23/08/2024 Articles

The Automation of Tax Controls in Italy: the Role of the Procedure Manager and the Need for Explainability

Anteprima alla pubblicazione del volume speciale 2024/17

Index: 1. Possible Digital Shift in Tax Decision-Making and the Issue of Liability 1.1. Ve.R.A..: An AI-driven application for Taxpayers Risk Analysis 1.2. Digital Transformation of Decision-Making Processes 2. The Central Role of the Procedure Manager 3. The Significance of Personal Data Protection Legislation and Interventions by the Data Protection Authority Concerning New Automated Procedures to Combat Tax Evasion 3.1. The Right to the “Intelligibility” of the Algorithm 3.2. The Right Not to Be Subject to Decisions Based Solely on Automated Processing 3.3. Verification of Analysis Models, Data Pseudonymization Techniques, and Other Security Measures for Data Processing 4. Towards an Explainable Artificial Intelligence: Possible Solutions. 4.1. The place for XAI within the Italian legal framework 4.2. An alternative use for XAI: the place for explainability in internal risk management. 5. Conclusions

Abstract

 

***

 

The automation of tax controls is having a significant impact on the framework tax law and the structure of tax administrations worldwide. In Italy, the recent implementation of an advanced system of tax risk profiling ("V.e.R.A.")  might open the way to the automation of tax proceedings, exposing taxpayers to the potential risk of errors and discrimination. In this paper, we will address the upcoming changes in the framework of Italian law, by emphasizing the integration between tax law, data protection law, and AI in adapting the scope of tax proceedings to the progressive automation of tax controls. In addition, we will focus on the invaluable role of human decision-makers, with specific reference to the sc. "procedure manager", in ensuring a sound integration between humans and AI in the realm of automated tax controls.

 

1. Possible Digital Shift in Tax Decision-Making and the Issue of Liability

In the case Malone v. United Kingdom (1984),[1] the European Court of Human Rights’ Judge Louis-Edmond Pettiti prophetically affirmed that “the danger threatening democratic societies in the years 1980-1990 stems from the temptation facing public authorities to ‘see into’ the life of the citizens […]. In order to answer the needs of planning and of social and tax policy, the State is obliged to amplify the scale of its interferences. In its administrative systems, the State is being led to proliferate and then to computerize its personal data-files” leading to the creation of a “profile” for each citizen[2].

As Judge Petitti predicted forty years ago, the indiscriminate, widespread collection of personal data by public authorities, in an era of ongoing technological development, might lead to a “digital panopticon” where the public power observes everyone while remaining unnoticed.[3]

Though this problem might not be apparent in the realm of tax controls,[4] there might be several reasons to argue otherwise.[5] In fact, the constant automation in the functioning of public affairs has two fundamental consequences on the structure of the tax administration: 

1. Reduction in Non-Digital Interactions:[6] for many taxpayers, the shift towards digital-only interactions has significantly restricted their ability to manage their dealings with tax authorities in any non-digital format. This shift has allowed the Tax Administration to amass extensive data in specialized databases, enhancing the scope and quality of its surveillance and assessment capabilities.
2. Use of sophisticated Data Analysis Techniques in tax audits:[7] the Tax Administration now extensively utilizes advanced data analysis methodologies to perform large-scale tax risk analysis. These methodologies involve statistical models and automated processes, which are increasingly incorporating artificial intelligence to refine the accuracy and efficiency of taxpayer risk assessments.

In Italy, the use of data analytics in the realm of tax controls is addressed by Fiscal Law no. 111/2023, which specifically empowers the government to “enhance the use of digital technologies, [by] employing systems of artificial intelligence, to counteract phenomena of tax evasion and avoidance” (Art. 17).

