Your finance team is already using AI. The question is what they're pasting into it.

It is already happening

Walk through almost any finance function in the Gulf and you will find the same three things. An invoice pasted into a chat assistant to get the line items out as a clean table. A trial balance pasted in with a request for a first draft of the variance commentary. A difficult supplier email pasted in, with a request for a reply that is firm without being rude.

These are personal accounts, on a phone or in a browser tab. Nobody provisioned them and nobody filed a request. It is not shadow IT in the furtive sense — it is people reaching for a tool that genuinely works on a task that is genuinely tedious, because no approved alternative was ever offered. Blocking the domain does not end the behaviour; it moves it to a phone, where you cannot see it at all. The habit is not the problem to solve.

What the tool is, and what it is not

If you use these assistants daily, you already know how capable they are at language and at reasoning over whatever sits in front of them. That fluency is exactly what makes the next part counter-intuitive, so it is worth stating plainly. Three expectations to correct:

It cannot read your NetSuite. A chat assistant has no connection to your system unless something is built to give it one. It knows nothing about your subsidiaries, your chart of accounts or last month’s close. Everything it appears to know about your business arrived by being pasted in.

It is confident, not correct, about your numbers. Give it a figure that is wrong and it will explain the variance behind that wrong figure fluently and without hesitation. It has no independent view of what your ledger actually says, so it cannot flag the error — and the explanation will read exactly as well as a correct one would.

Enabling a feature and building a capability are different orders of work. Switching on an AI feature in a product you already own takes minutes. Constructing something that queries your ledger safely — scoped, permissioned, logged, and reliable enough that finance will trust the answer — is a project. The gap between those two is where most disappointment comes from.

Three lines you can draw

You can draw these this week, without a strategy, a budget or a vendor.

Line	What belongs there
Never leaves NetSuite	Anything identifying a person, a price, or an unreleased number
Fine to paste	Public information, generic questions, your own drafting
Needs a controlled path	Everything in between — which is most of the useful work

The first line is not only a matter of commercial prudence. Under the UAE’s Federal Decree-Law No. 45 of 2021, processing means any operation performed on personal data by electronic means, and the Saudi PDPL reaches the processing of personal data in the Kingdom by any means — so a prompt containing customer records is processing, and pasting it into a consumer account is a disclosure somebody has to be able to account for.

The third row is the one that matters. Most of what your team actually wants help with sits in the middle, which is why “just don’t use it” fails as a policy: it asks people to give up the useful part and keeps only the risky part underground.

What a controlled path looks like

Two routes. Which fits depends on whether you want the model to draft inside a process or to answer questions across the ledger.

The role is the boundary. Whoever builds it decides what an AI may read — and that is a classification decision, not a technical one.

Run the model call from inside NetSuite. The N/llm module lets SuiteScript send a prompt server-side, from your account rather than from an employee’s browser. Oracle’s documentation states that the data never leaves Oracle and is not used by third parties for model training, while also noting that data may be processed globally — which is a question worth asking before personal data crosses a border under either PDPL. The practical gain is that the prompt is constructed by code you control, on data the script selected, instead of by whatever someone decided to copy.

Give a model scoped, audited access — through a service Oracle now ships. Until recently this was the part of the answer that had to be described as a design rather than pointed at. That changed at SuiteConnect Dubai in February 2026, where Oracle announced the NetSuite AI Connector Service: a supported NetSuite service built on the Model Context Protocol, with Standard MCP tools out of the box and Custom ones where the standard set does not reach. Oracle states it is available in the UAE now.

What it gives you is the three controls a finance function would have asked for. You select which AI models to connect. You define the data those models are allowed to reach. You govern how they interact with NetSuite. A tool exposes a specific permissioned read — this saved search, that subsidiary, these fields — rather than handing over the account, and afterwards you can answer the question that decides whether any of this survives an audit committee: what did it see?

That is the part worth registering. The objection to putting an assistant anywhere near the ledger has always been that there was no governed way to do it, only a choice between a paste and a bespoke integration. There is now a governed way, from the vendor, and it is shipping.

It is also free. Oracle states that the AI Connector Service is not a paid feature and that MCP Standard Tools is a free SuiteApp — your AI client’s own subscription aside, enabling it costs nothing. There is no licence to buy and no procurement cycle to wait out, which is what turns the governance question from a hypothetical into a live one. Nothing external gates this. Whatever gates it has to come from you.

Which is not the same as it being done. The service settles the question of whether a controlled path exists; it does not make the decisions that path is made of. Which reads to expose, to whom, under whose approval, and what an auditor is shown six months later are design choices, and they are the whole of the work. Switching the service on is the short part — which is the same gap described further up, now with a supported product on one side of it instead of a whiteboard.

Oracle has made one of those decisions unavoidable, and it is the most instructive one. The service will not run under the Administrator role — nor under any role holding full access to NetSuite features, a restriction Oracle applies so that a compromise on the AI client’s side cannot reach everything. Before anyone can connect, somebody has to build a custom role and grant it the MCP Server Connection and OAuth 2.0 access token permissions, with Server SuiteScript and OAuth 2.0 enabled on the account and REST Web Services as well where the Standard Tools SuiteApp is installed. The client then connects over OAuth 2.0 with PKCE and sees exactly what that role sees.

That last clause is the point. The role is the boundary, and assembling it is not an administrative task — it is a classification decision. Whoever builds that role is deciding which subsidiaries, which records and which fields an AI is allowed to read, and they are deciding it in a permissions screen, usually without anyone framing it that way. Oracle has ensured the decision must be made. It has not made it, and it should not fall to whoever happens to have the screen open.

The actual question

Most finance teams do not need an AI strategy. They need to know which of those three lines their staff are already crossing, and somewhere sanctioned to put the work that sits in the middle.