The IRS had a rule to stop AI that lacked required assessments, and a team to check. The audit doesn't say if either acted.
A memo from the White House Office of Management and Budget, issued in April 2025, contains a sentence that is unusual in governance writing because it says what happens next. If a high-impact AI use case does not meet the minimum risk management practices, the agency must safely discontinue it. One of those practices is a completed and documented impact assessment before deployment. The memo, M-25-21, allows exemptions for pilots and written waivers, and gave agencies until April 2026.
On 24 September the Treasury Inspector General for Tax Administration reported on five of the IRS's high-impact uses, all of them used for workload selection, meaning they help pick the cases compliance staff work on. Two of the five had no documented impact assessment. The memo makes that assessment one of the minimum practices, so unless a pilot exemption or a waiver covered these uses, and the report mentions neither, that is non-compliance. The three that did have one were written under earlier guidance, before the memo took effect.
The second finding is easier to misread. Four of the five had no testing documentation at all. Program managers and data scientists told the auditors that data quality checks had been completed, and TIGTA reports that as their account without confirming it. The auditors grounded this finding in the government's general internal-control rule that documentation is part of an effective control, rather than in a specific practice from the memo. So it is a recordkeeping and assurance failure whether or not the testing happened, and on its own it cannot show that testing never took place.
The IRS had a process of its own before the audit's fieldwork ended. In February 2026 it put an AI governance policy into the Internal Revenue Manual, two months before that fieldwork closed in April. The policy names an AI Assurance Team that must independently review the minimum practices for high-impact AI before risk is accepted. It requires a central inventory validated every year and reserves waivers to Treasury's Chief AI Officer, with no delegation. Where high-impact AI is not performing at an appropriate level, officials must plan to discontinue it until it complies, and where the risk cannot be mitigated, use must cease and access be suspended.
TIGTA's report does not say whether that assurance team reviewed these five uses, what it concluded if it did, or whether anyone considered discontinuation. IRS management agreed to complete the missing assessments by November 2026. So a requirement existed, a sanction existed and a named reviewer existed, and the gap still reached the inspector general's report with no documented response before it. I cannot say from the record that nobody inside noticed. I can say that if anyone did, the audit records no trace of it.
The Australian Taxation Office shows the same gap with less wiring around it. In Report No. 26 of 2024–25, published in February 2025, the Australian National Audit Office found that as of August 2024, 32 of the ATO's 43 AI models in production lacked a completed data ethics assessment. Assessments had been mandatory since January 2022, and of the 22 models introduced after that, only 10 had one. The auditors went further than TIGTA did. As of July 2024 the ATO had no monitoring and assurance arrangements over the framework, including over the completion and approval of assessments.
The detail I find most telling is the register. The data ethics team kept a list of assessments that had commenced or been completed, and did not check it against the assessments that were required. It recorded what existed and could not show what was missing. The report describes no route from a missing assessment to stopping a model. The ATO agreed to all seven recommendations. Its current AI transparency statement says nothing about the assessments, and I found no follow-up audit, so this describes the ATO in 2024 and not necessarily today.
A third audit shows that recording can fail on the side of action too. On 21 September ANAO reported that the Department of Health, Disability and Ageing replaced its one AI-enabled fraud detection model with a simpler logistic regression in December 2025, a decision its monitoring informed. The department did not assess the costs and benefits of the switch, and it did not document the change. Something was done here, and the record of why is what went missing.
Reading these findings needs three distinctions the reports do not always draw. A practice not performed is a failed control. A practice performed but not documented is also a failure, of recordkeeping and of assurance, since the documentation is how anyone else can rely on it. A record that exists but cannot be produced for auditors would be a failure of auditability, though none of these audits shows a case of it. Staff saying the testing happened does not settle which kind the IRS finding is. And none of the findings shows, by itself, whether anyone inside had already noticed.
Independence matters less here than four working parts. Someone needs access to the evidence, a schedule for checking it, a deadline for escalating what they find, and the authority to stop the system. An internal team can have all four. The IRS policy names the team, ties its review to risk acceptance and requires the inventory to be validated every year. What I could not find is an escalation deadline that turns a missing assessment on a system already running into a decision about stopping it. A periodic external audit cannot stand in for that, however good it is, because it runs to its own cycle and not to the system's.
A discontinuation rule describes what should happen once somebody notices. Access and a schedule are what make the gap visible. An escalation deadline and someone empowered to stop the system are what make it matter, and a rule that names the sanction without either half is a promise about a meeting nobody has called.
Sources
- Office of Management and Budget, Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, April 2025, sections 4(a)(i), 4(a)(ii) and 4(b)(ii).
- Treasury Inspector General for Tax Administration, Assessment of Artificial Intelligence Risk Management Practices, Report 2026-208-059, 24 September 2026.
- Internal Revenue Service, IRM 10.24.1, IRS Policy for Artificial Intelligence (AI) Governance, sections 10.24.1.1.3, 10.24.1.4.4, 10.24.1.4.6 and 10.24.1.5.3, dated 10 February 2026; current version effective 10 August 2026.
- Australian National Audit Office, Governance of Artificial Intelligence at the Australian Taxation Office, Auditor-General Report No. 26 of 2024–25, published February 2025, including paragraphs 2.87, 2.89 and 2.90.
- Australian Taxation Office, ATO AI transparency statement, accessed 5 October 2026.
- Australian National Audit Office, Artificial Intelligence and Medicare Benefits Integrity, Auditor-General Report No. 5 of 2026–27, 21 September 2026.
The evidence here is three independent audit reports, one agency policy manual and one federal memo, all primary. TIGTA's testing finding rests partly on staff statements the auditors did not verify. The ATO figures describe mid-2024, and no later audit was found. The DHDA account is the department's, as reported by ANAO. None of the audits establishes whether anyone inside the agencies had noticed the gaps before the auditors did. The prose was drafted with AI assistance. The research, verification and editorial decisions are the author's.