Using Claude for accounts payable: what works and what to watch

What "using Claude for AP" can mean

When an AP lead says they want to use Claude, they usually mean one of three things:

1. A person uses the Claude app. Drag in a stack of invoice PDFs, ask for a table of vendor, invoice number, date, PO and total, and check it against the ERP.
2. Claude connects to your accounting system. Through a connector in Claude's directory, it can look up bills, payments and aging, and in some cases create records.
3. Claude runs inside a custom workflow. Invoices arrive in a mailbox, software sends each one to Claude through the API, and a draft bill lands in your ERP for a person to approve.

All three can work. They carry different risks, and the plan you use matters more than most people think. Anthropic's pages below were checked on Oct. 28, 2026.

What Claude does well with invoices

It reads PDFs as text and as images. Anthropic's PDF documentation says each page is turned into an image, and the page's text is extracted and sent alongside it. That's why it handles scanned invoices, stamps and tables better than older tools that only read text. Through the API, a request can carry up to 600 pages (100 in some setups) and 32 MB. Anthropic warns that dense PDFs can fill the context window before hitting the page limit.

It can return fields in a fixed format. Structured outputs make Claude return data that matches a schema you define, such as vendor, invoice number, line items and total, so your software can load it without breaking. Be clear about what that guarantees. It guarantees the shape of the data, not that every number is right. A perfectly formatted invoice record can still have the wrong total.

It can show its work. With citations turned on, Claude points to the exact text in the PDF behind each answer, and Anthropic says the pointers are guaranteed to be valid references to the document. For AP, this is the feature that makes review fast. The clerk sees the total and the spot on the page it came from.

It works with spreadsheets. Claude can create and edit Excel files in the app, and Claude for Excel works inside your workbook on Pro, Max, Team and Enterprise plans. Anthropic's own page says it isn't recommended for "audit-critical calculations without verification." That's a fair description of an AP reconciliation.

Connectors: what Claude can reach in your accounting system

Claude's connector directory lists several AP-adjacent systems. What each one is allowed to do varies a lot:

Read-only connectors are useful for questions like "what's due to our top 20 suppliers this week?" A connector that can create records, like NetSuite's, needs the same care as giving a new hire ERP access: its own role, limited permissions, and someone checking its work. Every connector page also carries Anthropic's warning that it doesn't control what tools a developer exposes or whether they'll change.

Your data: which plan you use matters

Invoices carry vendor names, bank details and prices. Know where they go.

• Personal accounts (Free, Pro, Max). Since Anthropic's 2025 consumer terms update, users on these plans choose whether their chats can be used to train models. If they allow it, data is kept for five years. If not, the 30-day retention stays. A clerk using a personal account for company invoices is making that choice for you.
• Business plans and the API. Anthropic says that by default it will not use inputs or outputs from its commercial products (Team, Enterprise, the API) for training. Anthropic's privacy article says commercial inputs and outputs are deleted within 30 days by default, with exceptions. Zero data retention is available for the API by agreement, but not for the Team or Enterprise apps or for Claude for Excel.
• Certifications. Anthropic lists SOC 2 Type I and II and ISO 27001:2022, among others. Ask for the reports through its trust portal if your auditors want them.

The simple rule: company invoices go through a company plan or the API, never a personal login.

What to watch: the AP risks AI doesn't fix

Fraud is the big one. In the FBI's 2024 Internet Crime Report, business email compromise led to $2,770,151,146 in reported losses from 21,442 complaints. In the AFP's 2026 Payments Fraud and Control Survey of 465 treasury practitioners, 76% of U.S. organizations had attempted or actual payments fraud in 2025, and 74% were hit by business email compromise. The survey's highlights say fraudsters mostly pose as vendors or executives asking to change payment instructions.

Where payments fraud came from in 2025

Share of organizations that experienced payments fraud, by source. AFP survey of 465 treasury practitioners.

1. Fraudulent email (BEC)70%
2. Changed ACH or wire instructions33%
3. Invoice fraud26%
4. Third party or outsourcer13%

Source: AFP, 2026 Payments Fraud and Control Survey, Key Highlights (underwritten by Truist), April 2026.

A fake invoice that looks right will be read correctly. Claude will pull the vendor, the total and the new bank account off it perfectly. Reading isn't verifying. That's why vendor setup and bank changes stay with people who call the vendor back on a known number.

Hidden instructions in documents. An invoice PDF is content from outside your company. Anthropic's own guidance on prompt injection warns that documents, emails and OCR output can contain instructions meant to redirect Claude, and recommends least privilege so a successful attack can do little damage. Its research team says prompt injection is far from a solved problem. Claude for Excel's page warns specifically that vendor files can carry hidden instructions. In AP terms: the thing that reads invoices should not also be able to pay them.

Plain mistakes. Anthropic says its techniques for reducing hallucinations help but don't eliminate them, and to always check critical information. Duplicate and wrong payments are already a cost without AI: APQC data showed even top performers paid 0.8% of disbursements in duplicate or in error, and bottom performers 2%, as reported by CFO.com in 2020. Software should make those checks easier, not skip them.

Claude can read an invoice perfectly. It can't tell you the invoice is honest.

Where the other side has a point

AI for invoices works, and the evidence is growing. In one 2025 study, researchers compared AI models with experienced lawyers reviewing legal invoices. The models reached up to 92% accuracy on approval decisions, against a 72% ceiling for the lawyers, at a tiny fraction of the time. The study covers legal bills, not supplier invoices, and isn't peer-reviewed. Anthropic's own small-business product is built on the right rule: Claude does the work, and "you approve before anything sends, posts, or pays."

Your ERP may also already cover the basics. Microsoft's Business Central Payables Agent reads invoices from a mailbox and drafts them for review. It never posts them, and it creates new vendors blocked until a person approves. It also has limits: it skips PDFs over 10 pages or 5 MB. NetSuite's Bill Capture extracts bill fields and leaves your 3-way match and approval workflows in place. If your invoices are clean and your ERP has this, start there.

What to automate, and what to keep with a person

How Peekgentic does it

We build the third kind: a workflow on a business plan or the API, connected to your mailbox and your ERP. Each invoice is read, matched to the PO and receipt where you have them, and saved as a draft bill on hold with every value tied to its spot on the page. A person on your team approves it. The software that reads invoices gets a login that can draft bills and nothing else: no vendor edits, no payments. The same pattern runs our order-entry builds; see how we handle billing and three-way match automation.

Before you start, pull 20 recent invoices, including the worst ones. If a tool can't handle those with a person approving, it isn't ready for your AP desk.