Taming AI in finance

Organizations have significant expectations for AI. While 66% of surveyed executives say their organizations are already achieving improvements in efficiency and productivity, ambitions increasingly extend beyond efficiency. Sixty-five percent hope AI will reduce costs, 61% expect enhanced decision-making and data-driven insights, and 71% hope it will ultimately increase revenue.

Source: Deloitte, State of AI in the Enterprise: The untapped edge, January 2026. Survey of 3,199 director- to C-suite-level respondents in 24 countries.

Those expectations are accompanied by meaningful risks. Data privacy and security topped the list of AI concerns among surveyed executives at 73%, followed by legal, intellectual property, or regulatory compliance at 50%. Governance and oversight, as well as model quality, consistency, and explainability, were each cited by 46%. Meanwhile, just 21% of companies reported having a mature governance model for autonomous agents.

Perhaps most telling is the preparedness gap. Only 30% of respondents described their organizations as highly prepared from a risk and governance perspective, while just 20% said the same for talent. Technology infrastructure, by comparison, received a 43% highly prepared response.

Source: Deloitte, State of AI in the Enterprise: The untapped edge, January 2026. Survey of 3,199 director- to C-suite-level respondents in 24 countries.

For controllers, the takeaway is not to slow down the AI adoption. It is to help the organization build the foundation needed to scale it responsibly.

As AI becomes embedded in business processes, controllers may need to expand their lens beyond traditional financial controls. In Taming the Beast: What Financial Controllers Need to Know About AI, seven considerations are explored:

1. Set your objectives (before someone sets them for you)
2. Adopt a governance framework
3. Test, validate, and keep testing
4. Get your data right (it doesn’t have to be perfect)
5. Keep a human in the loop (but define what the human actually does)
6. Measure what matters
7. Invest in your people, not just your technology

Together, these considerations point toward a broader role for controllership. Controllers can bring discipline to questions that otherwise risk being treated primarily as technology decisions: What problem are we solving? What constitutes an acceptable output? Who is accountable? How will performance be monitored? And ultimately, how will the organization know whether AI is delivering value?

The first question may be the most important: What are we actually trying to achieve?

AI investment alone does not guarantee AI value. Organizations can deploy sophisticated tools and still struggle to connect those investments to measurable business outcomes. That makes defining objectives upfront particularly important.

For finance leaders, traditional ROI measures remain relevant, but they may not tell the entire story.

The definition of AI value can extend across four dimensions: financial, operational, strategic, and employee value. Financial measures might include margin impact or AI run-rate as a percentage of revenue. Operational measures could include cycle-time reductions or transaction-processing costs. Strategic measures may capture customer value creation, speed to market, or reduced reporting risk. Employee measures can examine time redirected toward strategic work, engagement, or how quickly new hires reach proficiency.

That broader view can help controllers move the conversation from “How much are we spending on AI?” toward “What outcomes are we getting from it?”

It also creates a foundation for governance. Clear objectives make it easier to establish what should be measured, what constitutes acceptable performance, and where controls should be applied.

AI may introduce new technology, but organizations do not necessarily need to abandon established control principles to manage it.

An emerging principles-based framework for AI and internal control over financial reporting emphasizes a top-down, risk-based approach: Management should evaluate whether controls adequately address the risk of material misstatement and assess evidence about those controls based on risk. For controllers, this may look like: first identifying AI systems and their use, assessing risk, determining appropriate controls based on those risks, and defining considerations based on those controls.

In other words, the technology may be new, but many of the underlying questions are not.

A key theme underlying the framework is maintaining a reasonable level of assurance, meaning there is a high, but not absolute, level of confidence that material misstatements are caught or prevented. The goal here remains reliable financial reporting, regardless of technological change.

Human oversight is another key to the framework and is likely to remain an important component of AI control environments, and human-in-the-loop (HITL) procedures are a starting point for most AI control environments. But simply saying a “human is in the loop” is not enough. 

Organizations should consider the nature, timing, and extent of human intervention and HITL procedures. What is the reviewer expected to evaluate? What information do they need? What happens when an output falls outside acceptable parameters? And does the reviewer have the knowledge and authority to challenge the system?

As an AI system demonstrates reliability over time, organizations may be able to shift toward greater automation. The objective remains reasonable assurance and reliable financial reporting, and not human intervention for its own sake.

This approach also helps address AI’s so-called black box. Rather than attempting to recreate every underlying decision pathway, controls can focus on governance and outcome-based testing, validating outputs and monitoring whether the system continues to perform as intended.

AI introduces risks that range from data quality, access, and explainability to hallucinations, model drift, inconsistent outputs, and the potential propagation of errors across multiple agents.

But those risks tell only part of the story.

For controllers, AI represents an opportunity to apply familiar strengths in a new context. The organizations that derive sustainable value from AI may not simply be those that deploy the most technology. They will also need to establish clear objectives, meaningful measures, appropriate governance, reliable data, thoughtful human oversight, and people equipped to work differently.

In other words, AI does not necessarily need to be contained. It needs direction.

And controllership can help provide it.