Your controllers are pasting company numbers into free chatbots. That is a risk, but it’s also a good use case for how AI can make a positive impact on your business.
Picture this. Your controller has been drafting variance commentary with ChatGPT since February.
She does it to save time. Writing the commentary from scratch used to take most of a day. Now she pastes in the trial balance, asks for a first draft, and edits from there. And your reports go out two days earlier.
In the process, she’s learned where AI helps and where it doesn’t. Maybe it writes a decent draft. But it gets the reasoning wrong, so she knows not to ask it that question. She found out what works through trial and error. More good news. But none of her work is documented as an AI use case. And that’s bad news.
The rest of your department is making the same kind of discoveries. Someone in accounts payable uses AI to draft emails to vendors. Someone else uses it to summarize a contract instead of reading forty pages. Each of them knows where AI helps and where it fails, and none of them told anyone else.
We’re making this scenario up to make a point. But copying accounting data into an unapproved AI tool creates a real risk.
So the question is not whether your finance team uses AI. The question is whether you find out what they did and why. And of course, take steps to mitigate the potential risks.
The risk: One employee, one prompt, one SEC filing
Here’s a real example.
On May 5, 2026, Community Bank in Pennsylvania learned that non-public customer information had been handled using an unauthorized AI application. The information included customer names, Social Security numbers and dates of birth. Its parent company, CB Financial Services, determined the incident was material and disclosed it in an SEC filing.
The filing said the incident did not disrupt the bank’s operations, customer access, payment systems or core IT infrastructure. The company said it was communicating with regulators and conducting customer notifications as required. The exposure of sensitive information was enough to warrant public disclosure.
The bank later told American Banker that an approved AI tool was already available. The employee used a different tool anyway. The bank did not say why.
The risk extends beyond this one bank.
IBM’s Cost of a Data Breach Report highlights the need to control how AI systems access and handle data. Approved tools, clear permissions and monitoring all matter.
Your finance department carries a second exposure on top of the data risk. When someone pastes your trial balance into a chatbot, no record exists of what they asked or what came back. If the answer shapes a number in your close and your auditor asks how you produced it, you have nothing to show. That’s a black box problem.
Why banning AI might make things worse
Your first instinct might be to send a company-wide email prohibiting AI tools. Maybe you already have. But a ban alone does not tell you whether people stop using them.
A ban alone may not stop the behavior. Employees can switch to personal phones and personal accounts, moving the work somewhere you cannot see it. That leaves you with the same exposure… and fewer insights than you had before.
People may hesitate to disclose a tool they rely on if they expect to lose it. Ask what makes it useful, then give them an approved way to do the work.
What to do instead? Run an amnesty program to build your AI use case
Give your finance team a deadline to tell you what they use, with no consequence for answering. Ask key questions. What do you use AI for? Why? What information do you give it? This is really about building a use case for AI, not punishing people for productivity. Try to get real, honest answers. You’ll get good insights back.
With a little luck, you’ll get a ranked list of what AI features to turn on first. If six people tell you they draft variance commentary in a chatbot, you know which NetSuite feature to enable before the others. That’s solid requirements gathering based on real workflows rather than a vendor demonstration.
With this approach, you’ll get a specific picture of what data leaves your company. If people paste vendor names, invoice details, and account balances, your requirements name those exact things. A blanket rule to “never use AI” does not get followed.
This will also get your pilot team engaged. The people who invented the workaround can help make the approved version work because they already know what’s what.
Why the same work is safer inside NetSuite
Compare these two versions of one task – the difference is visibility.
Today, your controller copies account balances into a free chatbot. The information leaves your company and sits on a server you do not control, with no record showing it happened.
Asked inside NetSuite, the same question stays inside your company. You control who gets to use it using the permission settings you already use for every employee. And the system logs what was asked, so you have an answer when your auditor wants one.
Turning the features on will not end the problem by itself, and the bank in Pennsylvania is the proof. An approved tool was already available and the employee used something else instead. People reach for whatever is fastest and most familiar. If your approved option takes four clicks and a login while a browser tab takes one, your team goes back to the browser tab. That’s human nature.
Making the approved path easier is a good rollout decision.
Where to start
You have two options, but only one good one.
Send the blanket policy email, and the work continues on personal computers where you cannot see it. You lose visibility and keep every bit of the risk.
Ask about their workflows instead, and you’ll learn the parts of your close that AI handles well, which parts produce nonsense, and which people should run your pilot. Then you build the approved workflows your now-engaged team already tested. Win-win.
If you are going to SuiteWorld in October, you’ll come home with a list of AI features and this is a great way to rank them. This amnesty approach tells you exactly where AI has already proven useful in your close.
BTW… Be sure to bring your answers to the Vursor (Booth 1013 at SuiteWorld 2026). Our experts will walk you through the new NetSuite features and help map them to your use case.
Hope to see you there!
