AI Governance Institute
← News
Enforcement2026-09-29

IRS Deployed High-Impact AI With No Testing Records in 80% of Cases

Source

Data documentation for IRS's AI use cases is lacking, watchdog finds

Treasury Inspector General for Tax Administration

What happened

TIGTA published a report, covered by FedScoop in "Data documentation for IRS's AI use cases is lacking, watchdog finds". It found that 80 percent of five sampled high-impact IRS AI use cases lacked any written testing documentation. The IRS was conducting data quality checks in practice. However, those checks were not being recorded in the AI impact assessments that OMB Memorandum M-26-04: Increasing Public Trust in AI Through Unbiased AI Principles requires agencies to complete. TIGTA flagged that undocumented testing creates conditions where biased, inaccurate, or unreliable AI outputs could go undetected and uncorrected. IRS management agreed with both TIGTA recommendations: standardize data quality assessment procedures across AI use cases, and finish impact assessments for all currently deployed high-impact systems by November 2026.

Why it matters

  • ·Federal agencies and contractors subject to OMB AI inventory and assessment requirements now have a watchdog-confirmed standard: performing checks is not enough if those checks are not recorded. Undocumented testing is treated the same as no testing under OMB Memorandum M-26-04: Increasing Public Trust in AI Through Unbiased AI Principles.
  • ·The finding exposes a documentation gap that regulators and auditors are beginning to treat as a material control failure, not a paperwork technicality. Organizations that cannot produce written evidence of their AI data quality and testing procedures face the same reputational and regulatory exposure the IRS now does.
  • ·The November 2026 remediation deadline creates a concrete benchmark. Private-sector teams building AI impact assessment programs can use it to pressure-test whether their own documentation would survive an equivalent review.

Governance controls affected

What to do now

  • ☐Pull your current AI use case inventory and confirm that each high-impact use case has a written impact assessment on file, not just an internal understanding that testing occurred.
  • ☐Ask the teams running AI data quality or validation checks to show you the written records from those checks. If the records do not exist, begin creating a documentation requirement immediately.
  • ☐Set a review date before November 2026 to verify that any AI systems without completed impact assessments have been brought into compliance, mirroring the IRS remediation deadline.
  • ☐Check whether your organization's AI documentation standards require sign-off from a named owner for each use case, so that informal practices cannot persist without a responsible party on record.
  • ☐If your organization holds federal contracts or is subject to OMB AI guidance, confirm with your legal or compliance team whether the TIGTA findings trigger any parallel obligations for your own AI use case inventory.

What to watch next

Compliance teams should watch for TIGTA follow-up reviews as the November 2026 IRS deadline approaches. A missed remediation will likely draw a second public finding. It could also influence how other inspectors general treat AI documentation gaps across the federal government. Broader OMB enforcement signaling around OMB Memorandum M-26-04: Increasing Public Trust in AI Through Unbiased AI Principles is also worth tracking. Of particular interest is whether the administration treats documentation failures as grounds for pausing AI deployments. The TIGTA finding joins a pattern visible in the NY Comptroller audit of SUNY. Public-sector watchdogs are consistently finding that AI deployment has outpaced the governance infrastructure meant to oversee it.

Related Coverage

Corporate Policy2026-10-15

DOT's Undisclosed AI Vetting Tool Exposes a Shadow AI Inventory Problem

The U.S. Department of Transportation has built an AI tool to screen research grant recipients for financial ties to foreign adversaries. These include connections to Chinese Communist Party leadership and Russian oligarchs. Senior AI advisor Neil Chaudhry described the capability publicly, but the tool does not appear in the agency's published AI inventory. The gap raises concrete questions about high-impact AI disclosure obligations under federal governance requirements.

Research2026-10-08

Deloitte Finance Webcast Frames ISO 42001 and EU AI Act as Audit Evidence Anchors

Deloitte's October 2026 webcast for finance leaders addresses how to build audit-ready AI governance programs under frameworks including ISO/IEC 42001:2023 and the EU AI Act. The session covers governance structure, risk controls, compliance obligations, and evidence requirements for AI-enabled and agentic processes. It positions the NIST AI Risk Management Framework alongside the EU AI Act as practical reference points for regulated financial institutions.

Research2026-10-18

BCS ISO 42001 Certification Shows What Auditable Agentic AI Governance Looks Like

BCS, the UK's chartered institute for IT professionals, received ISO/IEC 42001 certification. An independent BSI audit assessed its AI management system across policy, accountability, risk assessment, testing, and human oversight. The certification covered agentic AI governance specifically. The experience provides a concrete implementation reference for organizations pursuing the same standard.