Responsible AI in ERP - Frequently Asked Questions

Responsible AI in an ERP context means ensuring that AI capabilities embedded in or connected to the ERP system are deployed with appropriate governance, human oversight, auditability and accountability -and that the organisation understands which decisions AI is making on its behalf and on what basis. This is a more specific and urgent question than general responsible AI governance, because ERP systems sit at the centre of an organisation’s most consequential operational processes: payroll, financial reporting, procurement authorisation and statutory accounts. An AI agent operating within an ERP system is not producing a recommendation for a human to consider -it is executing transactions, posting entries and progressing approvals within the system of financial record. For a public sector organisation, where the S151 Officer has statutory accountability for the proper administration of financial affairs and external auditors review the controls over financial systems, responsible AI in ERP is not an optional governance enhancement. It is a requirement of the accountability framework within which the organisation already operates.

Oracle’s March 2026 launch of Fusion Agentic Applications represents the most significant expansion of AI capability in Oracle Fusion Cloud to date. It introduced 22 agentic applications embedded directly into the Finance, HR, Supply Chain and Customer Experience pillars of Oracle Fusion Cloud, available to customers through the standard quarterly update cycle. These are not AI assistants or recommendation engines. They are coordinated teams of autonomous agents capable of reasoning, deciding and executing within business processes using Oracle’s transactional data, approval hierarchies and policy frameworks. Specific capabilities include a Payables Agent that processes invoices and manages supplier payments; a Ledger Agent that supports journal processing and financial close; a Workforce Operations agentic application that reconciles time, shifts and payroll policy rules continuously; and a Collectors Workspace that manages debt-collection activity, prioritises accounts and generates outreach. For a local authority or NHS trust running Oracle Fusion, these capabilities become available without a separate procurement -they arrive via the quarterly update cycle and are adopted within Oracle’s existing role-based access framework. The governance question is therefore how the organisation controls their adoption and configuration: whether it has the oversight structures to deploy them responsibly, and the testing infrastructure to confirm, before each quarterly update, that AI-driven processes are behaving as expected.

Accountability for AI-driven decisions in an ERP system sits with the organisation deploying the AI, not with the software vendor. This is the foundational governance principle of responsible AI -and it is non-negotiable in a public sector context. Oracle’s Fusion Agentic Applications are designed with role-based access controls, approval frameworks and end-to-end traceability. The technical infrastructure for accountability exists. But technical traceability is not the same as organisational accountability. The organisation must establish: who has authorised the deployment of each AI capability; what the human oversight mechanism is for AI-driven decisions above defined thresholds; how exceptions and unexpected outputs are escalated and resolved; and how AI-driven transactions are evidenced in the audit trail in a way that satisfies external audit requirements. In a local authority, the S151 Officer cannot discharge their statutory responsibility for financial administration by pointing to the software vendor’s audit log. They need to be able to demonstrate that the organisation had governance over how AI capabilities were deployed, what decisions they were authorised to make, and how their outputs were reviewed. That governance must be designed deliberately -it does not emerge automatically from Oracle’s built-in controls.

This distinction is the most important conceptual clarification in responsible AI for ERP, and it is consistently conflated in vendor marketing. AI as automation replaces a manual, rule-based process with a faster, more consistent version of the same process. Automating invoice matching against purchase orders, generating payment-run schedules or producing payroll exception reports are examples. The AI is executing a predefined logic more efficiently than a human could. The governance requirement is that the logic is correct and that exceptions are surfaced for human review -the same requirement that applies to any automated process. AI as decision-making is qualitatively different. An agent that reasons across data sources, evaluates scenarios and decides which supplier to pay first, which payroll exceptions to escalate, or how to prioritise debt-collection outreach is making judgements that previously required human discretion. The governance requirement here is not just that exceptions are surfaced -it is that the organisation has explicitly authorised the AI to make those judgements, understands the basis on which it makes them, and has a mechanism to review and override its decisions. Oracle’s Fusion Agentic Applications sit firmly in the second category for many of their use cases. Treating them as automation -and applying only automation-level governance -exposes the organisation to accountability gaps that will surface under audit or incident review.

AI governance in Oracle Fusion for a public sector organisation should be approached as an extension of existing ERP programme governance -not as a separate technology governance workstream. The practical starting point is an inventory of which AI capabilities are active in the Oracle Fusion environment, either enabled by default in a recent quarterly update or switched on by the implementation team. Many organisations do not have a complete picture of what AI is operating in their Oracle environment, because AI features arrive incrementally via quarterly updates and are not always prominently communicated. As at [month 2026], the 26C release included in the order of 600+ feature changes across 80+ modules (per Oracle’s 26C release readiness), a significant proportion of which involve AI enhancements. For each active AI capability, the governance framework should confirm: what decisions the AI is authorised to make autonomously; what decisions require human approval; what the escalation path is when an AI decision produces an unexpected output; how the AI’s outputs are included in the audit trail; and how the capability is tested before each quarterly update to confirm it is behaving as expected in the organisation’s specific configuration. The last point connects directly to the quarterly update regression challenge. An AI agent that behaves correctly in one Oracle release may behave differently after an update that modifies the underlying application logic. Testing AI-driven processes as part of quarterly regression is not optional -it is the mechanism by which the organisation maintains confidence that its governance framework is still functioning after each update.

