Promote agency-wide responsible AI innovation and adoption through a governance and oversight process.

Oversee IRS compliance with requirements to manage risks from the use of AI.

Coordinate with accountable agency officials to ensure that the IRS's use of AI complies with applicable law and government wide guidance.

Establish, maintain, oversee, and report the agency’s AI Use Case Inventory in accordance with applicable law and policy.

Ensure that custom-developed AI code and the data used to develop and test AI are appropriately inventoried, shared, and released in agency code and data repositories, in coordination with relevant officials.

Establish processes for determining, documenting, centrally tracking, monitoring, and evaluating IRS AI use cases, including independent reviews of all high-impact use cases, determinations, and waivers and the certification and oversight of high-impact AI pilot projects.

Review determinations from accountable agency officials that a presumed-high-impact AI use case is not, in fact, high-impact, and override such determinations when deemed necessary.

Establish processes to measure, monitor, and evaluate the ongoing performance and effectiveness of the agency’s high-impact AI applications.

Certify high-impact AI pilot projects to proceed without one or more minimum risk management practices.

Serve as the senior advisor on AI to the Commissioner of Internal Revenue and within IRS executive decision-making forums.

Represent the IRS in, and collaborate with, coordination bodies relating to AI activities, including external forums such as AI-related councils, standard-setting bodies, relevant governance boards, or international bodies.

Advise on the transformation of the IRS’s workforce into an AI-ready workforce.

Provide guidance on AI investments to the Commissioner of Internal Revenue and Chief Financial Officer related to resourcing requirements relating to AI and agency efforts to track AI spending.

Ensure project team completion of all internal business unit requirements before engaging with enterprise AI use case governance, when the business unit elects to establish internal AI use case development and review processes that precede - but do not supersede or replace - service-wide AI governance.

Determine, track, and record whether each AI use case – upon initiation or at any lifecycle stage thereafter – meets the OMB-provided definition of high-impact AI. If the accountable agency official identifies the use case as one that is presumed-high-impact, but determines that it is not, in fact, high-impact, the accountable agency official must document and provide justification to the CDAO/RAIO via the CDAO AI team. All determinations must be recorded in the IRS AI Use Case Inventory. See IRM 10.24.1.4, High-Impact AI Use Cases.

Document, track, and record all risk-acceptance approvals to initiate and employ AI for operational use in the IRS AI Use Case Inventory.

Request and receive documented approval from the Treasury CAIO, via the CDAO/RAIO and CDAO AI team, for waiver from any high-impact AI minimum risk management practices. Waivers may only be approved based upon a system- and context-specific risk assessment declaring that fulfilling the minimum risk management practice requirement(s) would increase risks to safety or rights overall or would create an unacceptable impediment to critical agency operations.

Request and receive documented certification from the CDAO/RAIO via the CDAO AI team to implement high-impact AI pilot projects when the pilot would proceed without application of one or more minimum risk management practices.

Serve as the IRS’s ultimate decision-making body for final determination of high-impact AI when the accountable agency official overrides a presumption of high-impact to determine that the particular use is not, in fact, high-impact.

Serve as the IRS’s ultimate decision-making body for final certification of high-impact AI pilot projects to proceed without implementation of one or more high-impact AI minimum risk management practices.

Review and consult with accountable agency officials on any proposal for Treasury CAIO waiver from high-impact AI minimum risk management practices.

Conduct preliminary reviews of accountable agency official requests for waiver from one or more minimum risk management practices for high-impact AI. These requests must address system-specific and context-specific risk assessment and must conclude that fulfilling one or more minimum risk management practice requirements for the particular high-impact AI use case would increase risks to safety or rights overall or would create an unacceptable impediment to critical agency operations. The AIAT must then advise the DASIB on the clarity, detail, and appropriateness of all requests for Treasury CAIO waiver from high-impact AI minimum risk management practices.

Conduct preliminary reviews of accountable agency official requests for certification of high-impact AI pilot projects to proceed without implementation of one or more high-impact AI minimum risk management practices. The AIAT must then advise the DASIB on the clarity, detail, and appropriateness of all requests for certification for high-impact pilot projects to proceed without implementation of one or more high-impact AI minimum risk management practices.

