AI Agents for a Tax Department: Rules, Filings and Evidence

AI agents for a tax department work best as preparers and checkers, not as decision makers. They collect documents, apply a versioned library of rules your team has approved, draft workpapers and flag exceptions, while a named person reviews and signs before anything is filed or paid. Three safeguards make this reliable: a rule library the agent must cite, evidence attached to every figure, and review gates placed by consequence.

Key takeaways

• Start with preparation and monitoring work (document collection, reconciliations, calendars, notice routing), not with tax positions or submissions.
• Keep rules in a versioned library with an owner and effective dates, so the agent cites an approved rule instead of recalling one from memory.
• Every figure in a workpaper should link to a source document, a rule version and a calculation step that a reviewer can reopen.
• Put review gates where judgment or irreversibility begins: positions, submissions, payments and any message to an authority.
• Judge the agent by observable results such as reviewer corrections and late items, and review its permissions on a fixed schedule.

What tax work can an agent actually handle?

Tax work mixes judgment with a large amount of repetitive preparation. The repetitive part is where an agent earns its place, because it is rule-bound, document-heavy and easy to check. Typical candidates:

• Collecting and chasing source documents such as invoices, bank statements, payroll summaries and intercompany schedules.
• Matching ledger balances to supporting documents and listing the differences.
• Preparing draft workpapers for periodic indirect tax, withholding and income tax provisions.
• Maintaining the compliance calendar and reminding owners of open items.
• Reading notices from authorities, classifying them, and routing each one to the right person with the deadline noted.
• Answering internal questions from finance and procurement colleagues with a cited rule.

Some work should stay with people: taking a tax position, interpreting ambiguous law, negotiating with an authority, and signing a return. The agent can assemble the file for those decisions. It should not make them.

If your tax function sits inside an accounting practice, the pattern is close to the one described in superintelligent agents for accounting firms. If your department also handles customs and duties, the document discipline in AI agents for import export companies applies directly.

Why does a tax agent need a rule library?

A general model knows a great deal about tax in general and very little about your entities, your elections, your jurisdictions and your internal policies. Rules also change, and a model's recall carries no effective date. An agent that answers from memory will sound confident and be wrong in ways that are hard to spot.

The fix is a rule library the agent must retrieve from and cite. Each entry should hold:

• The jurisdiction and tax type it covers.
• The rule text, or a precise reference to the authoritative source.
• The date it takes effect and, where relevant, the date it ends.
• Your department's interpretation, kept separate from the law itself, with the name of the person who approved it.
• The entities it applies to and the known exceptions.
• An owner responsible for keeping the entry current.

Retrieval is a better fit than retraining for this job, because a rule change becomes an edit to one entry. The agent behaves differently on its next run, and the change is visible in a history. If you want the technical trade-off, the [AWS comparison of retrieval and fine-tuning](https://docs.aws.amazon.com/prescriptive-guidance/latest/retrieval-augmented-generation-options/rag-vs-fine-tuning.html) explains why editable knowledge belongs outside the model.

Two behaviors matter most. When no approved rule matches, the agent says so and escalates instead of improvising. When two entries conflict, it shows both and asks for a ruling. A library that records these rulings gets better with use, which is how a department's judgment becomes reusable.

What counts as evidence for an agent's answer?

An answer without evidence is only an opinion. For tax work, the standard is that a reviewer, or an auditor months later, can reopen a workpaper and reproduce each number without asking anyone. For an agent, that means every figure carries four things:

• The source document, with its identifier and the place in it where the value appears.
• The rule entry and version that was applied.
• The calculation steps, in order, in plain language.
• A record of what produced the figure and when, including which tools were called.

The agent should also state how well each item matched. A line can be fully matched to a document, partly matched with a stated difference, or unmatched. Reviewers then spend their time on the second and third groups instead of rereading everything.

Documents should remain in your own systems. The agent refers to them rather than keeping private copies, so retention and access rules stay in one place. Recording each retrieval, tool call and output is ordinary observability practice, and the [OpenTelemetry primer on observability](https://opentelemetry.io/docs/concepts/observability-primer/) is a useful background if your engineers need a shared vocabulary. The audit-prep habits described in AI for quality management transfer well here: findings, evidence and corrective actions in one traceable chain.

Where should review gates sit?