Five questions that every Director of Finance or S151 Officer should be able to answer about AI in their Oracle Fusion environment: First: which AI capabilities are currently active in our Oracle Fusion environment, and did we consciously authorise each one? The answer is often incomplete, because AI features arrive via quarterly updates without requiring an explicit adoption decision. Second: for AI capabilities that involve financial transactions or payroll processing, what is the human review mechanism? If the answer is that there is no systematic review -that exceptions are only reviewed when they are noticed -the governance framework has a gap. Third: how are AI-driven decisions evidenced in our audit trail? External auditors are increasingly asking about controls over AI-assisted processes. The organisation needs to be able to demonstrate not just that transactions occurred, but that they were appropriately authorised and reviewed. Fourth: are AI-driven processes included in our quarterly regression testing scope? If the regression scope was defined before AI capabilities were enabled, it may not cover the processes that now carry the most change risk. Fifth: if an AI agent makes an error that affects payroll, financial reporting or a statutory submission, what is our incident response process? Organisations that have not considered this question before an incident occurs consistently take longer to respond and find it harder to evidence appropriate controls in the aftermath.

The UK regulatory framework for AI in public sector financial systems is evolving, but several existing obligations already apply directly. The Accounts and Audit Regulations and the relevant CIPFA code of practice require local authorities to maintain effective internal controls over financial systems. Where AI is involved in financial processing, the control framework must address AI-specific risks -including model behaviour changes following system updates, data quality dependencies, and the auditability of AI-driven decisions. Transparency obligations also apply. The Government’s guidance on AI procurement and the Algorithmic Transparency Recording Standard ask public sector bodies to be transparent about the use of algorithmic and AI-driven decision-making in their processes. Where Oracle Fusion AI agents are involved in decisions that affect individuals -payroll calculations, HR approvals, procurement decisions -transparency and accountability requirements apply. (Confirm the current status and local-government applicability of both before publishing.) Recognised AI risk-management guidance -including DSIT’s AI assurance work, NCSC guidance, and frameworks such as ISO/IEC 42001 and the NIST AI Risk Management Framework -is consistent on one point: AI risk should be integrated into existing enterprise risk management rather than treated as a separate discipline. For a local authority, this means AI governance in Oracle Fusion should be embedded in the programme’s existing risk register, change control process and internal audit programme -not managed as a standalone technology risk. External auditors, including those operating under the NAO framework for central government and the local government audit framework, are developing their assessment approaches for AI controls. Organisations that can demonstrate structured AI governance -documented authorisation decisions, tested controls, human oversight mechanisms -will be in a significantly stronger position than those that cannot.

Standard ERP governance addresses configuration risk, data quality risk, process design risk and system availability risk. AI in Oracle Fusion introduces four additional risk categories that standard governance frameworks were not designed to manage. Model behaviour drift: AI models can produce different outputs following system updates even when the underlying configuration has not changed. A payroll agent that correctly calculated exception flags in one Oracle release may classify them differently after an update modifies the model’s reasoning logic. Standard regression testing confirms that processes produce the right outputs; AI-specific testing must also confirm that the AI’s reasoning is producing appropriate outputs in the organisation’s specific context. Data dependency risk: AI agents reason across large volumes of operational data. Where data quality is inconsistent -as it frequently is in legacy-migrated Oracle environments -the AI’s outputs will reflect those inconsistencies in ways that may not be immediately visible. An accounts-payable agent that prioritises supplier payments based on incorrect supplier data can produce outputs that are individually plausible but systematically wrong. Autonomous escalation risk: AI agents designed to surface exceptions for human review may define exceptions differently from how the organisation would. A payroll agent that handles certain classes of discrepancy autonomously rather than escalating them may be operating outside the governance framework the organisation believes is in place -without producing an error or an audit-trail entry that would surface the discrepancy. Vendor dependency risk: the organisation’s AI governance is partly dependent on Oracle’s own responsible AI practices -including how Oracle designs, tests and updates the AI models embedded in Fusion Agentic Applications. Organisations should understand what commitments Oracle makes about model governance and update communication, and factor vendor AI governance into their own risk assessment rather than treating it as Oracle’s responsibility alone.

