Technology
How we build Norman: AI agents that do real bookkeeping and tax work, and the systems that keep them correct. Notes straight from the team.
Voice Input for Bookkeeping: Where the Flow Breaks
Voice input can replace manual data entry in bookkeeping, and almost none of the 2026 voice-agent stack is what you need for it. Here is the flow we shipped, the four things that broke, and the model upgrade that cost us language detection.
Automated E-Commerce Bookkeeping: What AI Orders Break
Automated e-commerce bookkeeping mostly works because the ledger assumes a customer record exists. Agent-driven orders arrive without one, and the country that decides the VAT goes with it. Here is what we measured in our own ledger, and what an order stream actually requires.
AI Bookkeeping Accuracy: Why 95% Tells You Nothing
Almost every AI bookkeeping tool claims 95% accuracy or better, and the number is close to meaningless. In our own German ledger, a program that always answers "19% VAT" would score about 87%, and half the money sits in the largest one percent of expense lines. Here is what to measure instead.
Can an AI Agent Collect Your Missing Receipts?
An AI agent can fetch some missing receipts and should chase almost none of them in the order you expect. Close to two hundred thousand expense lines in our own ledger have no document, seven in ten are under a hundred euros, and the ranking signal that matters was broken in our code.
Is AI Bookkeeping GoBD Compliant? Check the Audit Log
AI bookkeeping is GoBD compliant only if your change log can name who made each booking, and most audit logs cannot name a model. Here is what GoBD demands, why the EU AI Act will not help, and what we found in our own production audit trail.
ELSTER MCP server: can an AI agent file your tax return?
One exists, and it is a browser robot driving the portal with your credentials. Germany has no filing API to wrap: transmission runs through ERiC inside certified software, signed with a certificate that belongs to a person. Here is what an agent can and cannot do in a German return, and how we automate every step up to the signature.
MCP servers for accounting software: who has one
People are already searching for "sevDesk MCP", "DATEV MCP" and "WISO Steuer MCP". Almost none of those vendors publish one, and the servers that do exist are mostly community builds on top of public APIs. Here is the state of MCP in accounting and tax software in 2026, and what actually separates a first-party server from a wrapper.
Half the answer is always in another system
Norman is an MCP client now, so the agent can read from the tools a business already runs: a payment processor, a mailbox, a document store, your own internal server. What that unlocks, with the actual questions people ask, and the one rule that shapes all of it: read outside, write inside.
Half our background jobs had a deadline nobody chose
A command-line default in our container image was quietly capping every background task at 120 seconds, including batches that make dozens of model calls. Fixing the number was the easy half. The hard half was teaching the jobs how to die.
We do not write test cases for our AI. Production does.
Hand-written golden datasets rot the week you write them. Our regression suite for AI categorization is generated from real user corrections, gated by a rule that a miss has to happen three times before it earns a test. Here is the pipeline, the numbers behind it, and the hinge that was quietly broken.
Our agent has 102 tools. The engineering is in what it never sees
Every instinct in agent design right now is additive: more tools, more instructions, more memory. Norman exposes 102 tools and 19 workflow playbooks, and almost every architectural decision we made was a subtraction. Here is what we take away from the model, and why the agent is better at its job for never knowing what step it is on.
Streaming an AI agent is a protocol problem
A chat reply looks like a socket with words coming out of it. In production it is a protocol: additive event types, a trailing id, a retry rule that knows whether a tool already ran, and a timeout budget where every layer has to outlive the slowest turn. Here is what our chat stream actually sends, and why each piece is there.
Our batch scheduler is really a load balancer
Every night Norman balances two very different tenants on the same workers: patient, network-bound bank syncs, and hungry, compute-bound AI jobs that read receipts and categorize a constant stream of transactions. This is how we treat the scheduler as a load balancer, sense queue pressure per workload, and where we are taking it next: placing the heavy AI work by live load instead of a hand-picked cron minute.
How we trace every AI agent run without storing your data
Every model call inside Norman leaves an audit trail: which workflow, which model, what it cost, how long it took. What it does not leave is your receipts and bank data. We store hashes, not payloads. Here is the observability layer behind our agents.
How our categorizer learns from a single correction
Every transaction on Norman gets a category, and most of them never touch the model. The interesting engineering is not the LLM: it is turning one manual correction into a per-company memory that never leaks, has to earn trust, and can be proven to stick. Here is the design.
How we built an agent that files your VAT return
Autofiling prepares and submits your German UStVA end to end. The hard part was never the model — it was making a stochastic agent safe enough to perform a legal filing. Here is the design.