Use AI as a checker on vendor onboarding and master data, never as the one who edits it. It reads new vendor forms and documents, spots likely duplicate suppliers, and flags every bank detail change request for call-back verification. A named person in AP or treasury approves each change, and nothing reaches the payment run without that approval.
#Key takeaways
- A messy vendor master causes two expensive problems: duplicate payments to the same supplier, and payments sent to a fraudster's account.
- AI is good at reading trade licences, VAT certificates and bank letters, comparing them with the form, and finding near-duplicate supplier names.
- Bank detail changes must always be verified by a person, by phone, on a number already on file, whatever the AI says.
- Emails from suppliers are untrusted input; the workflow must ignore any instruction written inside them.
- A clean-up project plus a strict change procedure may be enough if you onboard few new suppliers.
#What does vendor onboarding look like in a mid-sized AP team?
A buyer emails AP: new supplier, please set up, urgent. Attached are a form, a trade licence, maybe a VAT certificate and a bank letter, sometimes in Arabic. The AP clerk keys it into SAP, Odoo or NetSuite, often without noticing the supplier already exists as 'Al Noor Trading LLC' under another spelling. Later, an email arrives asking to update the bank account.
The risk is real. The AFP payments fraud and control survey, april 2025 found that 79% of organizations faced attempted or actual payments fraud in 2024, with business email compromise the leading route at 63% of respondents. nacha, april 2025 reported that FBI complaint data put business email compromise losses in the billions across 2022 to 2024.
#What can AI check, and what must a person decide?
- AI can check: that the form, trade licence, VAT number and bank letter name the same legal entity, and that documents are not expired.
- AI can find likely duplicates by name, VAT number, address, phone and bank account across your whole vendor list, including Arabic and English spellings.
- AI can flag any request that changes bank details, remit-to address or contact email, and pull up the last verified details beside it.
- A person decides: whether to create the vendor, whether to merge duplicates, and whether a bank change is genuine after a call-back.
Treat supplier emails as untrusted. The OWASP top 10 for LLM applications lists prompt injection as the top risk, and a fraudster's email can carry hidden instructions. The workflow reads documents for facts and never acts on what the text tells it to do.
#What does a practical vendor master playbook look like?
- Export the vendor master and run a duplicate review once; merge or block duplicates with a person deciding each one.
- Write one onboarding checklist: required documents, who requests, who approves, who keys.
- Separate duties so the person who requests a vendor cannot also approve it or change its bank details.
- Verify every bank change by calling a number already on file, never one from the request.
- Have AI check each new request against the checklist and the existing master, and route it to the approver with its findings.
- Measure duplicates found, requests returned for missing documents, and bank changes verified before payment.
Duplicates have a direct cost too. corpay, citing APQC research, checked november 2026 points to research naming poor vendor master data as a leading cause of duplicate or wrong payments.
#When is a clean-up and a procedure enough?
If you add a handful of suppliers each month and one AP lead knows them all, a one-off duplicate clean-up in Excel, a written change procedure and a call-back rule are enough. Your bank's payee checks help too. AI earns its place when volume, multiple entities, Arabic documents or several requesters make the checks hard to apply consistently.
#How does Stennir run vendor onboarding with AI?
Stennir's AI consulting audit maps your onboarding and change process and ranks it against other AP workflows. AI implementation then builds the checks into your ERP and AP inbox, in Arabic and English, hosted where your rules require, with an approver on every change and every action logged. You pay for finished work.
AI training through the AI Operator Program teaches the AP team how to read the AI's findings and when to escalate.
We are
Stennir builds checks that sit in front of your vendor master, with a person approving every create, merge and bank change.
We aren't
Stennir does not edit vendor records or release payments on its own, and is not a payments provider.
#What should a finance lead do next?
Export your vendor list and count suppliers that share a VAT number or bank account. That count shows the size of the clean-up. See related work at AI for finance and AI for approval workflows, then take the free readiness assessment or book a 30-minute call.
#Common questions
Can the AI approve a bank detail change if the documents look right?
No. Documents can be faked and emails can be spoofed, so a person always verifies a bank change by calling a number already held on file. The AI's job is to make sure no change slips through unnoticed and to put the old and new details side by side for that person.
Does it read Arabic trade licences and bank letters?
Yes. Stennir builds for Arabic and English documents, including bilingual trade licences and bank letters. Accuracy is tested field by field on your own documents before anything runs, and fields the AI is unsure about are marked for the AP clerk to check by hand.
What do you need from us to start?
An export of the vendor master, a sample of recent onboarding requests and bank change emails, your current approval rules, and the name of the person who will approve changes. Sensitive fields such as account numbers can be masked during the first review.
Where does our supplier data stay?
In your own systems and the hosting region your rules require. Stennir does not copy your vendor master into its own accounts. Access is granted by you, logged, and can be revoked, and you keep the accounts, the data and the off switch.