Conduct secondary reviews of accountable agency official determinations that a presumed high-impact AI use case is not, in fact, high-impact. The AIAT must then advise the DASIB of concurrence or substantive non-concurrence with the accountable agency official’s determination.

Conduct independent reviews of AI minimum risk management practices for high-impact AI and document the outcome of those reviews in the AI Use Case Inventory before risk acceptance by the accountable agency official.

Any artificial system that performs tasks under varying and unpredictable circumstances without significant human oversight, or that can learn from experience and improve performance when exposed to data sets.

An artificial system developed in computer software, physical hardware, or other context that solves tasks requiring human-like perception, cognition, planning, learning, communication, or physical action.

An artificial system designed to think or act like a human, including cognitive architectures and neural networks.

A set of techniques, including machine learning, that is designed to approximate a cognitive task.

An artificial system designed to act rationally, including an intelligent software agent or embodied robot that achieves goals using perception, planning, reasoning, learning, communicating, decision making, and acting.

This definition of AI encompasses, but is not limited to, the AI technical subfields of machine learning (including supervised and unsupervised models, and semi-supervised approaches), reinforcement learning, transfer learning, and generative AI.

This definition of AI does not include robotic process automation or other systems whose behavior is defined only by human-defined rules or that learn solely by repeating an observed practice exactly as it was conducted.

For this definition, no system should be considered too simple to qualify as covered AI due to a lack of technical complexity (e.g., the smaller number of parameters in a model, the type of model, or the amount of data used for training purposes).

This definition includes systems that are fully autonomous, partially autonomous, and not autonomous, and it includes systems that operate both with and without human oversight.

Standalone AI capabilities

AI that is embedded within other systems or applications

AI developed by the IRS

AI developed or procured by third parties on behalf of the IRS for the fulfilment of specific IRS missions

AI procured by the IRS, including commercial-off-the-shelf (COTS) products that include AI functions

Paid and free services hosted by external service providers and accessed by IRS personnel or automated processes for IRS business use

an individual or entity's civil rights, civil liberties, or privacy

an individual or entity's access to education, housing, insurance, credit, employment, and other programs

an individual or entity's access to critical government resources or services

human health and safety

critical infrastructure or public safety

strategic assets or resources, including high-value property and information marked as sensitive or classified by the Federal Government.

Safety-critical functions of critical infrastructure or government facilities, emergency services, fire and life safety systems within structures, food safety mechanisms, or traffic control systems and other systems controlling physical transit

Physical movements of robots, robotic appendages, vehicles or craft (whether land, sea, air, or underground), or industrial equipment that have the potential to cause significant injury to humans

Use of kinetic or non-kinetic measures for attack or active defense in real world circumstances that could cause significant injury to humans

Transport, safety, design, development, or use of hazardous chemicals or biological agents

Design, construction, or testing of equipment, systems, or public infrastructure that would pose a significant risk to safety if they failed

In healthcare contexts, the medically relevant functions of medical devices; patient diagnosis, risk assessment, or treatment; the allocation of care in the context of public insurance; or the control of health-insurance costs and underwriting

Control of access to, or the security of, government facilities

Adjudication or enforcement of sanctions, trade restrictions, or other controls on exports, investments, or shipping

The blocking, removal, hiding, or limitation of the reach of protected speech

In law enforcement contexts, production of risk assessments about individuals; identification of criminal suspects; forecast of crime; tracking of non-governmental vehicles over time in public spaces; application of biometric identification (e.g., iris, facial, fingerprint, or gait matching); facial reconstruction based on genetic information; social media monitoring; application of digital forensic techniques; use of cyber intrusions; physical location-monitoring or tracking of individuals; detection of weapons or violent activity; or determinations related to recidivism, sentencing, parole, supervised release, probation, bail, pretrial release, or pretrial detention

Preparation or adjudication of risk assessments related to foreign nationals seeking temporary or permanent access to the U.S. or its territories including related to immigration, asylum, detention, or travel approval status

Use of biometric identification for one-to-many identification in publicly accessible spaces

Ability to apply for, or adjudication of, requests for critical federal services, processes, and benefits to include loans and access to public housing; determination of continued eligibility for ongoing benefits; the control of access-through biometrics or other means ( e.g., signature matching)-to IT systems for accessing services for benefits; detection of fraudulent use or attempted use of government services; adjudication of penalties in the context of government benefits

