The Treasury Inspector General for Tax Administration Reviewed Five IRS AI Use Cases and Found Risk Management Practices Need Improvement

On September 24, 2026, the Treasury Inspector General for Tax Administration, TIGTA, issued its final audit report "Assessment of Artificial Intelligence Risk Management Practices," Report Number 2026-208-059, to the Commissioner of Internal Revenue. Its objective was to determine whether the data in the IRS's Compliance Data Warehouse "is sufficiently reliable to support the use of Artificial Intelligence." It did not evaluate the accuracy of the data itself, the report says. Its review "focused on the IRS's process to document its data reliability assessments for its AI use cases." Parts of the report follow, not the whole.

As of December 2025, the report says, the IRS had an inventory of 225 AI use cases. The inspectors identified seven deployed high-impact use cases that use data from the warehouse, and reviewed the five used for workload selection. High-impact AI, in the report's words, is "any AI system whose output serves as a principal basis for decisions or actions" that have "a legal, material, binding, or significant effect on civil rights, privacy, health, safety, or access to critical government resources and services." A footnote adds that certain uses of AI are presumed to be high-impact. AI may be integrated in decision or activity pipelines in high-impact categories without meeting the definition, it says, when its output does not actually serve as a principal basis for the relevant type of agency action or decision.

The Impact Assessments

A memorandum from the Office of Management and Budget, M-25-21, required federal agencies to implement minimum risk management practices for high-impact AI by April 2026. Those practices, the report says, require a completed and documented impact assessment that includes an assessment of the AI's intended purpose and expected benefit, the quality and appropriateness of the relevant data and model capability, and the potential impacts of its use. The memorandum also states, the report says, that if a high-impact use case is not compliant with the minimum practices, "the agency must safely discontinue use of the AI functionality."

Of the five deployed high-impact use cases reviewed, 40 percent, 2 of 5, "did not have an impact assessment documented." The other three did. A footnote to the sentence on the three that did says the AI impact assessments were conducted before the memorandum's effective date, based on prior guidance.

The IRS's Research, Applied Analytics, and Statistics management stated that they prioritized compliance with federal requirements for governance of AI use cases. However, the report says, the memorandum required federal agencies to implement minimum risk management practices for high-impact AI use cases by April 2026. In February 2026, the report says, the IRS developed and began implementing its own policy on the governance of AI, risk management processes and supporting documentation to align with the memorandum. As of July 2026, that management stated, they had not received any guidance or instructions from the Department of the Treasury to implement minimum risk management practices.

AI risk management for high-impact use cases "is critical because these use cases may have a material effect on taxpayer outcomes." According to the warehouse's own internal web page, the report says, its data "should not be used as a substitute for source systems for operational decision-making purposes." The IRS's impact assessments, the report says, should include documented analysis of the quality and appropriateness of the data from the warehouse, its potential impact on taxpayers, and planned mitigation measures.

Fit for Use, and the Record of It

The inspectors interviewed IRS program managers and data scientists about how they decided whether the data were fit for use. According to them, the report says, data quality checks were completed and the data were fit for use. "However, the type of data quality checks and documentation completed for each AI use case varied." One of the five use cases had documents outlining numerous processes and procedures used in testing. The remaining 80 percent, 4 of 5, "did not have any testing documentation."

OMB Circular A-123, the report says, states that proper documentation is a necessary part of an effective internal control system. In the report's words, "Documentation preserves evidence to support decision-making." The Research, Applied Analytics, and Statistics management agreed that standard documentation procedures would be valuable. However, in the report's words, "they did not prioritize documenting or standardizing baseline procedures or guidelines for evaluating data quality checks before its use in high-impact AI models."

A lack of formal written procedures or guidelines for assessing the quality and appropriateness of the data used in high-impact AI use cases, the report says, "may result in inaccurate, biased, or unreliable AI outputs that can cause significant financial losses and reputational damage."

Two Recommendations, and the IRS's Answers

TIGTA made two recommendations to the IRS's Chief Data and Analytics Officer: to ensure that AI impact assessments for high-impact use cases are completed in accordance with the memorandum, and to develop and implement standard processes for evaluating data quality and documenting the fitness of data for use in AI use cases. IRS management agreed with both.

On the first, the report says, management stated that it "will complete AI impact assessments for currently deployed high-impact AI use cases as of November 2026." On the second, management stated that it has implemented standard processes for evaluating data quality and documenting the fitness of data for use in AI use cases.