As preliminary investigations reveal, this evolving framework poses multiple challenges both on the traditional institutions of domestic tax law, and to the protection of fundamental rights.[8] These challenges are amplified by concerns such as the opacity of algorithmic processes, the exposure of sensitive personal data, the risks linked to algorithmic profiling, and the possible lack of human oversight, which are intrinsic to the use of automated procedures in administrative proceedings.[9]

A particular focus is placed on an algorithmic system known by the acronym “Ve.Ra”,[10] which is intended to allow the Italian Tax Administration to cross-reference and process, through advanced techniques based on artificial intelligence, all the information contained in the databases at its disposal. Through this system, the Revenue Agency will be able to select taxpayers for audits and foster spontaneous compliance.

In this paper, the authors will try to address such developments, by analyzing whether the evolution of artificial intelligence, both from a legal and technical perspective, can lay the groundwork for the automation of tax controls within the Italian legal framework.

1.1. Ve.R.A..: An AI-driven application for Taxpayers Risk Analysis

The Ve.R.A. system is regulated by a series of provisions of the 2020 Italian Budget Law[11] and was implemented in June 2022 by a decree of the Ministry of Economy and Finance (MEF),[12] following the approval of the Italian Data Protection Authority (“DPA”). The available information on Ve.R.A. is relatively sparse. In recent discussions with the DPA, the Italian Revenue Agency underscored the need to maintain secrecy on the functioning of Ve.R.A. to preserve the effectiveness of tax controls.[13]

This necessity hints at the immense potential of Ve.R.A., which on one hand, will have access to all the databases available to the Tax Administration,[14] and on the other hand, will be capable of processing the vast amount of information found within these databases. This system aims at targeting “tax-evading” individuals by conducting probabilistic analyses based on evidence from prior audits.

Specifically, according to the information provided by the MEF[15], the functioning of Ve.R.A. will be based on the interaction of two different models, namely:

1. deterministic analysis models, which are intended to reconstruct the assets and financial flows of individual taxpayers; specifically, these models can highlight any discrepancies by cross-referencing information such as the declared income and the level of consumption attributable to individual taxpayers;
2. probabilistic (or stochastic) analysis models, which are designed to profile individual taxpayers by assigning an average “fiscal risk score” to each taxpayer, based on observational and data modeling processes.

From the limited indications provided by the Italian Tax Administration, it appears that the risk scores provided by Ve.R.A. will not trigger automated tax assessments. Rather, the aim of this system is to distribute public resources more efficiently, by enabling the Tax Administration to focus on “high-risk” profiles while excluding taxpayers with low or otherwise explainable levels of risk. This approach aims at directing tax controls at cases with higher investigative needs, in accordance with Art. 12 of the Taxpayer’s Rights Statute.

However, it has been suggested that this new application might soon outweigh human intervention, leading to the (full) automation of the audit process.[16] For this reason, the academic discussion has stressed the importance of harmonizing the use of Ve.R.A. with the provisions of tax law (such as the rules that regulate the audit decision-making process) that should limit such extensive use of artificial intelligence in assessment activities.

1.2. Digital Transformation of Decision-Making Processes

In administrative law, it has long been established that the use of “digital variants” in the conduction of administrative decisions must adhere to the “traditional” rules and principles of domestic law. Particularly, it has been noted that the “depersonalization” of algorithmic decision-making should not outweigh the accountability of public officials in individual proceedings. It has also been clarified that public authorities should be liable both for the flaws arising from poor algorithmic risk management, and for the errors and defects attributable to the programming phase of the system[17].

This position is reflected by several rulings from the Council of State,[18] which has established a set of principles that should regulate the use of algorithmic systems by the Public Administration.

1. The principle of algorithmic transparency or intelligibility: this principle aims at ensuring that the algorithmic decision-making process is interpretable by both the controllers and addressees of an individual proceeding.
2. The principle of non-exclusivity, or human intervention, in the decision-making process (so-called “human in the loop”): this principle ensures that human decision-making influences, or otherwise complements, the outcome of an automated individual decision.
3. The principle of non-discrimination: this principle is aimed at ensuring that the use of algorithmic tools complies with the principles of equality and equal treatment.

