Invoicing and Accounts Payable: from Paper Invoices to AI agents

Invoices arrived by mail and fax. A clerk opened the envelope, stamped the date, and walked the paper to whoever ordered the goods for a signature. Then someone keyed the vendor, amount, due date and GL account into the accounting system by hand.

Small companies ran on QuickBooks, which Intuit released in 1992. Mid-market and enterprise firms ran AP modules inside on-prem ERPs: SAP R/3 from 1992, Oracle E-Business Suite, JD Edwards, Great Plains. Large buyers and retailers pushed suppliers onto EDI, the structured invoice format that rode private value-added networks. EDI worked for the top suppliers and almost nobody else.

The core control was the three-way match: the invoice against the purchase order against the receiving report. Clerks did it with paper stacks and highlighters. Checks were printed in batches, signed (sometimes by a signature plate), and mailed. The fax machine was a legitimate invoice channel well into the 2000s.

What broke: lost invoices, late fees, duplicate payments when the same bill arrived by mail and fax, and approvals stuck on a manager's desk during vacation. Month-end close meant a week of chasing paper.

The cloud moved the inbox, not the work. Bill.com, founded in 2006, gave small businesses a shared AP inbox, online approvals and electronic payments. NetSuite brought cloud ERP to the mid-market and Oracle bought it for about $9.3 billion in 2016. Coupa and Tipalti pushed spend management and global payables into the browser.

OCR templates started to read PDFs, approvals moved to email and mobile, and ACH replaced many paper checks. Europe began standardizing e-invoicing through Peppol, which started as an EU project in 2008. Pricing was per seat or per transaction, the model I argue agents are now breaking in AI didn't kill SaaS, it killed the seat.

What broke was the template. Every new supplier layout needed setup, and exceptions still landed on a person. Email approval also opened a new attack surface: criminals learned that a convincing "please update our bank details" note to AP was worth more than malware. That pattern is now a named scam, vendor invoice redirection.

Machine learning replaced templates. Instead of a rule per layout, models trained on millions of invoices pulled the header and line items from whatever arrived. Tipalti launched Tipalti Pi in March 2020 to flag fraud and payment errors. Stampli built Billy, an assistant that suggests GL codes, catches duplicates and nudges approvers. Vic.ai and AppZen sold ML coding and spend audit to finance teams.

The pattern was suggestion, not action. The model proposed a GL code and a match; a clerk accepted it. Anomaly detection flagged an unusual amount or a changed bank account, and a person called the vendor. Touchless rates went up on clean, PO-backed invoices and stayed low on everything else.

Consolidation followed. Thoma Bravo took Coupa private for about $8 billion in 2023. Meanwhile business email compromise kept growing: the FBI logged $2.77 billion in BEC losses for 2024. Better capture did nothing for the attacker who simply asked AP to pay a new account.

In 2025 the vendors stopped suggesting and started acting. Ramp launched Agents for AP in October 2025: they code each invoice line to the GL, check 60-plus fraud signals before routing, summarize vendor history and contracts for the approver, and enter card details in vendor portals to pay. BILL shipped a W-9 Agent and a Reconciliation Agent the same month, and its W-9 Agent now auto-approves high-confidence validations. Tipalti relaunched Tipalti AI around agents for purchase requests, tax form scans and reporting. Basware announced a Supplier Agent that handles invoice disputes and payment queries in February 2026.

Read the fine print and the limits are clear. Ramp's approval agent recommends; a person decides. Ramp reports 85% of accounting fields correct on the first pass, so roughly 15% of fields still need a human fix. Basware routes every agent action through a policy engine and "autonomy gates." Stampli matches invoices to POs and skips approval when totals agree, which is automation of the easy case, not judgment on the hard one.

The hard part is the money leaving. Agents now read the same email inbox that BEC crews target, and deepfakes have already talked a finance employee into wiring $25 million, as I wrote in the $25 million deepfake. An agent that can pay must be held to tighter rules than the clerk it replaces, not looser ones.

Pricing is moving too. When an agent processes the invoice, per-seat pricing makes less sense than per-invoice or per-outcome pricing, the shift I describe in the pricing model that proves you are AI-native.

My bet is that by 2031 most PO-backed invoices at mid-market and enterprise companies will be received, coded, matched, approved and paid with no human touch, and AP close becomes continuous instead of a monthly event. The human queue shrinks to exceptions, new vendors, bank detail changes and anything above a policy threshold.

Two forces push this. First, e-invoicing mandates: the EU's ViDA package makes structured e-invoices and near real-time reporting mandatory for intra-EU trade from July 2030. Structured data removes the capture step entirely and makes matching a database join. Second, agent payment rails: Visa Intelligent Commerce and Google's Agent Payments Protocol already define how an agent proves it was authorized to pay. The same mandate idea will reach B2B, where a buyer's agent and a supplier's agent settle an invoice between themselves, an extension of agentic commerce.

What has to be true is mostly identity. Each AP agent needs its own credential, a scoped payment authority, and an audit trail a regulator will accept. Shared API keys and borrowed human logins will not survive an auditor, a point I make in AI agents don't have passwords. Segregation of duties has to be rebuilt for agents: the agent that adds a vendor must not be the agent that pays it.