Invoicing and Accounts Payable: from Paper Invoices to AI agents

Invoices arrived by mail and fax. A clerk opened the envelope, stamped the date, and walked the paper to whoever ordered the goods for a signature. Then someone keyed the vendor, amount, due date and GL account into the accounting system by hand.

Small companies ran on QuickBooks, which Intuit released in 1992. Mid-market and enterprise firms ran AP modules inside on-prem ERPs: SAP R/3 from 1992, Oracle E-Business Suite, JD Edwards, Great Plains. Large buyers and retailers pushed suppliers onto EDI, the structured invoice format that rode private value-added networks. EDI worked for the top suppliers and almost nobody else.

The core control was the three-way match: the invoice against the purchase order against the receiving report. Clerks did it with paper stacks and highlighters. Checks were printed in batches, signed (sometimes by a signature plate), and mailed. The fax machine was a legitimate invoice channel well into the 2000s.

What broke: lost invoices, late fees, duplicate payments when the same bill arrived by mail and fax, and approvals stuck on a manager's desk during vacation. Month-end close meant a week of chasing paper.

The cloud moved the inbox, not the work. Bill.com, founded in 2006, gave small businesses a shared AP inbox, online approvals and electronic payments. NetSuite brought cloud ERP to the mid-market and Oracle bought it for about $9.3 billion in 2016. Coupa and Tipalti pushed spend management and global payables into the browser.

OCR templates started to read PDFs, approvals moved to email and mobile, and ACH replaced many paper checks. Europe began standardizing e-invoicing through Peppol, which started as an EU project in 2008. Pricing was per seat or per transaction, the model I argue agents are now breaking in AI didn't kill SaaS, it killed the seat.

What broke was the template. Every new supplier layout needed setup, and exceptions still landed on a person. Email approval also opened a new attack surface: criminals learned that a convincing "please update our bank details" note to AP was worth more than malware. That pattern is now a named scam, vendor invoice redirection.

Machine learning replaced templates. Instead of a rule per layout, models trained on millions of invoices pulled the header and line items from whatever arrived. Tipalti launched Tipalti Pi in March 2020 to flag fraud and payment errors. Stampli built Billy, an assistant that suggests GL codes, catches duplicates and nudges approvers. Vic.ai and AppZen sold ML coding and spend audit to finance teams.

The pattern was suggestion, not action. The model proposed a GL code and a match; a clerk accepted it. Anomaly detection flagged an unusual amount or a changed bank account, and a person called the vendor. Touchless rates went up on clean, PO-backed invoices and stayed low on everything else.

Consolidation followed. Thoma Bravo took Coupa private for about $8 billion in 2023. Meanwhile business email compromise kept growing: the FBI logged $2.77 billion in BEC losses for 2024. Better capture did nothing for the attacker who simply asked AP to pay a new account.

In 2025 the vendors stopped suggesting and started acting. Ramp launched Agents for AP in October 2025: they code each invoice line to the GL, check 60-plus fraud signals before routing, summarize vendor history and contracts for the approver, and enter card details in vendor portals to pay. BILL shipped a W-9 Agent and a Reconciliation Agent the same month, and its W-9 Agent now auto-approves high-confidence validations. Tipalti relaunched Tipalti AI around agents for purchase requests, tax form scans and reporting. Basware introduced InvoiceAI with AP Business and AP Data agents in November 2025, then announced a Supplier Agent for invoice disputes and payment queries in February 2026.

The limits are visible in the vendors' own wording. Ramp's approval agent recommends; a person decides. Ramp reports 85% of accounting fields correct on the first pass, so roughly 15% of fields still need a human fix. Basware routes every agent action through a policy engine and "autonomy gates." Stampli matches invoices to POs and skips approval when totals agree, which is automation of the easy case, not judgment on the hard one.

The risk sits where the money leaves. Agents now read the same email inbox that BEC crews target, and deepfakes have already talked a finance employee into wiring $25 million, as I wrote in the $25 million deepfake. An agent that can pay must be held to tighter rules than the clerk it replaces, not looser ones.

Pricing is moving too. When an agent processes the invoice, per-seat pricing makes less sense than per-invoice or per-outcome pricing, the shift I describe in the pricing model that proves you are AI-native.

The first nine months of 2026 widened the scope from the invoice to the inbox and the platform. AppZen made eight prebuilt vendor-email agents generally available in April, including a bank change guardian that escalates every request to vendor management and a draft-for-review mode where finance approves replies before they go out. Coupa bought Rossum in May to own document capture, then in August opened its Navi agents to outside agents over MCP, with access governed by existing user permissions. Coupa says more than 450 customers run its agents in production, a vendor-reported figure.

Every one of these vendors now sells an agent that can touch money or the vendor master, and the questions that matter are about identity, scope and rollback. I list them below in the buyer checklist.

My bet is that by 2031 most PO-backed invoices at mid-market and enterprise companies will be received, coded, matched, approved and paid with no human touch, and AP close becomes continuous instead of a monthly event. The human queue shrinks to exceptions, new vendors, bank detail changes and anything above a policy threshold.

Two forces push this. First, e-invoicing mandates: the EU's ViDA package makes structured e-invoices and near real-time reporting mandatory for intra-EU trade from July 2030. France already requires every VAT-registered business to be able to receive structured e-invoices from 1 September 2026. Structured data removes the capture step entirely and makes matching a database join. Second, agent payment rails: Visa Intelligent Commerce and Google's Agent Payments Protocol already define how an agent proves it was authorized to pay. I expect the same mandate idea to reach B2B, where a buyer's agent and a supplier's agent settle an invoice between themselves, an extension of agentic commerce.

What has to be true is mostly identity. Each AP agent needs its own credential, a scoped payment authority, and an audit trail a regulator will accept. I expect auditors to reject shared API keys and borrowed human logins, a point I make in AI agents don't have passwords. Segregation of duties has to be rebuilt for agents: the agent that adds a vendor must not be the agent that pays it.