The rationale behind these rulings is primarily based on the European data protection regulation (GDPR, Reg. 2016/679) and, to a lesser extent, on Italian Administrative Law (see, particularly, Law no. 241/1990). Apparently, administrative judges have referred to European data protection law not only to build a “safety net” against the automation of administrative proceedings, but perhaps also to highlight that the framework of administrative law should parallel the evolution of AI and new technologies. 

These developments suggest the need for appropriate policy measures to ensure that administrative processes remain fair, transparent, and accountable. In fact, the integration of digital tools into the public administration raises significant concerns about the depersonalization of administrative decisions. Therefore, it is necessary to strike a balance between innovation and the protection of fundamental rights, to preserve the legitimacy and acceptance of algorithm-driven public governance.

In conclusion, the implementation of AI in administrative practices requires the adaptation of the existing legal framework to the modern complexities introduced by these technological advancements; in this context, the principles of transparency, non-exclusivity and non-discrimination play a pivotal role, by ensuring the protection of individual fundamental rights in the context of automated decision-making.

 

2. The Central Role of the Procedure Manager

The most delicate aspect of algorithmic decision-making is that artificial intelligence systems are often indecipherable without adequate computational expertise.[19] This problem could lead the Tax Administration to retain their information on all the necessary elements to decipher the functioning tax risk profiling and the various steps that led to a specific decision. In fact, if human officers are not capable of understanding the software operations themselves, they might avoid challenging the output of the system. This might lead them to provide explanations that do not refer to the reasoning behind the case at hand, but rather to common templates, in violation of the principle of “non-exclusivity” or human intervention in automated decision-making.

Therefore, the upcoming challenge for tax administrations will be to ensure that basic legal institutions (such as the duty to provide individual hearings or explanations for tax assessments) do not remain mere formalities by result of the transition from human to automated decision-making.

From this perspective, it seems crucial to deeply revisit the role of the procedure manager to ensure that the officials responsible for AI-based tax proceedings are equipped with adequate and proven competencies in both legal and computational fields. This would foster a “virtuous” dialogue between the Tax Administration and the system, ensuring human intervention over the outcome of algorithmic decisions. Through such interaction, we could ensure that automated tax assessments comply with the principles of “transparency”, “non-exclusivity” and “non-discrimination” of algorithmic decision-making, in accordance with the case-law of the Italian Council of State.

An adequately trained procedure manager will indeed be able to: (i) efficiently conduct verification, evaluation, and validation processes in relation to  automated individual decisions, without succumbing to the “overwhelming force of the algorithm”; (ii) verify the correct execution of the logical operations performed by the program and intercept any errors or programming defects; (iii) disclose the operational rules and outcomes of the algorithm during the motivation phase or in adversarial proceedings; and, finally, (iv) in cases where an administrative decision must undergo a second-degree procedure (such as a self-protection procedure)[20], reset the machine and either address the errors made in the previous decision or resort to a completely human revision of the algorithmic decision.

Hence, if we (really) are to see the use of artificial intelligence systems in tax proceedings, a major focus should be put on the role of the procedure manager.

This might even require regulatory level adjustments, and an explicit statement that their absence may provide grounds for invalidating the acts of the Tax Administration.

Moreover, to ensure that the designation of such officials is not a sole formality, it will no longer be sufficient for the designated officials to be merely a technical-tax expert. Instead, they must possess proven technical-computational skills to ensure the correct functioning of the machine and the accurate interpretation of algorithmic decisions.

A more realistic alternative (and, in this regard, the Spanish system could serve as a model for the Italian legislator[21]) might be to configure a sort of “dual-faced” figure. This model would involve both the procedural manager, as the tax official who materially instructs the practice, and, in a supporting role, an official from the “Technology and Innovation” department of the Tax Administration, or from another department that oversees, at a central or peripheral level, the development of the algorithmic systems employed by the Italian Revenue Agency. Indeed, the complexity of the context requires transversal and multidisciplinary skills, which seems excessive – if not impossible – to find in a single tax official.

