Algorithmic Accountability and Faceless Tax Administration in Pakistan.

Rais Nouman Ahmed Guest Columnists, New LawsNo comments

Abstract

Pakistan’s tax management is shifting from manual analysis to algorithms. The Inland Revenue Information System (IRIS) of the Federal Board of Revenue (FBR), created by Pakistan Revenue Automation Limited (PRAL), has transformed from being just a filing portal. Under the new Finance Act of 2026, tax jurisdictions can be assigned to individuals based on algorithms created by the Board, without needing to know the officer’s name, and allowing for the resolution of tax disputes through a generated system offer in just ten days. The statement above argues that Pakistan audits its taxpayers but does not audit the algorithms that select them. Existing remedies, including appeals, the Federal Tax Ombudsman and constitutional petitions, test the decision and not the system behind it. Drawing on the EU’s GDPR and AI Act, the SCHUFA judgment, the Dutch childcare benefits scandal and Indian faceless assessment case law, the article proposes a model of auditable faceless administration built on human responsibility, independent audit, explainability and effective redress.

Keywords: algorithmic accountability, automated decision-making, IRIS, PRAL, faceless assessment, explainability.

1. Introduction

In Pakistan, the taxpayer once dealt with a tax office and a tax officer. Today he deals with a screen. FBR launched IRIS 2.0 in July 2023 as a system developed by PRAL, admitting that earlier versions faced performance problems and needed costly hardware at peak loads.[i][1] IRIS is now becoming more than a filing portal. On 28 August 2026 the Prime Minister was told that international consultants had been hired to design IRIS 3.0, with plans to pilot auto-taxation and later use artificial intelligence and machine learning.[2] The World Bank project funding FBR’s modernisation had already expected data mining tools to identify non-compliant taxpayers.[3] If software only helps a person file a form, the concern is efficiency. If it helps decide who will be audited, the concern becomes administrative justice.

2. PRAL and the Question of Responsibility

PRAL is a private limited company fully owned by FBR. Taxpayers file returns and pay taxes through its system, which holds the record of all tax transactions.[4] In August 2025 the Prime Minister reportedly ordered PRAL’s abolition within six months.[4] PRAL was not abolished. In August 2026 he was briefed on its restructuring and new senior appointments.[2] FBR has also attached Inland Revenue officers to PRAL as domain officers with direct access to its data.[5] The line between the tax authority and its technology provider is becoming thin. The legal question is who answers in law when a PRAL-run system contributes to a decision against a taxpayer. It cannot be the software. An algorithm does not become a legal decision-maker because officers rely on it.

3. From Digital Filing to Algorithmic Administration

Audit selection in Pakistan is already automated. FBR moved from random ballot to a Risk Based Audit Management System, and now to a Compliance Risk Management (CRM) System. FBR calls CRM selection a “transparent, discretion free and automated process”.[6] Automation is not transparency. A process can be free of an officer’s discretion and still be closed to the taxpayer. What data is used? How is risk calculated? How often is the system wrong? Who reviews the system itself? Pakistan has not answered the last question. An audit of a taxpayer asks whether he obeyed the law. An audit of an algorithm asks whether the system that selected him is lawful, accurate and fair. Pakistan has machinery for the first and almost none for the second.

4. The Finance Act 2026: Faceless and Algorithmic by Law

The Finance Act 2026 moves the algorithm from practice into the statute. Four provisions of the Income Tax Ordinance 2001 matter.[7] Section 122E allows audits, assessments and rectifications to be made in a faceless manner for persons or cases specified by the Board. Any hearing must take place through e-hearing, and the officer’s identity, including facial and voice identity, must be kept confidential. Section 209B(1) goes further. Jurisdiction over a taxpayer is assigned to officers of the National Faceless Centre “through algorithms developed by the Board”. Section 227D(3) lets the Board design those algorithms. Neither provision sets criteria, requires publication, or provides for independent audit. Jurisdiction is a legal status, and it is now allocated by an unpublished algorithm. Section 209B(5) keeps the officer’s identity secret from the taxpayer and his representative. Section 209B(6) then provides that no order can be challenged “merely” because of lack of jurisdiction under section 209, lack of notified delegation under section 210, or the secrecy of the officer’s identity. The word “merely” keeps challenges for mala fides alive in theory. In practice, bias cannot be proved against a person whose name is unknown. Section 134B is sharper still. A system generates a settlement offer based on compliance history, the nature of the discrepancy and “any other basis the Board may consider relevant”. The taxpayer has ten days to accept. On acceptance the issues “stand abated”. No assessment order is passed, so nothing remains to appeal. The law gives no right to know how the offer was calculated. There is one real safeguard. Section 227D(5) requires audit, assessment and quality control in a case to be done by separate officers. But three officers who never question the first algorithmic selection add little.

