Short answer: AI should connect to your accounting and business systems through the vendor's official connection, start with permission to look but not change anything, and only change records after a named person approves each change. Every change should be logged so your own staff can undo it without calling the consultant who built it.
This post is for owners of Canadian companies with 50 to 500 people who are being pitched AI tools that "plug into" QuickBooks, Xero, Business Central or Salesforce. It explains, without jargon, what that plugging in actually means, where it goes wrong, and what to ask before you say yes. It draws on hands-on testing we did at Agent Forge Works against QuickBooks and Xero test companies.
What should I ask before an AI tool connects to my books?
Ask these four questions about any AI tool that wants into your accounting system, ERP or CRM. The answers tell you more than any demo.
- Will it only look, or can it change things? Looking at your unpaid bills is low risk. Approving or paying them is not. Find out which the tool can do, not just which it is meant to do.
- Who keeps it working? The software vendor, a free community project, or the consultant who built it? Each has a different answer to "what happens when it breaks next year?"
- Can it serve each of your companies or divisions separately? If you run more than one entity, each should have its own connection and its own data, never shared.
- Who stops it from changing things? The vendor's own permissions, a setting someone switched on, or rules written into the tool itself? A setting can be switched off by anyone with access. A vendor permission cannot.
What are the ways AI can get into my systems?
There are six common ways in. The best choice is the highest one on this list that your software supports; each step down is more fragile and costs more to keep running.
| Way in | What it is, in plain words | When it makes sense |
|---|---|---|
| Official connection from the vendor | The supported doorway Intuit, Xero or Microsoft provide for other software | First choice whenever it exists |
| The vendor's own AI connector | A ready-made link that lets an AI assistant like Claude or ChatGPT read your data | Quick exploring and answering questions; check what it is allowed to change |
| Notifications from your system | Your system sends an alert when something happens, such as a new bill | Fast reactions; never on its own, because alerts can be missed |
| Automation tools (Zapier, Make, n8n) | Off-the-shelf links between apps | Simple hand-offs between two systems |
| Spreadsheet export | Your staff export a file and the AI reads it | Software with no official connection; slow but very safe |
| Screen clicking | Software that clicks through screens like a person | Last resort; breaks when the vendor moves a button |
One more rule of thumb: if a task is the same every time ("each night, list bills over $5,000 due this week"), it should be fixed, predictable software. Save the AI's judgment for questions that genuinely vary, like "why were margins down in March?"
How do I let AI change records safely?
A wrong look gives you a wrong answer. A wrong change pays the wrong supplier. So any AI that changes records, such as approving a bill, needs all five of these protections:
| Protection | What it means | Example |
|---|---|---|
| One job per tool | The AI gets a tool that does one specific thing, not "edit anything" | "Approve this bill", not "change any record" |
| No double actions | If a request is sent twice by mistake, it still happens only once | A dropped connection doesn't cause a second payment |
| A last-second check | The AI confirms the facts are still true right before acting | If your bookkeeper paid the bill by hand an hour ago, the approval stops |
| A written record | Every change is logged: what changed, from what to what, who approved it, when | Bill 1042 moved from pending to approved at 10:14, approved by your controller |
| A person says yes | A named person approves each change until testing proves the AI can be trusted with more | The AI prepares the payment; your controller clicks approve |
Two things make this practical in a company your size. First, the approval should arrive where your people already work, as a message with buttons in Teams, Slack or email, not in yet another app. Second, every change must be reversible by your own staff from that written record, without calling whoever built the system.
What happens when two of my systems disagree?
Decide in advance which system wins for each fact, and write it down. Otherwise the AI meets two conflicting answers and has to guess, and you hear about it from an unhappy customer.
Example: QuickBooks says an invoice is unpaid, but the sales team's spreadsheet says the customer paid on Friday. The usual rule is simple:
- Your accounting system wins on what it owns. QuickBooks decides whether an invoice is paid, because payments are recorded there.
- The other system wins on what only it knows. The spreadsheet wins on "the customer promised to pay Friday", because QuickBooks has no place for that.
A one-page list (fact, which system wins), agreed with you before anything is built, prevents most of these problems. A good adviser works across the systems you already have rather than asking you to merge everything into one first.
What we found testing QuickBooks and Xero
We connected AI to QuickBooks Online and Xero test companies three different ways, in October 2026. All three read the same unpaid bills correctly. What differed was how easily each could change your books.
| Ready-made AI connector | Free community-maintained connector | Purpose-built connection | |
|---|---|---|---|
| Who uses it | A person asking questions in chat | An AI assistant working on its own | Scheduled work that runs every day |
| Can it change records? | Xero's: no, look only. QuickBooks': yes, it can create and delete invoices | Yes: half of its 142 tools change records | Only what it is built to do |
| What stops changes | Xero itself (strongest). QuickBooks: nothing | A setting in a file (weakest) | Rules written into the connection (strong) |
| How many companies | One person's login | One company at a time | One separate connection per company |
| Keeps a record of every request | Not under your control | No | Yes |
Three findings matter most for an owner:
- QuickBooks has no "look only" permission for outside software. When you allow a tool into QuickBooks, you give it the right to read and change your whole set of books. Any limit has to come from the tool itself, so ask how it is enforced. Xero does offer a look-only permission.
- "Read-only" can be a switch someone forgets. The community connector we tested only stops changes if three settings are switched on, and someone editing that file can switch them off.
- Logins expire if unused. QuickBooks connections stay alive for about 100 days between uses. A job that runs only at year-end will find its connection expired and stop until someone signs in again.
A checklist for owners
Before you let any AI tool into your accounting system, ERP or CRM, confirm each of these:
- It is tested on a sample company first, never on your live books.
- It starts with permission to look only, and you know who or what enforces that.
- Each of your companies or divisions has its own separate connection.
- Any change it makes is approved by a named person, in Teams, Slack or email.
- Every change is logged with what changed, before and after, who approved it and when.
- Your own staff can undo any change from that log without outside help.
- You have agreed in writing which system wins for each fact.
- Someone checks the connection is still working, including after vendor updates.
These are the same rules we build by. All fourteen are in The Agent Forge Way, and every figure in this post is on the evidence page with its source.