 

3. The Significance of Personal Data Protection Legislation and Interventions by the Data Protection Authority Concerning New Automated Procedures to Combat Tax Evasion

As mentioned in the previous sections, the approval of D.M. 28/06/2022 (i.e., the ministerial decree that established the technical rules for the implementation of Ve.R.A.) was followed by a series of discussions between the Revenue Agency, serving as the data controller, and the Italian DPA.[22]

Technically, the Agency first conducted an “impact assessment” pursuant to Article 35 GDPR, and subsequently submitted this evaluation to the DPA in accordance with the following Article 36 GDPR.[23] Through the provision no. 276/2022, the Italian DPA authorized the use of Ve.R.A., subject to a set of significant conditions and reservations.

Primarily, the scope of the authorization was limited to a “testing phase”, to be conducted “on a representative random sample” of the population. Secondly, the DPA used its corrective powers – as provided by Article 58, paragraph 1, letter d), of the GDPR[24] – to require, at the stage of testing, that the Revenue Agency implements a series of significant measures to ensure compliance with the principles of “transparency”, “non-exclusivity” and “non-discrimination”.

These measures emphasize the critical importance of the provisions of data protection law, which could trigger potential civil suits and even claims before a tax court.

For this reason, it is now necessary to focus on the main technical measures that the Italian DPA imposed on the Revenue Agency through provision no. 276/2022. In the next section, we will specifically address the scope and objectives of such measures, while focusing on the legal basis of each measure under the rules and principles of the GDPR.

3.1. The Right to the “Intelligibility” of the Algorithm

Firstly, the DPA required the Revenue Agency to “collect opinions” on the functioning of Ve.R.A. from various stakeholders (such as trade associations and professional orders), and “publish an excerpt of [its] impact assessment”, while excluding the “attachments” and “parts that might compromise the security of the treatments”.[25]

It is worth noting that the adoption of these measures would be unnecessary if the implementation of Ve.R.A. was limited at the stage of tax-risk-analysis. In fact, tax-risk-analysis is an activity with no external relevance, which is subject to the complete discretion of the Tax Administration. Therefore, under Italian Tax Law, the opacity underlying the functioning of Ve.R.A. should not raise concerns, due to the high level of secrecy and discretion[26] that marks this phase of the audit process. 

However, under the provisions of the GDPR, the fiscal interest in maintaining secrecy on the functioning of tax-risk-analysis must be carefully balanced^[27] with the right to algorithmic “intelligibility”, as provided by Articles 13, 14, and 15 of the GDPR. More precisely, the right to algorithmic intelligibility provides that the subject of an automated individual decision has the right to receive meaningful information about the logic involved in data processing, in order to understand it.

In this respect, Article 23 of the GDPR stipulates that any exemption to this right must comply with the principle of proportionality. This principle – initially formulated by German scholars and subsequently incorporated into the EU legal framework – broadly stipulates that legislators and public administrations cannot impose obligations and/or restrictions on the rights and freedoms of private individuals protected by Union law to an extent greater than the strictly necessary to achieve the purpose set by the national authority.[28]

Traditionally, the principle of proportionality comprises three requirements, or “sub-principles” (so-called “three-step theory”), which must be integrated for a measure to comply with the principle of proportionality: “suitability”, “necessity”. and “adequacy” (or “proportionality in the strict sense”)[29]^-[30]: (i) “suitability” requires assessing whether a measure is likely to achieve the intended result; (ii) “necessity” demands selecting, among the various suitable measures to achieve the intended result, the one that involves the least sacrifice of EU principles; (iii) “adequacy” requires a comparison (or “balancing”) between public and private interest, and provides that the measure, though “suitable” and “necessary”, must not unduly burden its addresses.[31]

Assuming that Ve.R.A. constitutes a “suitable” and “necessary” measure to preserve the effectiveness of tax controls, the obligations imposed by the DPA on the Italian Revenue Agency seem precisely aimed at complying with the “sub-principle” of “adequacy”, in order to strike a balance between secrecy and proportionality in the context of algorithmic profiling.

3.2. The Right Not to Be Subject to Decisions Based Solely on Automated Processing

The second technical measure imposed by the DPA on the Revenue Agency concerned the “adequate training of [the] personnel involved” in the use of Ve.R.A. This measure aims at safeguarding the “right not to be subject to decisions based solely on automated processing” as found in Article 22 of the GDPR (subject to the exception provided under the subsequent Article 23, namely the principle of proportionality).

More specifically, art. 22 GDPR stipulates that, in the context of an automated decision-making process, there must always be human intervention in reviewing, validating, or refuting the decision made by the machine (sc. “human in the loop”).

Despite the ministerial decree and the impact assessment both stated that “human intervention is always guaranteed in the processes of forming analysis datasets and control”, the DPA warned that tax officers might “find it more prudent not to oppose the system's results, thus nullifying the guarantee connected to human intervention in the decision-making process”.[32]  This problem could be further emphasized if such officials did not possess proven competencies in managing, analyzing and monitoring the functioning of the algorithmic systems developed by the Revenue Agency. 

Hence, this obligation aligns with our previous considerations (supra, section 2), as to the necessity of revisiting the role of the procedure manager and ensuring that the officials responsible for potential future tax proceedings conducted via AI are equipped with adequate and proven competencies in both legal and computational fields.

3.3. Verification of Analysis Models, Data Pseudonymization Techniques, and Other Security Measures for Data Processing

The Italian DPA also required the Italian Revenue Agency to adopt effective processes to verify the quality of their models, apply data pseudonymization techniques, and implement security measures for processing data related to electronic billing, by providing periodic reports about the metrics used, the activities conducted, any issues encountered, and the security measures and techniques applied in practice.

These precautions are intended to uphold the general principles of “data minimization”, “storage limitation” and “integrity and confidentiality” of data, as provided by Articles 5 and 6 of the GDPR. 

Since Ve.R.A. will process and analyze data pertaining to a large set of taxpayers, it is critical to ensure that the security measures and techniques that they have implemented can effectively mask the identities of individuals and prevent data breaches in case of unauthorized access to the computer systems of the Revenue Agency.

The guidance provided by the DPA on data pseudonymization and other security measures for data processing is highly technical and specific. Nevertheless, official sources have reported that among these measures, the Revenue Agency: 

(i) will systematically apply pseudonymization techniques[33] aimed at preventing  the “mass reidentification” of taxpayers, and specifically, the risk “that through the cross-referencing of multiple non-identified variables included in the analysis dataset and the original database”, the model will be able to “reconstruct with a single operation all the original tax codes (or a significant number of them);[34]

(ii) in the definition of the models of analysis, it will not use the so-called “special” data (Art. 9 of the GDPR), such as those related to health status, sexual orientation, ethnic origin, political and religious orientations, etc.; moreover, the Revenue Agency will also exclude the data concerning the taxpayer’s country of birth; 

(iii) in the adoption of stochastic-probabilistic analysis models (for example, the classification of a subject as high or low risk profiles based on the outcome of previous investigative or assessment activities conducted against other subjects), it will only utilize “historical information related to processes that have completed their administrative life cycle”, thus excluding information retrievable from ongoing tax proceedings; 

(iv) to ensure transparency in relation to the risk analysis activity and the profiling techniques, it will publish a periodically updated special informative note on the logic used by the algorithms, as well as on the databases used to perform tax risk analysis, on the institutional website of the Revenue Agency; 

(v) it will not contemplate fully automated acts of assessment, as each phase of the risk analysis process will include the intervention of one or more operators.

It is worth noting that the technical measures underscored in these five points address some of the problems we have identified in the previous sections.

