AI in Finance has a Deployment Problem
A year ago, the majority of my conversations with finance leaders was about AI capabilities and use cases in finance. Whoa, I can’t believe it updated that spreadsheet with formulas intact.
Fast forward to mid-2026, and we’re not talking about the magic of these models anymore. We know what they can do. What we don’t know is how to get them working in production, inside our control environment. The focus has shifted to the complexity of deploying AI agents at scale.
If we can’t solve the deployment problem, much of the excitement around AI and vibecoding will fall flat. My goal is to help finance teams take their projects from prototype to production, so I’m sharing the framework we use at Lumera.
I’m going to use some SOX terminology, but these ideas aren’t limited to companies subject to SOX. Accounting and finance automations should be governed, testable, and predictable whether or not an auditor is asking.
The deployment problem
We have seen how quick it is to build an MVP of an automation idea. A couple of prompts, and you have a beautiful dashboard and Python code powering what used to be painstaking manual work. Now, where do you ship it?
There are two challenges.
The first is getting the project off your computer and into a production environment. If you’re lucky enough to get engineering support, you may get a walkthrough of GitHub, your cloud provider, and the company’s deployment process. But what happens when someone else in finance needs to review or update the business logic? They have to learn your setup first, and there’s a good chance you’ll lose them somewhere around the first command-line prompt.
The second is that the project operates on an island. It may perform the business logic correctly, but it doesn’t have the surrounding control environment that makes it reliable and audit-friendly. That includes access controls, change management, deployment history, monitoring, separate testing and production environments, secure integrations, and audit logs.
In SOX terms, these are your general IT controls, aka GITCs / ITGCs. The gap between prototype and production is the lack of ITGCs around your AI builds.
What an ITGC foundation needs
Whatever you build on, the same checklist applies:
Project-level access management
Separate sandbox and production environments
Secure API and MCP integrations
A shared data layer governed by administrative controls
Version control and change history
Deployment and audit logs
Detailed code-run logs
SOC 1 Type II and SOC 2 Type II reports from your platform provider
Most finance teams rebuild some version of this for every project, or skip it and run into issues in auditor discussions. Lumera ships with these on by default, and it’s the reason we built a governed platform for finance teams instead of a set of templates.
You design the application and review controls
The platform gives you the control environment. You, as the process owner, determine what could go wrong in your specific process and what checks belong in the workflow itself.
What needs an LLM, and what should be deterministic code. If the same input should always produce the same output, it’s code. Recalculations, threshold checks, roll-forwards, mapping tables. Use an LLM when you have use cases that need reading unstructured input, like classifying a vendor invoice description or pulling terms out of a contract.
Set your materiality threshold. Not every transaction needs the same level of scrutiny. You can incorporate your materiality threshold into your app, and define how smaller transactions are automated vs. manual review for material transactions.
What the reviewer needs in order to actually review. Manual review is treated like a silver bullet in the world of LLM automations. But this important step gets reduced to a rubber stamp of approval if you don’t design the review step to have visibility into the inputs and the work that was done.
If an application queries data from NetSuite, include an audit-log page showing the exact SuiteQL and parameters used. A reviewer can then trace or reperform the query.
If it’s an accrual calculation, show the population, the records excluded, and why.
If it’s a reconciliation, show the matching logic and the match results for the full population of data.
From prototype to production
Architect the process end to end. Design application controls around the risks of that specific process. Set materiality thresholds and build review controls into the app itself. Deploy on a platform where you can rely on the ITGCs instead of rebuilding them.
We support publicly listed and pre-IPO companies on Lumera. If you’re interested in exploring the platform for your team, or want to trade notes on this topic, I’d love to hear from you. You can send me a note here, or reply to this email!
Sowmya is the CEO and co-founder of Lumera, AI infrastructure for finance teams. She was previously Controller at OpenAI and Rippling, and led Corporate Accounting at Square.
A useful perspective. Building AI is only part of the challenge. Making it reliable, governed, and audit-ready is what determines whether it delivers lasting value in finance.