CRA AI audits: what triggers a flag and what to do
A client forwards you a CRA letter about their 2024 rental income and asks the obvious question. Why them?
Here's the uncomfortable answer. Nobody at the CRA picked them. A model did.
The CRA now runs 19 artificial intelligence systems. Some are ordinary back-office tools. Others score returns for risk of non-compliance before any human opens the file. The agency describes this very carefully, and the wording matters more than most people notice.
Most coverage of this stops at the news release. This post goes to what the CRA published about itself, including the privacy documents that name its risk-scoring systems and the internal evaluation that shows how often the targeting misses.
You'll learn which systems feed audit selection, what data they match against, what "human oversight" really covers, whether a client can challenge an algorithmic flag, and what to do in the first week after a letter lands.
The CRA runs 19 AI systems, and it words this carefully
A CRA spokesperson confirmed the number publicly in April 2026. The same statement included this line: "All tax returns and individual tax files continue to be reviewed and processed with human oversight. AI is not used to make decisions on personal tax situations."
Read the statement twice
Both sentences are true. Both are also narrower than they sound.
A "decision on a personal tax situation" means an assessment, a reassessment, or a benefit eligibility determination. Selection sits upstream of all of those. A model can rank your client in the top percentile for non-compliance risk, route the file to a program area, and never make a single decision as the CRA defines the word.
The uses the CRA describes in public are modest. A chatbot. Document classification and sorting. Internal drafting and summarizing. Coding assistants. Corporate functions. Nothing in that list is audit selection, and nothing in that list rules it out either.
Charlie, and why the accuracy gap matters
The CRA's chatbot is worth a short detour, because it's the only CRA AI system that has been independently tested.
- Launched February 2020 as a scripted, rule-based tool
- About $18 million to build and operate over five years
- Upgraded to a generative AI version in November 2025
- CRA cited roughly 90% accuracy in pre-release testing of the new version
- The Auditor General tested the older version in October 2025 and found it gave correct information about one third of the time
That's a wide gap between an internal benchmark and an outside test. Keep it in mind the next time you hear a confidence number attached to an enforcement-side model. Nobody has independently tested those.
The systems that actually touch audit selection
This is the part missing from the news coverage. The CRA documents its risk-scoring systems itself, in privacy impact assessment summaries published on canada.ca.
What the CRA's own privacy documents name
Business Intelligence and Compliance Risk Assessment. The CRA describes it as using "analytical algorithms and statistical models that generate risk scores that predict the risk of non-compliance." The summary is explicit that at the outset, "all available taxpayer personal information" is run through the predictive models. Cases that come out the other side go to the Compliance Programs Branch for further screening, which can lead to an audit, a letter, monitoring, penalties, or leads on related taxpayers.
It covers four audit classes:
- International and Large Business
- Small and Medium Enterprises
- Scientific Research and Experimental Development
- GST/HST
Integrated Risk Assessment System. In use for large business since fiscal 2017-2018. It produces algorithm-based risk rankings across three disciplines, domestic, international, and tax avoidance. Human reviewers then layer in local knowledge and audit history, and the highest-ranked files become the audit workplan.
Enterprise Fraud Management System. Significant enough to have drawn its own CRA internal audit.
Every return passes through a scoring layer. The score doesn't assess anyone. It decides whose file a human being will look at, and that is most of what matters.
The CRA's own evaluation is not flattering
On January 23, 2026, the CRA released an evaluation of workload management in its International and Large Business Tax Programs, covering April 2017 through March 2024.
For each entity selected, the CRA opens three audit cases, one per discipline. The evaluation tracked how often those cases produced tax earned by audit:
- All three cases produced results 3% of the time
- Two of three produced results 22% of the time
- Only one of three produced results 76% of the time
Efficiency moved the wrong way too. Average hours per closed case rose 26%, from 127 to 160, between fiscal 2021-2022 and 2023-2024. One of the recommendations was to review and refine file selection.
Tell your clients this part. Risk scoring is a filter, not a verdict. The CRA's own numbers show that most selected large-business cases produce nothing. A flag means someone is looking. It is not evidence that something is wrong.
What the models are matching against
Data the CRA already has before you file
The models aren't guessing. They're comparing what's reported against data already sitting in CRA systems.
- Slips. T4s, T5s, T3s, and financial institution reporting
- Payment processors. Merchant settlement data
- Digital platforms. Part XX reporting rules require platform operators to file annually by January 31. The first return was due January 31, 2025 for the 2024 calendar year. That covers short-term rentals, ride-share, and online selling
- Crypto. Canada's Crypto-Asset Reporting Framework takes effect January 1, 2026, with first reporting in 2027 for the 2026 calendar year. Your client's exchange activity for the year now in progress is the first batch
- Offshore structures. Information exchange under the Common Reporting Standard
- Industry norm databases. This is the one people forget
The ratios that stand out
Peer comparison is where most owner-managed files get caught. Things that draw attention:
- Gross margin drifting off the industry band with nothing in the file explaining it
- Shareholder loan balances that only move one way, especially across a year end
- Vehicle, meals, and travel claims high relative to revenue for the industry code
- Large year-over-year swings in revenue, deductions, or margin
- ITCs claimed that don't tie to reported sales on the same period's filings
- Contractor classification where the facts point to employment
- Personal expenses run through the corporation, renovations and travel in particular
None of these are illegal. All of them are visible to a model that compares your client against everyone else filing under the same code.