By imposing specific transparency requirements and human intervention in the conduction of tax assessment, the Revenue Agency lays the foundation for implementing AI technologies in accordance with the standards set by the Italian tax legal framework and the principle of proportionality. 

Yet, the legitimacy of algorithmic techniques of risk analysis lies on a specific condition that prevails over the remaining others, namely the presence of human intervention in individual tax proceedings (supra, point v).

In fact, as widely discussed in section 2, human intervention is needed to address the complexity of audit decision-making, and to prevent fallacies or information asymmetry in relation to the outcome of algorithmic profiling. Put differently, the current legal framework can only allow further automation in the decision-making process if automated decision-making does not outweigh human intervention in individual audit decisions. 

The measures undertaken by the Revenue Agency fail to provide a reliable basis for preventing or limiting automated decision-making, despite the warnings of the Italian DPA and legal scholarship in this respect. In the next section we will try to address these shortcomings, by analyzing whether the current developments in the field of artificial intelligence can help harmonizing the potential automation of tax proceedings with the requirements set by the principles of administrative and data protection law. 

 

4. Towards an Explainable Artificial Intelligence: Possible Solutions.

The increasing adoption of algorithmic systems by Tax Authorities requires an adequate understanding of their functioning by tax officers and taxpayers alike. 

In fact, the inability to interpret the functioning of AI models could trigger severe organizational problems, and potentially undermine the rights of individual taxpayers in individual tax proceedings. 

This problem further enhances the need to constrain the use of AI systems under the standards set by the principles of European and domestic law. More precisely, the implementation of AI techniques in tax controls should happen under the oversight and discretion of human officers, which in turn, should maintain control over the audit decision-making process. 

Apparently, these concerns are well reflected in the requirements set by Italian tax law. As we have mentioned in the previous sections, Italian law does not conceive algorithmic profiling as a major component of the decision-making process, but rather as a mean to foster spontaneous compliance. More precisely, Art. 5 of D.M. 28/06/2022 provides that the outcome of tax risk analysis is always subject to the oversight and discretion of human officers, which autonomously decide whether (or not) to issue an act of assessment to the “high-risk” profiles detected by the system.[35]

However, the Italian DPA suggested that human officers might soon rely on the system’s predictions without further intervening in the decision-making process (supra), [36] leading to a violation of the principles of European and domestic law.

This scenario could lead to even further problems in light of the current developments in the interpretation of the notion of automated decision-making by the CJEU. More specifically, in the recent SCHUFA ruling,[37] the CJEU has stated that the outcome of a [credit] scoring system should be labeled “automated decision-making” under art. 15, GDPR, whenever it plays a determinant role on the outcome of a decision, even if it is not the sole component of the decision-making process.[38]

This interpretation emphasizes the need to evaluate the weight of human decision-making, compared to automated decision-making, in the realm of tax assessments: in fact, an extensive reliance on the outcome of algorithmic profiling could trigger the application of Art. 15 GDPR, and bind Tax Authorities to comply with the obligations set for automated individual decisions.

It is worth noting that the developments reached by the SCHUFA case have also concerned this latter point, namely the obligations that apply to the providers of automated individual decisions.

More specifically, in the Advocate General opinion over the SCHUFA case, Adv. Gen. Pikamae asserted that the “right to receive an explanation” for the outcome of automated decision-making should mention, at least on an “aggregate basis”, the variables detected by the system in the scoring process.[39] Despite not being directly addressed by the SCHUFA ruling, this conclusion could trigger a broader interpretation of the right to receive an explanation, laying the groundwork for the implementation of automated decision-making in accordance with the principles of European law.[40]

In the realm of tax law, the solution envisioned by the Adv. General would require tax officers to provide taxpayers with reliable explanations on the functioning of the system. Yet, tax officers might be unable to “carve” such explanations out of the system, as the use of AI is notably faced by an “efficiency vs explainability” trade-off.

