Multi-Agent Tax Advisory That Can't Be Manipulated.... aitaxadvise.com

Joe Wee · 2026-04-07

AI tax advice is already wrong half the time

The Washington Post tested TurboTax's "Intuit Assist" and H&R Block's "AI Tax Assist" with two tax experts and found the chatbots gave "misleading and inaccurate information" up to 50% of the time on moderately complex scenarios [1]. The IRS Taxpayer Advocate Service confirmed: AI chatbots from leading tax prep firms provided "inaccurate or irrelevant responses up to 50 percent of the time" and "may encounter difficulties interpreting complex tax laws correctly" [2].

In the UK, Mr. Zzaman used AI to prepare his defence in a tax tribunal appeal. The AI-generated submission referenced real cases that were legally irrelevant. The tribunal judge dismissed the appeal and warned about AI reliance, noting the tool "may not fully understand the question being asked" [3]. Goyal documented AI incorrectly claiming FBAR filing exceptions and falsely stating the US had totalization agreements with Ecuador and Costa Rica (none exist) [4].

Dahl et al. found LLMs hallucinate at least 58% of the time in legal queries and "often uncritically accept users' incorrect legal assumptions" [5]. Nay et al.'s study in Philosophical Transactions found GPT-4 achieves "high levels of accuracy but not yet at expert tax lawyer levels" even with optimal prompting [6].

These are hallucination problems. The prompt injection problem is worse.

When users manipulate the advisor

The NCSC warned that prompt injection "may be a problem that is never fully fixed" because LLMs don't enforce separation between instructions and data [7]. Lee et al.'s study in JAMA Network Open found a 94.4% attack success rate on medical advisory LLMs, with manipulated recommendations persisting in 69.4% of follow-up exchanges [8]. OWASP ranks prompt injection as LLM01 - the #1 vulnerability [9].

For tax advisory, the attack scenario is specific: a user crafts queries that gradually convince an expert to drop compliance disclaimers and present tax evasion strategies as "legitimate planning." The EU AI Act classifies AI systems that exploit user vulnerabilities as potentially prohibited under Article 5 [10]. The SEC has already fined firms $400,000 for "AI washing" - making false claims about AI capabilities in advisory services [11].

The product

AITaxAdvise is a multi-jurisdiction AI tax advisory platform. Users describe tax situations in natural language. A Tyga Orchestrator classifies the query, routes it to domain experts, and merges their responses. The system operates across 10 jurisdictions (UK, US, UAE, Singapore, Malta, France, Germany, Italy, Spain, Ireland) in 5 languages.

9 domain experts

ExpertDomainJurisdictions
Income TaxPAYE, freelance, rental, salaryUK, US, UAE, SG, MT, FR, DE, IT, ES
Capital GainsCGT, property, shares, disposalUK, US
Crypto TaxBitcoin, DeFi, staking, NFTsUK, US, UAE
VAT / Sales TaxRegistration, returns, exemptionsUK, US
Corporate TaxCompany, dividends, R&D creditsUK, US, IE, MT, FR, DE, IT, ES
Expat TaxResidency, DTAs, remittance, FBARUK, US, UAE, SG, MT, FR, DE, IT, ES
Estate / IHTInheritance, gifts, trustsUK, US
Pension Tax401k, IRA, SIPP, drawdownUK, US
Property TaxSDLT, stamp duty, ATED, FIRPTAUK, US

Routing ensures experts are only invoked for matching domains and jurisdictions. This scoping is critical given the complexity Wolters Kluwer documents: nexus determination alone involves property, payroll, temporary service presence, leased assets, and remote activities - each potentially triggering filing obligations [12].

The 8-step pipeline

  1. Classify - LLM call to identify domains, jurisdictions, and entities. Fallback: keyword regex matching.
  2. Semantic cache check - SHA-256 hash of sorted domains|jurisdictions|entities. Semantically identical queries produce the same key. Hit = 0 LLM calls, ~1.2s latency.
  3. Route - Match classification to expert agents. Typically 1-3 experts per query.
  4. Temporal resolve + compress - Load applicable rules from 247 structured tax rules. Temporal resolver filters by query date. Upcoming changes within 365 days surfaced as warnings. Rules compressed using Tyga Encoder notation (~50% token reduction).
  5. Call experts - Parallel LLM calls (your model, with fallback). Each expert receives: system prompt with role scope, compressed rules, temporal warnings, query, language instruction.
  6. Merge - If 2+ experts respond, a merge call consolidates into a single answer.
  7. Temporal warnings + disclaimer - Enforce mandatory disclaimer: "This is tax information for educational purposes only."
  8. Return + cache - Stream via SSE, cache (24h TTL), deduct credit, save to MongoDB.