Responsible AI in ERP is inseparable from data governance, because the quality of an AI agent’s outputs is directly dependent on the quality of the data it reasons across. This connection is frequently underestimated -organisations focus on AI governance frameworks and oversight mechanisms while the data quality issues that most directly affect AI behaviour go unaddressed. In an Oracle Fusion environment, the data quality issues that most affect AI are concentrated in three areas. Master data -supplier records, employee records, chart of accounts -is the foundation that AI agents use to identify, classify and process transactions. Master data migrated from legacy systems with inconsistencies, duplicates or missing attributes will produce AI outputs that systematically reflect those problems. Transactional data completeness -whether all transactions are captured, coded correctly and approved through the right workflow -determines whether the patterns an AI agent works from are representative of the organisation’s actual financial activity. Gaps or workarounds in transactional data create blind spots in AI reasoning. Historical data continuity -whether the AI has access to sufficient historical transaction data to identify patterns accurately -affects the reliability of AI capabilities that involve trend identification, anomaly detection or predictive modelling. Organisations that went live on Oracle Fusion recently may find that capabilities requiring historical context perform less reliably until sufficient data has accumulated. The governance implication is that responsible AI in ERP cannot be addressed by governance policy alone. It requires an active programme of data quality management -master data governance, transactional data controls and data completeness monitoring -maintained as a continuous discipline, not a one-time implementation activity.

Testing AI capabilities in Oracle Fusion as part of quarterly regression requires an extension of the standard regression approach that most organisations have not yet built. Standard regression testing confirms that defined business-process scenarios produce expected outputs. For AI-driven processes this is necessary but insufficient -because the AI’s outputs depend not just on the process logic but on the AI’s interpretation of the data it encounters. Two identical process scenarios run against different data sets may produce different AI outputs, both technically within the system’s configured parameters but one of which is not what the organisation would authorise. Effective AI regression testing for Oracle Fusion involves three additional elements beyond standard process regression. First, designated AI scenario testing -specific test cases that exercise the agent’s decision logic using representative data, to confirm that the AI is making the kinds of decisions the organisation has authorised. Second, edge-case validation -scenarios that exercise the AI’s behaviour at the boundaries of its authorisation, confirming that it escalates correctly rather than acting autonomously where human oversight is required. Third, comparison-baseline testing -running a defined set of scenarios through the AI before and after each quarterly update, comparing outputs to identify whether the update has changed the AI’s behaviour in ways that require review or re-authorisation. This level of AI testing is only practical with an automated regression suite. Manual testing of AI behaviour at the pace and frequency required by Oracle’s quarterly update cycle is not feasible within the resource constraints of most public sector organisations.

Responsible AI adoption in Oracle Fusion for an organisation starting from zero does not require a comprehensive AI strategy before any AI capability is used. It requires a structured, evidenced approach to each AI capability as it is deployed -beginning with the AI features already active in the environment. The practical starting point is an audit of the current Oracle Fusion environment to establish which AI capabilities are active, which have been enabled deliberately, and which have arrived via quarterly updates without an explicit adoption decision. This produces the AI capability inventory that is the foundation of any governance framework. The second step is risk classification -assessing each active AI capability against the organisation’s risk appetite and accountability framework. Capabilities that operate in low-stakes, easily reversible processes (generating report narratives, suggesting expense categorisations) carry a different risk profile from those involved in payroll processing, financial close or procurement authorisation. Governance requirements should be proportionate to the risk. The third step is governance design for each material AI capability -documenting the authorisation decision, the human oversight mechanism, the escalation path and the testing approach. This documentation does not need to be complex, but it needs to exist -both for the organisation’s own assurance and for external audit. The fourth step is integration with the quarterly update cycle -ensuring AI-driven processes are included in the regression testing scope, that the testing approach is sufficient to detect AI behaviour changes introduced by Oracle updates, and that the governance framework is reviewed and updated when significant new AI capabilities arrive. An independent adviser with Oracle Fusion delivery experience can accelerate this significantly -not because the governance framework is technically complex, but because identifying which AI capabilities carry material risk in a specific organisation’s context requires knowledge of both Oracle’s AI architecture and the organisation’s operational and accountability requirements.

SIM Consulting’s approach to responsible AI in ERP starts from a position that is uncommon in this space: we have delivered and assured Oracle Fusion programmes in public sector environments, we understand what the quarterly update cycle actually involves, and we do not have a commercial interest in accelerating AI adoption for its own sake. That independence matters in responsible AI advisory as much as it does in ERP assurance. Most AI governance advice in the ERP space comes from system integrators who benefit from AI implementation projects, or from software vendors who benefit from AI feature adoption. SIM’s position -as an independent adviser with no SI relationships and no Oracle resale arrangement -means our assessment of which AI capabilities are appropriate for a given organisation’s governance context is not influenced by implementation revenue. In practice, SIM’s responsible AI support for Oracle Fusion programmes covers three areas. AI capability auditing -establishing which AI features are active in the Oracle environment, how they arrived, and whether the organisation has the governance structures to deploy them responsibly. AI governance design -building the oversight framework, documentation standards, human review mechanisms and escalation paths that responsible AI deployment requires, integrated with the programme’s existing governance rather than layered on top of it. AI testing integration -extending the quarterly regression scope to cover AI-driven processes and building the test scenarios that confirm AI behaviour remains within authorised parameters following each Oracle update. For organisations beginning to think about AI governance in their Oracle Fusion environment, SIM’s ERP Governance Diagnostic provides a starting point. It includes questions designed to surface AI governance gaps alongside wider programme governance positions. It takes 15 minutes and is available without obligation at simconsultingltd.com.