reviews the AI’s work, catches what it misses, and signs their name to the result is the one the client is actually paying for. That role is not shrinking. The tools just made it the entire job.

— Footnote

Footnote is an independent publication. It is not professional accounting, tax, or legal advice. Our analysis and opinions are based on the company announcements, professional standards, and reporting linked above. Product details are current as of June 2026 and subject to change. We have no consulting relationships with any vendor named in this article.