Determination of the terms or conditions of Federal employment, including preemployment screening, reasonable accommodation, pay or promotion, performance management, hiring or termination, or recommending disciplinary action; reassignment of workers to new tasks or teams

Provision of language translation (e.g., foreign translation and audiovisual translation) when responses are legally binding or for an interaction that directly informs an agency decision or action

AI that informs or influences whether a taxpayer will be subject to audit, or what aspects of a return will be subject to audit

Conduct pre-deployment testing

Complete AI impact assessment, see IRM 10.24.1.4.3 (3), Minimum Risk Management Practices, for required elements.

Conduct ongoing monitoring for performance and potential adverse impacts

Ensure adequate human training and assessment

Provide additional human oversight, intervention, and accountability

Offer consistent remedies or appeals

Consult and incorporate feedback from end users and the public

The intended purpose for the AI and its expected benefit

The quality and appropriateness of the relevant data and model capability

The potential impacts of using AI

Reassessment scheduling and procedures

Related cost analysis

Results of independent review

Risk acceptance

Accountable Agency Official’s determination of high-impact AI.

DASIB certification for high-impact AI pilot projects to proceed without one or more minimum risk management practices, along with the justification.

Treasury CAIO waiver of one or more minimum risk management practices for deployed high-impact AI, along with the justification.

The AI is integrated in a COTS product or service.

The AI use meets one or more of the OMB-provided “widely used AI use cases.”

The AI use is NOT “high-impact” or substantially customized beyond product’s/service’s default features, capabilities, and interfaces.

AI when it is being used either as a component of any National Security System or within the Intelligence Community.

AI used incidentally by a contractor during performance of a contract (e.g., AI used at the option of a contractor when not directed or required to fulfill IRS requirements).

IRS assessments of AI applications exclusively because the AI provider is the target or potential target of a regulatory enforcement, law enforcement, or national security action, and not because the IRS is also evaluating such AI applications for IRS use.

Record those use cases in a database in a manner consistent with OMB and Treasury requirements and this IRM.

Record all OMB-mandated data fields for those use cases.

Declare the database to the CDAO/RAIO, including the names of the accountable agency official(s) charged with maintaining the database, and a count of the number of use cases recorded in the database.

Make the database available for oversight and reporting purposes through appropriate channels and with appropriate safeguards, when notified by CDAO/RAIO.

Obtaining documentation from the contractor or vendor that facilitates transparency and explainability, and that ensures an adequate means of understanding what the model does, tracking model performance and effectiveness for procured AI.

Identifying circumstances that merit including a provision in a solicitation requiring disclosure of AI use as part of any given contract's performance.

Disclosing in solicitations whether a planned use of an AI system meets the threshold of a high-impact use case or if there is a reasonable likelihood for such a high-impact use case to occur during the life of the contract.

For AI systems with potential or expected high-impact use cases, informing vendors and contractors of reasonable transparency and documentation requirements that will be placed on the vendor to enable agency compliance with the requirements in OMB Memorandum M-25-21. For example, project teams should require sufficient descriptive information from vendors to complete the required AI Use Case Inventory entries and AI Impact Assessment for high-impact use cases.

Requiring vendors to provide a notification to the accountable agency official and project team prior to the integration of new AI enhancements, features, or components into systems and services being delivered under contract. Vendor notification to agencies should follow existing processes, where practicable, and should be determined by the relevant agency stakeholders. Project teams should also ensure, prior to contract release, that compliance requirements will be followed, consistent with OMB Memorandum M-25-21.

For each Federal contract for an LLM requiring that the procured LLM comply with the EO 14319-defined Unbiased AI Principles and providing that decommissioning costs shall be charged to the vendor in the event of termination by the IRS for the vendor's noncompliance with the contract following a reasonable period to cure.

To the extent practicable and consistent with contract terms, revising existing contracts for LLMs to include the terms specified in Sec. 4.(b)(i) of EO 14319.

Adopting procedures to ensure that LLMs procured by the IRS comply with the EO 14319-defined Unbiased AI Principles.

