Risks of Building an ERP with AI

Risks of Building an ERP with AI

By Dan Boulton | Cedar Bay 

The risks of building an ERP with AI go beyond getting the software to work.

In my previous article, I explored why developing an ERP system using AI could be more complicated than it initially appears. 

But there’s another consideration I believe businesses need to take seriously. 

Who is responsible when something goes wrong? 

ERP security and data protection risks

ERP systems hold some of the most sensitive information within a business, including customer records, supplier details, employee information and financial transactions. 

With an established ERP platform, businesses can evaluate the vendor’s security architecture, access controls and ongoing support arrangements. 

Developing your own system means taking much greater responsibility for those areas. 

Who is testing the software for vulnerabilities? Who manages permissions, encryption, backups and recovery? Who ensures the application remains secure as it evolves? 

AI-generated code isn’t automatically insecure, but neither is it automatically secure. 

Then there’s GDPR. Businesses need to understand where personal information is stored, how it is processed and whether sensitive data is being shared with external AI services. 

A ERP security incident isn’t simply an IT problem. It can become a serious operational, financial and reputational issue. 

Building an ERP with AI: Finance and compliance

Businesses also need to consider Making Tax Digital, VAT reporting and financial controls. 

A bespoke system could meet these requirements, but the functionality must be developed and maintained, or the system needs to integrate with compatible accounting software. 

If you’re developing your own ERP but still need an established finance package for compliance, are you really removing the need for traditional business software? 

Or are you introducing another system that needs integrating and supporting? 

External auditors are another consideration. 

They may need evidence of how transactions are recorded, who can amend them, whether changes are traceable and how reports reconcile to the underlying financial records. 

A bespoke system isn’t automatically unsuitable for audit, but the business must be able to demonstrate that appropriate controls exist.