AI in Tax Compliance: Lessons from the GRC Function

Indirect tax teams rarely sit within corporate governance, risk, and compliance (GRC) groups, yet they share common traits with their fellow second-line-of-defense function from an AI-enablement perspective.

GRC and indirect tax groups have an absolute need to maintain compliance accuracy, which in turn requires heightened attention to master data management. The overarching need for data quality, and the potentially stiff penalties related to non-compliance, may explain why many GRC and indirect tax groups lag behind other parts of the organization – including operations, marketing, and customer service – in deploying AI solutions. This delay isn’t necessarily negative; it gives GRC and tax leaders the opportunity to be “smart second movers” in AI adoption.

As CFOs and indirect tax leaders consider how AI tools and functionality can strengthen tax compliance and tax planning, they can learn from how GRC groups are progressing on their AI journey.

In an article focused on “rethinking GRC in the age of AI,” IBM’s Amit Sharma argues that a traditional GRC approach – defined by spreadsheet-driven, periodic, reactive activities – cannot keep pace with AI-era risks, nor, for that matter with the accelerating pace of global regulatory change and continually evolving cyberthreats. This will sound familiar to readers of this blog: “Constant regulatory change, cross border activity, and the need for defensible outcomes create a growing burden for manual workflows,” writes Vertex Vice President of Technology Strategy Chris Zangrilli. “Thoughtfully applied AI offers a way to absorb that complexity by streamlining repetitive work and aligning data, decisions, and documentation across systems.”

Trustworthy AI Adoption

IBM’s Sharma also advocates for GRC functions to replace after-the-fact reviews with continuous monitoring, predictive analytics, and automated evidence-gathering. Those activities can be performed with the help of solutions containing AI functionality. Unlike their indirect tax counterparts, many GRC groups are charged with overseeing AI across the organization and throughout third-party vendor ecosystems.

This governance role involves subjecting AI usage to accountability, explainability, bias controls, and model risk policies in ways that enable trustworthy AI adoption. To achieve these objectives, GRC professionals are replacing traditional box-ticking work with assessments of strategic exposure – a shift that requires higher levels of tech literacy and deeper cross-functional partnership. Indirect tax professionals are also strengthening their technological proficiency by staying informed about advances in AI, sharpening their ability to work effectively with AI systems (e.g., prompt engineering), and putting low-code, no-code, and vibe-coding tools through their paces.

The Real-Time Mandate(s)

Continuous monitoring represents one of the GRC function’s top AI-deployment focal points. AI tools and functionality can help organizations identify potential regulatory compliance risks, evolving third-party risks, and other governance shortcomings in real time, or close to it, as opposed to after the fact. This capability also has an indirect tax analog: complying with global e-invoicing rules requires indirect tax groups to review, validate, and share tax and transaction data with tax authorities in real time or near real time.  Traditional tools are likely not up that task at scale.

This parallel suggests that learning opportunities run both ways. The indirect tax team’s experience complying with e-invoicing rules may help GRC groups implement continuous monitoring and anomaly-detection capabilities. Tax can leverage the AI governance structures – accountability, explainability, bias controls, model policies and the like – GRC groups have developed rather than building those mechanisms from scratch. Operating as a smart second mover also requires cross-functional conversations: ask GRC counterparts what AI tools they’ve deployed, and what they would do differently.