Use of any AI system that has not been approved for execution of the Treasury mission. Users seeking the use of AI systems provided by other government agencies should enter into a Memorandum of Understanding or similar agreement.

Input or upload into any public, non-Treasury, or otherwise-unauthorized AI system: personally-identifiable information (PII), federal taxpayer information (FTI), acquisition sensitive information, Bank Secrecy Act (BSA) information, statutorily-protected tax information, export-controlled or critical infrastructure controlled unclassified information (CUI), classified information, Official Use Only (OUO) information, Agency proprietary business information (PBI), other Sensitive But Unclassified (SBU) information, or any other non-public record or information that the Department has identified as restricted in nature and/or that the release of which could cause harm to the United States Government, the Treasury, or the IRS.

Use AI systems for any unethical or illegal purpose.

Input or upload data that is defamatory or infringing on any intellectual property rights.

Tampering or security evasion including attempts to reverse engineer, decompile, or disassemble any part of the AI systems except where required to meet Treasury mission requirements.

Engage in any activity that disrupts or interferes with the integrity or performance of the AI systems.

Use any outputs from AI systems in the performance of government business without ensuring direct human review to confirm the veracity of the information.

Using AI-generated content without reviewing the accuracy and appropriateness of the information.

Obfuscation of AI origin - when using GenAI to generate content, you must be transparent about AI use. As appropriate, disclose that the content was created with the assistance of and how GenAI was used (e.g. drafting, editing, etc.).

IRS uses of GenAI must be approved by an accountable agency official and align with IRS mission objectives and comply with applicable legal, privacy, and civil liberties requirements.

IRS GenAI systems must be governed by user agreements; employees must review, accept, and follow all requirements established in such agreements.

Employees are responsible for their inputs as prompts to solicit AI-generated outputs, and for their use, publication, or distribution of those outputs for internal or external purposes. Employees must review GenAI outputs to ensure they are appropriate for further use.

Users must maintain strong safeguards for civil rights, civil liberties, and privacy in their use of GenAI while also promoting innovation and public trust.

GenAI use cases must be reviewed against the list of uses that are “presumed” high-impact AI (see IRM 10.24.1.4.2 , Determination of High-Impact AI). GenAI use cases with outputs that serves as a principal basis for decisions or actions that have a legal, material, binding, or significant effect on rights or safety must be determined as ‘high-impact’ and subject to enhanced risk management and oversight consistent with M-25-21, Section 4. Refer to IRM 10.24.1.4, High-Impact AI Use Cases.

IRS must ensure that any generative AI systems procured or deployed for federal purposes demonstrate ideological neutrality, prioritizing truthfulness and historical accuracy, and explicitly avoid embedding or promoting ideological constructs associated with diversity, equity, and inclusion (DEI) or similar social agendas (Per EO Preventing Woke AI in the Federal Government).

The use of GenAI tools to create deceptive, misleading, or other content that violates law or policy is expressly prohibited. Do not use GenAI to make binding determinations or actions on taxpayer rights without proper oversight (see IRM 10.24.1.4, High-impact AI Use Cases), generate taxpayer-facing communications without appropriate validation, process or synthesize information in ways that risk disclosure of taxpayer data, including OUO, PII or FTI, unless explicitly authorized and protected.

IRS-controlled GenAI must include a user agreement and a problem/incident reporting mechanism.

Accuracy and Reliability: LLMs may sometimes produce inaccurate or misleading information. LLMs can also produce what are called "hallucinations." Hallucinations result when output appears coherent and plausible, but does not reflect factual data. Always critically evaluate LLM outputs and verify information from reliable sources.

Transparency and Disclosure: When using LLMs to generate content, be transparent about their involvement. As appropriate, disclose that the content was created with the assistance of an LLM and how AI was used (e.g. drafting, editing, etc.).

Variability in Responses: LLMs may generate different responses to the same prompt if asked more than once. This variability is a normal part of their function, as their output is based upon the probability of the next token as output. Experiment with different prompts and parameters to achieve desired results.

Over-reliance: Avoid becoming overly reliant on LLMs. Use LLMs as tools to assist and augment your work, not replace your own critical thinking and judgment.

Consult PGLD at *Privacy for guidance on requirements for use of data in GenAI contexts, including publicly-available, synthetic, simulated, or anonymized data.