5. The Data Security Record

An algorithm is only as reliable as the data it runs on. The security history of FBR’s systems is therefore part of the legal question. The Auditor-General, auditing PRAL’s accounts for 2020-21, reported that FBR applications including IRIS had been hacked, and that PRAL could not maintain an adequate and effective system despite reasonable funds.[8] In October 2025 the Prime Minister ordered an international forensic audit of PRAL’s system after a committee linked a sales-tax fraud beginning in 2018-19 to PRAL’s outdated infrastructure, weak monitoring and inadequate database protection. An audit vault, a database protection wall and real-time monitoring were then announced.[9] This record does not prove that the whole IRIS database was leaked. That claim would go beyond the evidence. What it does show is that the data feeding FBR’s risk systems have been open to manipulation. A model that runs on altered data can produce wrong results even when the model itself works perfectly. An algorithmic audit must therefore examine the whole chain: data, model, risk score, human decision, and consequence for the taxpayer.

6. What the EU and India Teach

European Union. Article 22 of the GDPR prohibits an individual from being impacted by decisions based exclusively on automated processing.[10] In SCHUFA, the Court of Justice found that automated scoring can be categorized as one of the ways in which an automated process may influence the decision of another entity.[11] Therefore, a CRM score that, in practice, determines the audit of an entity is a decision and should not simply be viewed as a tool for making the decision. The EU AI Act does not clarify the situation either. Recital 59 states that the systems employed by tax and customs authorities in their administrative processes should not be considered high-risk systems but also acknowledges the difficulty of denying their results.[12] Thus, even the EU has a gap in this field.

The Dutch experience illustrates the importance of the presence of the gap. In December 2021, the Dutch Data Protection Authority imposed a fine of EUR 2.75 million on the Tax Administration for employing the nationality criterion in the risk assessment model applied in the classification of risks regarding children’s allowances.[13] The tax risk model may seem neutral in terms of its appearance; nevertheless, it may discriminate.

India. Section 144B of the Income Tax Act 1961 created faceless assessment. In Bharat Aluminium, the Delhi High Court read the word “may” as “must” and held that a personal hearing must be given on request. It also accepted that the officer’s identity can be masked during the hearing.[14] Anonymity and a real hearing can therefore live together. Behind this sits Puttaswamy, which made privacy a fundamental right and required state data use to be proportionate.[15]

7. Remedy?

A taxpayer can appeal to the Commissioner (Appeals), now possibly in faceless form under section 129A, then to the Appellate Tribunal and, on questions of law, the High Court. A writ under Article 199 remains for jurisdictional error and mala fides. The Federal Tax Ombudsman can act on maladministration, which includes a decision that is arbitrary, unreasonable, biased or discriminatory.[16] But section 9(2)(b) bars the FTO from matters of assessment where appeal, review or revision is available.[16] Each remedy tests the decision. None tests the system. No forum can order FBR to explain or audit the model that selected the taxpayer. It may act on its own motion, require any tax employee to produce documents free of secrecy obligations, and commission studies into the causes of injustice.[16] Whether these powers reach an audit-selection algorithm is untested. If they do, the FTO can stay an impugned order for sixty days and enforce its recommendations. Section 134B creates a sharper problem. Once an offer is accepted and the issues abate, there is no order to appeal.

8. Auditable Faceless Administration

Pakistan’s move towards digitalising tax is commendable. It needs rules for how it does so. The National AI Policy 2025 already promises a framework for third-party auditing of AI decision-making, with redress for unwarranted outcomes.[17] Tax is the obvious place to begin. Five steps would help:

  1. Publish, in rules laid before Parliament, the criteria used by the algorithms under sections 209B(1) and 227D(3).
  2. Require periodic independent audit of those algorithms for accuracy, bias, and data integrity.
  3. Give the taxpayer the main reasons for his selection and for any section 134B offer.
  4. Disclose the officer’s identity to the court, in camera, where bias is alleged.
  5. Require human review of every settlement offer and extend the ten-day window.

9. Conclusion

The point of concern is not functionality but the legality. The utilization of the software by the government employees is legal, auditable, and contestable according to the requirements stipulated in Articles 4, 10A, 14, 19A, and 25 of the Constitution.[18] The computer may streamline the work of the tax authorities, but it cannot assume legal liability. Although technology may change the way taxation is conducted, it must not change the principle that government obeys the law.