Gates should follow consequence, not volume. A department that reviews everything equally will either burn out or start skimming. Use this decision guide:

• Read-only preparation (collecting, matching, listing differences): the agent proceeds, and a reviewer samples the output on a regular rhythm.
• Drafting a workpaper or computation: the preparer reviews it before it enters the file.
• Any tax position, estimate or interpretation: a senior reviewer approves, and the agent cannot continue past that point alone.
• Submission, payment or any message to an authority: a named person approves each item, and the agent holds no credentials to perform the action itself.
• Changes to the rule library: the tax lead approves, and the reason is recorded.

Two design details make gates real. First, the reviewer sees the evidence before the conclusion, so approval is an act of checking and not of trusting. Second, the agent that prepared a figure never approves it. Separation of preparer and approver is an old control in finance, and it applies to agents exactly as it applies to staff.

What are the security and permission risks?

A tax agent reads material from outside your walls: supplier invoices, forwarded emails, PDFs from authorities. Any of that text can contain instructions aimed at the agent. The safe rule is that content from documents is data, never a command. The [OWASP guidance on prompt injection prevention](https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html) lays out practical defenses, and they are worth building in from the first day.

Permissions deserve the same care you give a new hire in the department:

• Read access to ledgers and document stores, scoped to the entities the task needs.
• No ability to post journals, release payments or submit to a portal.
• Submission credentials held by people, with the agent preparing the package and a person pressing the final action.
• Personal data in payroll or contractor files limited to the tasks that require it, with the data protection rules that apply to you respected.
• A scheduled permission review, because access tends to accumulate quietly.

The [OWASP authorization guidance](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) covers least privilege and deny-by-default in a form your security team will recognize. For the wider governance frame, the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) gives a shared structure for mapping and managing these risks.

How do you start, step by step?

Begin with one role and one process. A narrow first scope is easier to test and easier to trust.

• Choose one recurring task with clear inputs and a clear owner, such as the monthly indirect tax preparation for one entity.
• Write down the current process as it really runs, including the exceptions people handle from experience.
• Build the first slice of the rule library for that task only, with owners and effective dates.
• Define the evidence standard: what every figure must carry before a reviewer sees it.
• Set the gates using the decision guide above, and name the approver for each.
• Run the agent alongside the team for several cycles, comparing its output with the human result and recording every correction.
• Choose a success criterion you can observe, such as fewer reviewer corrections per cycle and no late items, then widen scope only when it holds.

On evaluation, the [Anthropic article on evals for AI agents](https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents) is a practical guide to turning past cases into repeatable tests. Your corrected workpapers are exactly that kind of material.

Illustrative scenario: a mid-sized company with three entities prepares periodic indirect tax returns by hand. The agent gathers the sales and purchase reports, matches them to the ledger, and finds one purchase invoice with a tax treatment that does not match any approved rule. It does not guess. It marks the line unmatched, attaches the invoice and the two closest rule entries, and routes it to the senior reviewer. The reviewer rules on it, the ruling is added to the library, and the next cycle handles the same supplier without a question.

How does Be Human run this in practice?

Be Human designs, implements and operates personalized AI infrastructure for companies. A first engagement defines one useful role, such as a tax preparation agent, along with the memory and tools it needs, the approval boundaries and an observable success criterion. Managed operations can then include monitoring, recurring evaluations, integration maintenance, permission review, incident response and controlled improvements to the rule library and workflows. The agent keeps its identity, memory, channels, tools and permissions under your control, and the service is delivered remotely in English and Portuguese.

If you are not sure which task to hand over first, take the free Be Human AI diagnostic to find the first task worth handing to an agent.

Frequently asked questions

Can an AI agent file tax returns on its own? It should not. The agent can prepare the package, check it against your rules and list open questions, but a named person should approve and perform the submission. Keeping submission credentials with people makes that boundary enforceable and not just a policy.

Do we need to train a model on our tax files? Usually not. Retrieval from a rule library and your document stores keeps knowledge editable, citable and under your control. Training a model on tax files makes a rule change harder to apply and harder to prove.

How do we keep the agent current when rules change? Treat the rule library as a controlled document set. Each entry has an owner and effective dates, changes are approved by the tax lead, and recurring evaluations rerun past cases to confirm the agent now behaves as intended. The agent should refuse to answer when no current approved entry applies.

Who is accountable when the agent gets something wrong? The department remains accountable, as it is for work done by staff or advisers. That is why each gate has a named approver, each figure carries evidence, and the logs show what the agent did. When an error appears, the trail lets you correct the rule, the process or the permission that allowed it.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.