For several years now, the DGFiP has stepped up its use of datamining and artificial intelligence in the programming of tax audits. The CFVR system (Ciblage de la Fraude et Valorisation des Requêtes), in service since 2014 and continuously improved, cross-references tax-return, banking, land-registry and economic data to identify anomalies and direct audits towards the highest-risk profiles. Law no. 2019-1479 of 28 December 2019 authorised, on an experimental basis, the automated collection of data from public online platforms (social networks, sales websites). This automation is transforming audit practice: algorithmic transparency towards the audited taxpayer remains an open debate among commentators, but analysing the objective indicia in the file (the nature of the requests, the documents sought) often makes it possible to identify the line of attack and better prepare the defence.
The use of artificial intelligence and datamining by the DGFiP is now well established. The CFVR system (Ciblage de la Fraude et Valorisation des Requêtes) makes it possible to cross-reference on a massive scale the data available to the tax authorities (income-tax, corporate-tax and VAT returns, the land registry, household tax data, banking data via FICOBA, international automatic exchanges under DAC/CRS, URSSAF data) and to identify statistical anomalies or inconsistent profiles.
The law of 28 December 2019 (article 154) authorised, on an experimental basis for 3 years (since extended), the automated collection of public data from online platforms (social networks, sales websites, collaborative platforms). This collection specifically targets the fight against undeclared (hidden) activity, false declarations of residence, and conspicuous discrepancies between declared income and the lifestyle on display.
The consequence for the audited taxpayer: the programming of audits is now largely algorithmic, even though the investigation itself remains human. The question of the transparency of the targeting towards the taxpayer remains an open debate among commentators; no statute requires the tax authorities to disclose the precise indicators that triggered the audit. In practice, analysing the objective elements of the file (the nature of the first request, the documents sought) often makes it possible to identify the lines of investigation and calibrate the documentation to be produced.
The CFVR identifies the taxpayers to be audited by cross-referencing massive datasets. The consequence: an audit no longer arrives "by chance"; it is preceded by an algorithmic analysis that has detected an anomaly or a discrepancy. Understanding the nature of that anomaly makes it possible to prepare a targeted defence.
Since the law of 28 December 2019, art. 154, the DGFiP may automatically collect public data from online platforms (Facebook, Instagram, LinkedIn, sales websites). The targets: conspicuous photos at odds with declared income (outward signs of wealth), regular sales listings (undeclared activity), a location that contradicts a claimed foreign tax residence.
The DAC directive (European Union) and the CRS standard (OECD Common Reporting Standard) require the automatic exchange of banking information between tax administrations. The consequence: the balances and income of foreign accounts are now known to the French tax authorities, which makes non-disclosure extremely risky. On the interaction with the obligation under art. 1649 A, see our dedicated analysis.
Three lines of action: (1) identify the indicator that triggered the audit (often visible in the tax authorities' first request); (2) prepare targeted documentation on that indicator (supporting evidence, explanations); (3) build a coherent narrative that puts into context the isolated elements the algorithm has extracted. An overly generic response misses the point.
The use of AI in tax audits is supervised by the CNIL and governed by GDPR principles: purpose limitation, proportionality, retention periods, right of access to data. A taxpayer may challenge an audit based on data collected in breach of these principles, a potential line of defence, though one to be handled with caution. The Conseil d'État has regularly clarified the limits of these systems.
The firm assists taxpayers under audit by analysing the algorithmic logic of the targeting: which indicator triggered the audit? How consistent is the algorithmic analysis? The defence is built on the precise identification of the tax authorities' points of attention and the production of targeted documentation.
For high-stakes audits (significant estates, company directors, international transactions), analysing the algorithmic logic makes it possible to anticipate the subsequent lines of the audit and to put forward a coherent narrative that contextualises the isolated elements.
Yes, and they have for several years. The DGFiP's CFVR system (Ciblage de la Fraude et Valorisation des Requêtes) cross-references the available data on a massive scale (tax returns, FICOBA, DAC, CRS, the land registry, URSSAF) to identify the taxpayers to be audited. The programming of audits is now largely algorithmic, even though the investigation itself remains human.
Yes, since 2019, and under supervised conditions. Law no. 2019-1479 of 28 December 2019 (article 154) authorised, on an experimental basis, the automated collection of public data from online platforms. The collection covers only freely accessible data (public profiles, listings) and is strictly supervised (CNIL, GDPR). Private content and messaging services remain out of reach. But conspicuous photos on Instagram, or regular listings on Leboncoin, can attract the attention of the tax authorities.
The tax authorities are not required to disclose the precise reason for the targeting. But clues are often visible: (a) the tax authorities' first request often targets the anomaly that was detected; (b) the nature of the documents requested points to the subject of investigation; (c) a right of access to data may be exercised through the CNIL to understand the logic of the processing. Analysing these clues shapes the defence strategy.
For taxpayers holding undeclared foreign accounts, yes. The DAC directive (EU) and the CRS standard (OECD) require the automatic exchange of banking information: 31 December balances, income, beneficial owners. The consequence: what was once invisible is now known. Voluntary disclosure before any audit remains the most protective option; see our analysis on voluntary disclosure.
Yes, under certain conditions. The possible angles: (1) breach of the GDPR (collection of non-public data, disproportionate purpose); (2) rights of the defence (refusal of access to the indicators that triggered the audit); (3) potential algorithmic discrimination. These angles are delicate to handle, but they can reinforce a conventional defence on the merits.
Three preventive lines of action: (1) consistency of the declared position: avoid discrepancies between declared income, visible lifestyle and assets held; (2) proactive documentation of at-risk transactions (supporting evidence, mandates, agreements, invoices); (3) transparency on international elements (foreign accounts, real estate, holding companies). A preventive tax audit identifies points of weakness before they are detected.
A simulated tax audit conducted by a lawyer, before the tax authorities act: a quantified report, covered by legal professional privilege.
Voir la page Tax auditsGeneral audit procedure, reassessment and defence.
Voir la page Tax auditsThe importance of the provisions relied on in the defence.
Voir la page Foreign accountsVoluntary disclosure to limit penalties.
Voir la page Property dealerExtended reassessment period in the event of undeclared activity.
Voir la pageA confidential initial discussion to analyse the logic of the audit, identify the indicators that attracted attention and organise the defence.
© BENSAID Avocats — The information on this site does not constitute legal advice and is no substitute for personalised tax analysis.