Refrences

  1. Federal Board of Revenue, ‘FBR Launches IRIS 2.0, Redefining User Experience & Efficiency’ (Press Release, 27 July 2023) https://urdu.fbr.gov.pk/pr/fbr-launches-iris-20-redefining-user-experien/173899/2023 accessed 27 September 2026.
  2. Radio Pakistan, ‘PM Directs Timely Implementation of Tax Reforms’ (28 August 2026) https://www.radio.gov.pk/28-08-2026/pm-directs-fbr-to-complete-reforms-process-in-tax-system-in-stipulated-time accessed 27 September 2026.
  3. World Bank, ‘Project Information Document: Pakistan Revenue Mobilization Project (P165982)’ (19 April 2019) https://documents1.worldbank.org/curated/en/637701556009042302/pdf/Project-Information-Document-Pakistan-Revenue-Mobilization-Project-P165982.pdf accessed 27 September 2026.
  4. Shahbaz Rana, ‘PM Orders PRAL Closure in 6 Months’ The Express Tribune (Islamabad, 6 August 2025) https://tribune.com.pk/story/2559873/pm-orders-pral-closure-in-6-months accessed 27 September 2026.
  5. ‘500 Bugs Detected in 2026 FBR Tax Return Form’ ProPakistani (13 August 2026) https://propakistani.pk/2026/08/13/500-bugs-detected-in-2026-fbr-tax-return-form/ accessed 27 September 2026.
  6. Federal Board of Revenue, ‘Taxpayers Audit’ https://fbr.gov.pk/legal/142254/131272 accessed 27 September 2026.
  7. Income Tax Ordinance 2001, ss 122E, 134B, 209B and 227D, inserted or substituted by the Finance Act 2026 (Act XLIII of 2026), Gazette of Pakistan, Extraordinary, Part I, 26 June 2026; see also Federal Board of Revenue, Circular No 02 of 2026-27 (8 September 2026).
  8. ‘Auditor General Orders FBR to Explain Why It Got Hacked’ ProPakistani (15 October 2022) https://propakistani.pk/2022/10/15/auditor-general-orders-fbr-to-explain-why-it-got-hacked/ accessed 27 September 2026, reporting the Auditor-General’s audit of PRAL’s accounts for FY 2020-21.
  9. ‘Pakistan PM Orders Forensic Audit after Sales-Tax Fraud in Revenue System’ Arab News Pakistan (Islamabad, 30 October 2025) https://www.arabnews.pk/pakistan/pakistan-pm-orders-forensic-audit-after-sales-tax-fraud-in-revenue-system-2620887 accessed 27 September 2026.
  10. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) [2016] OJ L119/1, art 22.
  11. Case C-634/21 OQ v Land Hessen (SCHUFA Holding) EU:C:2023:957.
  12. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L2024/1689, recital 59.
  13. ‘Tax Office Fined €2.75 Million for Privacy Violations in Benefits Scandal’ NL Times (8 December 2021) https://nltimes.nl/node/55903; ‘AP legt boete op voor misstanden Belastingdienst/Toeslagen’ Taxence (8 December 2021) https://www.taxence.nl/?p=103794 both accessed 27 September 2026.
  1. Bharat Aluminium Co Ltd v Union of India (2022) 442 ITR 101 (Del HC).
  2. Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.
  3. 1. Establishment of the Office of Federal Tax Ombudsman Ordinance 2000 (Ordinance XXXV of 2000), ss 2(3), 9(1), 9(2)(b), 9(4), 10(9), 11 and 32; the Income Tax Ordinance 2001 was added to its “Relevant Legislation” by SRO 966(I)/2011 (7 October 2011); Federal Ombudsmen Institutional Reforms Act 2013 (Act XIV of 2013), ss 10, 11, 14 and 24.
  4. Ministry of Information Technology and Telecommunication, National Artificial Intelligence Policy 2025 (Government of Pakistan 2025).
  5. Constitution of the Islamic Republic of Pakistan 1973, arts 4, 10A, 14, 19A and 2

Rais Nouman Ahmed

Author: Rais Nouman Ahmed

Rais Nouman Ahmed is an Assistant Professor of Law at Gillani Law College, Bahauddin Zakariya University, Multan. He holds a PhD in artificial intelligence regulation and an LLM from Staffordshire University, UK, and has taught law since 2013. His research covers constitutional law, digital governance and AI regulation. He is regarded as Pakistan’s first domestically trained doctoral specialist in AI regulation. His publications include a Routledge book chapter and HEC-recognised journal articles on AI regulation and on Pakistan’s digital and criminal law.

Leave a Reply

*

This site uses Akismet to reduce spam. Learn how your comment data is processed.