Human oversight, and the deadline that passed in June
What the Directive requires
The federal Directive on Automated Decision-Making is the Treasury Board instrument governing this. It has been in effect since April 1, 2019 and applies to automated systems developed or procured after April 1, 2020. Systems that assist an administrative decision are in scope, not just systems that make one.
It requires an Algorithmic Impact Assessment published before launch, peer review findings published, bias testing, data governance, an explanation to affected people, human intervention scaled to the impact level, and recourse.
Here's the part that went by without much notice. The fourth update to the Directive took effect June 24, 2025. Federal institutions running automated decision systems that were already in production got until June 24, 2026 to meet the updated requirements.
That date has passed. It passed three months ago, quietly, with no public accounting of which systems met it.
Where you can actually look
The Government of Canada publishes an AI Register on the open government portal. It pulls from Algorithmic Impact Assessments, access to information responses, parliamentary returns, and service inventories. It's labelled a minimum viable product and the entries are uneven.
Be honest with clients about what it gives you. It will confirm that a system exists and roughly what it does. It will not tell you why one particular client got picked. Nothing public will, and there's no sign that's changing.
Can a client challenge an AI-driven selection?
Short version. Not directly, and not in a way that helps.
- No disclosure requirement. There's no formal obligation on the CRA to tell a taxpayer that an algorithm flagged the file
- Objections target the assessment, not the selection. A valid assessment doesn't become invalid because of how the file was chosen. Arguing about selection at the objection stage spends goodwill and gets nowhere
- Judicial review needs a decision. Audit selection doesn't change anyone's liability, which makes it weak ground for an application
- The Directive is policy, not a remedy. A department falling short creates an administrative problem for that department. It doesn't hand your client a tax outcome
Tax lawyers are actively asking whether a Directive breach could support a procedural fairness argument down the road. It's a live question and worth watching. Don't build a client strategy on it yet.
What your client does have is the Taxpayer Bill of Rights, the CRA service complaint process, the Taxpayers' Ombudsperson, and the ordinary audit and objection rights. Those are real. They're also process tools, and none of them undo a selection.
What to do when a client gets flagged
Before any letter arrives
- Reconcile to every slip and every third-party report. Mismatches are the cheapest thing a model can find and the easiest thing to prevent
- Document outliers in the year they happen. If margin dropped because a major contract went bad, put it in the file now. A note written at the time carries weight. One reconstructed two years later doesn't
- Tie GST/HST filings to the financial statements before you file, not after the query
- Settle worker classification before the CRA raises it
- Report crypto and platform income. The reporting is already built. 2026 is the first CARF year and there's no version of this where the data doesn't arrive
The first week after the letter
- Answer what was asked. Scope expansion usually starts with an over-broad first response
- Build a response calendar immediately. Bill C-31 was tabled May 6, 2026, passed second reading June 3, 2026, and is in committee. It has not received royal assent. If it passes as drafted, a notice of non-compliance carries $50 per day to a maximum of $25,000, and a compliance order penalty of 10% of aggregate tax payable where tax owing in at least one year exceeds $50,000. Slow responses are on track to get expensive
- Keep one channel. Client documents going straight to the auditor is how a narrow query turns into a broad audit
- Bring in counsel early where there's real exposure, particularly offshore holdings, unreported income, or gross negligence risk
If there is a real problem underneath
The Voluntary Disclosures Program was revised effective October 1, 2025, with a two-track relief structure and voluntariness assessed issue by issue. Once the CRA has contacted the client about that issue, the door is mostly shut.
That means the VDP conversation belongs before the letter arrives, not after. If you're reconciling a file and something doesn't add up, that's the moment to raise it.
The bottom line
- The CRA runs 19 AI systems. Its statement that AI doesn't make decisions on personal tax situations is accurate and narrow, because selection happens before a decision
- Risk scoring for audit selection is documented in the CRA's own privacy impact assessments, with named systems covering SME, large business, SR&ED, and GST/HST
- The CRA's January 2026 evaluation found that for large-business files, only one of three opened cases produced tax earned by audit 76% of the time. A flag is not a finding
- The federal Directive deadline for systems already in production was June 24, 2026, and it passed without public accounting
- There's no practical way to challenge an algorithmic selection. The defence is clean reconciliation and contemporaneous documentation
- Bill C-31 hasn't passed. Watch it, because it changes what a slow response costs
The uncomfortable truth is that your client's file was scored before anyone read it, and you'll never see the score. What you can control is whether the file holds up when a human finally opens it.
That's the work. Reconcile to the third-party data, write down why the unusual numbers are unusual, and answer queries narrowly and on time.
We cover this kind of thing every week. New posts on Canadian assurance, tax, and practice go up at theadjustingentries.com. Come back next week.