The Big Four are doing this too

EY launched an agentic platform with NVIDIA AI featuring 150 specialised tax agents supporting 80,000 EY tax professionals [13]. KPMG's Workbench runs 50 AI assistants with nearly 1,000 more in development, and was the first to achieve BSI/ISO 42001 certification for AI Management Systems [14]. Bloomberg Tax reports that PwC targets managed services at 20-25% of global advisory revenues - "AI changed the economics" [15].

The difference: the Big Four have compliance teams, legal review, and professional indemnity insurance. A SaaS platform serving freelancers and small business owners has the same liability exposure with none of those buffers.

The viral sharing risk

AITaxAdvise has a viral sharing feature - permanent public URLs for shared advice. One manipulated conversation reaches thousands of viewers. This is the Mata v. Avianca pattern applied to tax: fabricated or manipulated advice that looks authoritative and spreads before anyone verifies it [16].

HMRC has set expectations for AI in tax software, and established a dedicated "landing zone to safely exploit" generative AI [17]. The IRS deployed Salesforce Agentforce with "a lot of guardrails" and explicit prohibition on making "final decisions" [18]. OpenAI's usage policy prohibits "tailored advice that requires a license, such as legal or medical advice, without appropriate involvement by a licensed professional" [19].

Where A2A Infrastructure fits

A /v1/evaluate call before step 1 catches prompt injection at the entry point. Custom ground rules for tax advisory block:

Gate 1 catches the obvious patterns. Gate 2 - a stateless LLM judge with zero conversation history (architectural isolation of the judge) - catches the sophisticated ones. The judge can't be gradually convinced because it has no memory of previous turns.

247 structured tax rules

The knowledge base is structured JSON - bands, rates, thresholds, allowances, deadlines, warnings, legislative sources, and temporal metadata (effective dates, supersession chains). The temporal resolver filters at query time and surfaces upcoming changes (e.g., "UK BADR rate changing April 2026"). Compressed notation reduces 610 characters of JSON to 291 characters (~50% reduction), keeping context windows manageable across multi-jurisdiction queries.

References

  1. Fowler, G. (2024). "I tested AI tax tools. They gave 'misleading and inaccurate' advice." Washington Post
  2. IRS Taxpayer Advocate Service (2024). "Is AI Generated Tax Advice Making the Grade?" IRS TAS
  3. Zzaman v HMRC [2025] UKFTT 00539 (TC). AI-generated submission with irrelevant case citations. Ross Martin
  4. Goyal, A. (2026). "Overreliance on AI for Tax Advice: A Cautionary Perspective." Tax Executive
  5. Dahl, M. et al. (2024). "Large Legal Fictions: Profiling Legal Hallucinations in LLMs." Journal of Legal Analysis 16:64-93. Stanford
  6. Nay, J. et al. (2024). "Large language models as tax attorneys." Philosophical Transactions A, 382(2270). PMC
  7. UK NCSC (2025). "Prompt injection is not SQL injection (it may be worse)." NCSC
  8. Lee, J. et al. (2025). "Vulnerability of LLMs to Prompt Injection When Providing Medical Advice." JAMA Network Open 8(12). 94.4% attack success rate. PMC
  9. OWASP Top 10 for LLM Applications (2025). LLM01: Prompt Injection. genai.owasp.org
  10. EU AI Act, Article 5: Prohibited AI Practices; Article 6: High-risk classification. artificialintelligenceact.eu
  11. SEC (2024). First AI-related enforcement actions: Delphia ($225K) and Global Predictions ($175K) for "AI washing." SEC
  12. Wolters Kluwer (2026). "Multi state tax complexity in 2026." Wolters Kluwer
  13. EY (2025). "EY.ai Agentic Platform with NVIDIA AI: 150 tax agents, 80,000 professionals." EY
  14. KPMG (2025). "KPMG Workbench: multi-agent AI platform. First BSI/ISO 42001 certification." KPMG
  15. Iacone, A. (2026). "Big Four Firms Embrace AI to Revamp Corporate Service Offerings." Bloomberg Tax
  16. Mata v. Avianca, Inc. (S.D.N.Y. 2023). Lawyer sanctioned $5,000 for citing fabricated AI-generated cases. Wikipedia
  17. HMRC (2026). Guidance for AI in tax software + gen AI "landing zone." ICAEW
  18. IRS deploys Salesforce Agentforce (2025). "A lot of guardrails," no "final decisions." Axios
  19. OpenAI Usage Policy (2025). Prohibits "tailored advice requiring a license." OpenAI
  20. Baysal, H. (2026). "Asimov Safety Architecture." IETF Internet-Draft
Help

Help

Need help? Here are some quick links: