The tax-preparation problem is being solved. Thomson Reuters auto-prepares 1040s, CCH Axcess Expert AI drafts advisory insights across thousands of firms, Blue J answers research questions. The verification problem is not, and it is the one that carries the penalty. When an AI misclassifies a deduction, the 20% IRC §6662 accuracy-related penalty applies to the human who signed the return, not the model that drafted it.
That asymmetry is the whole argument. A drafting tool optimizes for a fluent, plausible position. Nothing in that loop asks the harder question a signer is actually liable for: is this position defensible under the statute? We built StatuteGuard, a deterministic verification layer for AI-drafted tax positions, to answer exactly that question, and to answer it the same way every time. You can run a position through it at https://veriprajna.com/demos/tax-compliance-ai.
The failure mode is not bad grammar. It is confident misclassification.
The dangerous output of a tax model is not a typo. It is a well-written, confident sentence that puts a deduction on the wrong line. Take one the industry got wrong in public: the new OBBBA car-loan interest deduction (qualified passenger vehicle loan interest, QPVLI). Plenty of mainstream tax-prep guidance, H&R Block's own site included, labeled QPVLI "above the line," a deduction that reduces adjusted gross income.
It does not. QPVLI is a below-the-line deduction under §63(b)(7). It does not touch AGI. A model trained on the same public web that carried that error will reproduce the error, fluently, at high confidence.
Here is what that looks like going into the pipeline. The language model reads the drafted memo and proposes a structured claim: provision OBBBA_QPVLI, classification "above_the_line", affects_agi true, reported at 0.98 confidence.
The only LLM step. It extracts a checkable claim (classification "above_the_line", affects_agi true) at 0.98 confidence and reports it as advisory. It never renders the verdict.
That 0.98 is the trap. The model is not hedging. It is sure, and it is wrong. No LLM self-check fixes this reliably, because the check runs through the same weights that produced the claim. You cannot trust an LLM to police an LLM.
So the model does not get the vote. A deterministic policy engine (real OPA/Rego, or an identical pure-Python twin) does.
DO NOT FILE. The deterministic engine blocks the position (the "Rule vs statute" check fails, 5 µs, red), and the open Grounding panel traces the citation chain §163(h)(1) → §163(h)(4)(A) → §63(b)(7) → §62/§63 and flags the five downstream amounts a false AGI reduction would corrupt.
The verdict is BLOCK. Not because a bigger model outvoted a smaller one, but because a policy rule fired: §63(b)(7) places QPVLI below the line, so a claim that it reduces AGI contradicts the encoded statute. Then the engine does the part a drafting tool never does. It traces the citation chain through the IRC cross-reference graph, and it flags the five downstream amounts a false AGI reduction would corrupt if filed: AGI itself, AGI-coupled state income tax, Medicare IRMAA premiums, the 7.5% medical-expense floor, and student-loan income-driven repayment. One misplaced line, five wrong numbers.
Agent advises, code decides
The reason a verdict like that survives an examiner is that the deciding logic is not a prompt. It is readable policy code you can audit against the statute yourself.
The real, readable policy. §280A home-office requires regular AND exclusive use as the principal place of business; §30D caps MSRP at $55,000 (car) and $80,000 (SUV, truck, van), and modified AGI at $150,000 single, $225,000 HoH, $300,000 MFJ. Anything outside the encoded set returns OUT-OF-COVERAGE and routes to a human.
A drafting model can tell you what it thinks the answer is. It cannot prove to an examiner which statutory provision backed which position. A deterministic layer with readable policy code and a filable §6662 audit trail can.
That is the durable point, and it is worth sitting with, because it changes what "wait for the next model" is worth.
Why a better base model does not close this gap
The next model will draft better prose. It will not change who signs the return, and it will not produce a citation you can defend. Both of those live outside the model.
The properties that matter here belong to the verification layer, not to the model. On a 42-case labeled golden set of the encoded provisions, the engine resolves 71.4% of positions deterministically (PASS or BLOCK) and correctly escalates the rest, with 100% gate precision (zero false blocks) and 100% correct escalation of the genuine gray areas, and verdicts matching the labels across all 42 cases. It was cross-checked against OPA 1.17.1 and matched the pure-Python twin exactly.
The golden-set scoreboard: 71.4% deterministic coverage, 100% gate precision (0 false blocks), 100% error-catch completeness, 100% correct escalation, on the 42-case labeled set. Reproducible and evaluated locally.
Read those numbers precisely. They are not an open-world "100% accuracy" claim, and we would not make one. They describe how the layer behaves on a fixed, labeled set of the provisions it actually encodes. A model's error rate shrinks as the model improves. Coverage, gate precision, and a filable audit trail do not "improve away," because they are not model errors. They are the layer doing its job, or not. That is why a stronger base model is welcome upstream and beside the point downstream.
There is a legal dimension too. After the Heppner ruling (SDNY, February 2026) raised a privilege-waiver question over a public-AI-tool research query, where the verification runs starts to matter as much as whether it runs. StatuteGuard runs fully local with no API key by default, so no position or client data leaves the perimeter.
Honesty about the boundary is part of the design. StatuteGuard does not encode the full IRC and does not prepare returns. It encodes a specific set of provisions (OBBBA QPVLI, §199A, §163(j), §1031, §280A, §30D, and the §62/§63 AGI distinction). Everything outside that set returns OUT-OF-COVERAGE and goes to a human, on purpose. Coverage is 71.4%, and we say 71.4%.
We are more interested in comparing notes than in pitching, because this gap is industry-wide and the answers will be too. So one concrete question for anyone running AI in a tax or compliance workflow: once your model drafts a position, does anything deterministic re-check it against the encoded statute and produce a citation you could hand an examiner, or does the position ship on the model's confidence? If you want to watch a position get a verdict, a citation chain, and a §6662 record for yourself, it is at https://veriprajna.com/demos/tax-compliance-ai.