A possible solution to this problem could be found within the realm of XAI (“explainable artificial intelligence”).[41]This field of study analyses various techniques that provide reliable estimates of the variables that determined the outcome of an algorithmic decision-making process.

Through such techniques, the users of AI models (including, inter alia, Tax Authorities) could comply with the requirements set by the CJEU, and specifically, with the duty to provide explanations for the outcome of an automated individual decision. By giving reliable estimates on the variables related to individual tax scores, Tax Authorities could provide taxpayers with insights on the legal grounds of their assessment notice, while ensuring that the outcome of automated individual decisions is reliable and fair. 

Accordingly, in the upcoming future Tax Authorities could use these techniques to comply with the legal requirements set forth in the previous sections. 

However, at the current state of technological development, the integration of XAI techniques in our legal system is faced by several challenges, as we will broadly discuss in the following section.

4.1. The place for XAI within the Italian legal framework

The implementation of XAI techniques in the realm of tax law faces significant challenges from both a legal and technical perspective.

From a technical perspective, the outcome of XAI estimates has proven to be reliable only under specific circumstances, while being fallacious in several other cases.[42]

From a legal perspective, lawmakers should clarify several aspects on the functioning of XAI explanations, namely: (i) if the content of XAI explanations should determine the issuance of an act of assessment, and (ii) if, and when, taxpayers should be entitled to acknowledge the content of such explanations. 

As for the first question, we believe that decision-makers should only deem an algorithmic decision as “valid” if it was proven to relate to a set of relevant variables, while possessing a minimum correlation with discriminatory or irrelevant variables (such as age, sex, or ethnicity). Based on this distinction, tax officers could rely on the content of XAI explanations to determine whether to notify taxpayers with an act of assessment, depending on the variables that determined the outcome of such individual decision.

As for the second question, we believe that lawmakers should specify whether taxpayers would be entitled to access the content of XAI explanations.

Naturally, this choice depends on the level of automation of the decision-making process: the higher the emphasis on automated decision-making, the higher the need to provide insights on the reasoning applied by the algorithms. Accordingly, taxpayers should be granted access to the content of XAI explanations whenever algorithmic decision-making was proven to be determinant for the outcome of an individual assessment.

At this point, lawmakers should also identify the stage of the decision-making process where taxpayers would be able to access the content of XAI explanations. 

Hypothetically, XAI explanations could be used by Tax Authorities in individual proceedings, to provide taxpayers with information of the reasoning behind their risk score. In this case, the outcome of XAI estimates should be disclosed to individual taxpayers upon notification of their act of assessment, as a substitute or integration of “traditional explanations”. 

Alternatively, XAI techniques could be used by Tax Authorities in court, to prove the reliability of their models against claims of unfairness or discrimination.[43]

However, we should note that in the latter case, Tax Authorities would only disclose the reasoning of the model after the issuance of an act of assessment, in blatant violation of the provisions of Italian tax law.

For these reasons, the outcome of XAI explanations could only be used upon notification of an act of assessment, as suggested in our former hypothesis. In this scenario, tax officers would use XAI explanations as a mean to provide taxpayers with valuable information on the decision reached by the model, thus “integrating” the content of traditional explanations. This use of XAI would allow further automation in the conduction of tax audits, while preventing any possible violation on the right to receive an explanation in individual assessments.

However, although this solution could be extremely valuable in the upcoming future, it is currently faced by several constraints. 

On one hand, the technical limitations that affect the field of XAI provide uncertainty as to whether these techniques could provide “reliable” information on the functioning of AI models. On the other hand, the disclosure of detailed information on the functioning of algorithmic profiling could undermine the effectiveness of tax controls, by providing taxpayers with insights that they could use to predict the reasoning of the algorithms (supra).[44]

For these reasons, the use of XAI techniques in individual proceedings is inevitably precluded by both technical and legal limitations. Yet, tax officers might still be able to exploit the advantages of XAI as a mean to prevent, rather than advance, the progressive automation of tax audits. More specifically, XAI explanations could serve as a valuable mean to enhance the role of human decision-making in individual assessments, by providing insights on the functioning of the algorithms in a prior stage of the decision-making process, i.e. the stage of algorithmic profiling. In fact, XAI explanations could allow tax officers to interpret the output of the algorithms and provide a meaningful contribution to the outcome of the decision-making process, in accordance with the principles of European and domestic law. 

4.2. An alternative use for XAI: the place for explainability in internal risk management.

Although XAI techniques could help foster explainability in automated decision-making, there are technical and practical constrains that make such techniques unable to supplant traditional explanations in individual tax proceedings. 

At the current state of scientific development, the uncertainty and inconsistency that surrounds the implementation of XAI makes it incompatible with the requirements set by the provisions of Italian tax law. Furthermore, the disclosure of detailed information on the functioning of the algorithms could undermine the effectiveness of tax controls by revealing too much information to individual taxpayers (supra).

For these reasons, XAI explanations are currently unable to match the progressive automation of tax audits, enhancing the need for human intervention in the decision-making process. Put differently, the field of XAI does not currently provide a reliable basis for the full automation of tax audits, but rather emphasizes the need to promote human oversight and discretion, to meet the standards set by the principle of European and domestic law.

To this end, we have repeatedly emphasized that the Revenue Agency should “make up” for the unfeasibility of individual explanations by (i) providing human intervention in the decision-making process and ii) implementing specific measures to enhance transparency in relation to the functioning of algorithmic profiling.

In our view, XAI explanations could help ensuring that the use of AI in tax controls complies with these specific requirements, by enhancing (i) human intervention and (ii) transparency in algorithmic profiling.

More specifically, XAI explanations could play a fundamental role at the stage of internal risk management, by providing reliable indications, especially at an aggregate level, on the risk of bias, inaccuracy, or fallacies in the functioning of algorithmic profiling.[45]

Naturally, the possible benefits that might derive from the implementation of XAI techniques for risk management purposes cannot supplant the rights and guarantees provided by domestic tax law in the realm of tax controls.[46]

Rather, these techniques may offer a reliable basis to foster AI interpretability, which in turn, is a pre-condition for providing taxpayers with an effective legal remedy in relation to their act of assessment. 

This conclusion is consistent with our previous considerations: the implementation of artificial intelligence in tax audits places a fundamental responsibility on tax officers and, specifically, on the sc. procedure manager, who is required to intervene in the decision-making process and prevent the full automation of tax audits, thus preserving the fundamental roots of taxpayer protection.[47]

 

5. Conclusions

As we have illustrated in this paper, the increasing reliance on automated decision-making by Tax Authorities requires the adoption of specific management techniques – such as, XAI explanations –to understand and interfere with the outcome of algorithmic profiling. 

Naturally, these techniques cannot supplant the fundamental institutions of taxpayer protection; rather, they can support tax officers in complying with the requirements set by the principle of proportionality, and in providing taxpayers with an effective legal remedy against (automated) acts of assessment. 

Although these conclusions may provide insights as to how Tax Authorities should integrate AI systems in the field of taxation, it would be foolish to interpret the progressive automation of law enforcement as a mere legal or technical issue. In fact, the increasing adoption of AI technologies in the public sector raises concerns that extend beyond the perspective that we have adopted in this paper.[48]

More specifically, we should consider whether, in light of the extraordinary and rapid technological developments we have witnessed in the last two decades, it is appropriate to promote, at a legislative level, a “full-field” use of advanced artificial intelligence techniques of “data scraping” to gather citizens’ information on the web. 

And this especially considering that several multinational companies have undertaken multiple initiatives to self-regulate the development and commercialization of AI.[49]

Eventually, the adoption of a “Machiavellian” approach in the implementation of new technologies could lead certain private entities to assume a “quasi-publicistic” role in the regulatory dynamics, and ultimately cause a “privatization” in the protection of our fundamental rights.[50]