If you filed your income tax return for Tax Year 2026, you may soon hear from the Federal Board of Revenue's computer before you ever hear from a human officer. In October 2026, the FBR drafted proposed Rule 38-B of the Income Tax Rules, 2002, to authorise automated, AI-assisted scrutiny of individual tax returns — checking each return for factual and legal errors before any penal action is taken. With the Tax Year 2026 filing deadline extended to 31 October 2026 (Circular No. 04 of 2026-27, described as a final extension) and about 6.9 million returns filed by mid-October 2026, this new system could touch millions of filers. This guide explains, in plain language, how the proposed rule works, what a "flag" from the system actually means, the common mismatches that trigger it, what you should do if your return is flagged, and what rights you keep throughout the process.
Background: why the FBR is moving to AI scrutiny
Pakistan's tax system runs on self-assessment. You prepare your own return, declare your income, claim your deductions and credits, and file it through the FBR's IRIS portal. In theory the tax department then trusts your return — but in practice it has long cross-checked declared figures against other information it holds: bank statements, salary payments reported by employers, property transactions recorded with registrars, vehicle purchases, travel records, utility bills and more. When the numbers do not line up, the department opens the return for audit or makes an amended assessment, often years later.
The problem with the old approach is scale. Millions of returns are filed every year, and a human officer can only examine a fraction of them. Many errors — and many cases of under-reporting — were therefore caught late or never at all, while honest taxpayers who made small mistakes could be pulled into long, stressful audit proceedings without any early chance to correct themselves.
Proposed Rule 38-B is the FBR's answer. Instead of waiting months or years for a human to select your return for audit, an automated system would scan returns soon after filing, compare declared data with the department's other records, and flag discrepancies to the taxpayer directly through IRIS. The design emphasis, according to the draft rules, is on correction before punishment: the taxpayer is told what looks wrong and given time to fix it, upload supporting records, or explain — before any formal assessment or penal action begins.
It is important to be clear about the status of this measure. As of mid-to-late October 2026, Rule 38-B is a draft rule — the FBR has prepared it, but it must go through the usual process of finalisation before it becomes fully operational law. The outline that follows is based on what the draft describes. Details may change if the final version differs from the draft.
How the AI check works, step by step
Here is the process as the draft rules describe it, in the order a taxpayer would experience it:
Step 1 — Filing and automated matching. You file your return through IRIS as usual. The automated system then runs your declared figures against data the tax authorities hold from other sources. This is sometimes called cross-matching or data-matching: for example, the income you declared is compared with bank credits, the salary your employer reported on your behalf is compared with what you declared, property purchases or sales recorded with the registrar are compared with your declared assets, and so on.
Step 2 — A discrepancy is flagged. If the system finds a mismatch — something in your return does not line up with the other records — it raises a flag on your return. The draft rules describe this as identifying "factual and legal errors." A factual error might be a figure that contradicts another record (declared income of Rs. 1.2 million against bank deposits of Rs. 3.5 million, for instance); a legal error might be a deduction or credit claimed in a way the law does not allow. The flag is raised in the system and communicated to the taxpayer through IRIS — in practical terms, expect a notice or alert inside your IRIS inbox/dashboard, and possibly an SMS or email alert tied to your registered contact details.
Step 3 — You get at least 7 days to respond. This is the heart of the design. Once flagged, the taxpayer is given a minimum of seven days to rectify the errors, upload the relevant records, or submit a clarification online through IRIS. This is not a court hearing and not a penalty notice — it is a chance to correct the record. If the mismatch has an innocent explanation (a transfer between your own accounts counted twice, a loan wrongly picked up as income, a figure typed incorrectly), this is where you explain it and upload the proof.
Step 4 — A missed deadline triggers another reminder. If you do not respond within the first period, the system sends an automated reminder, and you get another window of at least seven more days. The two-stage reminder structure suggests the FBR wants to be sure that silence is really silence — not a missed message — before anything more serious happens.
Step 5 — Human review by a designated officer. Here is the critical safeguard. The automated system does not decide your tax liability. Under the draft, Inland Revenue officers retain jurisdiction: a designated officer reviews the system's findings together with whatever explanation and records you provided, and only then decides whether to initiate a formal assessment under the Income Tax Ordinance, 2001. In other words, a machine flags; a human officer decides.
Step 6 — Formal proceedings, if warranted. If the officer is satisfied that the discrepancy points to a real understatement of income or tax, the normal assessment machinery of the Ordinance applies — notices under the relevant sections, an opportunity of being heard, and so on. The AI flag is the beginning of the conversation, not the end of it.
What a flag means — and what it does NOT mean
A flag from the automated system means one thing: the computer noticed something that does not match, and it wants you to look at it. That is all. It does not mean you have committed tax fraud. It does not mean a penalty has been imposed. It does not mean your return has been rejected or that you are under criminal investigation.
In particular, the draft rules' structure makes clear that AI flagging does not equal automatic penalty. There is a deliberate gap — the response windows and the designated officer's review — between a flag and any formal action. Penal provisions under the Income Tax Ordinance only come into play through the ordinary statutory process, with its own notices, hearings and appeal rights.
This distinction matters because a flagged notice can feel alarming. Data-matching is blunt: it compares numbers, not context. A large bank deposit might be a loan repayment from a relative, not income. A property in your name might have been bought with a declared gift. The system cannot know these things — it can only ask. Your job, if flagged, is to supply the context the system lacks.
Common mismatches that trigger flags
Based on the kinds of cross-checks tax authorities routinely run, these are the discrepancies most likely to draw a flag under an automated system. None of this is a finding of wrongdoing — each is simply a pattern that data-matching tends to catch:
Bank transactions vs. declared income. The most common flag source. If your bank accounts show total credits or a lifestyle of spending far above your declared income, the system will notice. Typical innocent explanations: loans from family, transfers between your own accounts (which look like deposits on both sides), sale proceeds of an asset you already owned, or agricultural/other exempt income that was never properly documented.
Property transactions. Purchases or sales of plots, houses or commercial property registered in your name are recorded with the registrar and visible to the FBR. A property purchase with no corresponding declared source of funds is a classic flag. So is declaring a property sale price well below the documented transaction value.
Salary vs. declared income. Employers report salaries to the FBR (through withholding statements). If your employer reported paying you Rs. 2.4 million but your return declares Rs. 1.8 million of salary income, the mismatch is automatic. This also applies to benefits and bonuses your employer reported.
Withholding tax credits claimed vs. actual. If you claimed withholding tax credits (on bank profits, mobile phone bills, vehicle tokens, property transactions, contracts) that do not match the withholding statements filed by the deducting agents, the system can spot the difference.
Non-filer history and new filers. People who filed for the first time after appearing in the FBR's data for years — owning a car, travelling abroad, holding property — may find their first return scrutinised for whether declared wealth matches accumulated assets.
Expense and deduction claims. Business expenses claimed without corresponding records, or personal expenses routed through a business return, are the kind of "legal errors" automated legal-rule checks are designed to catch.
Agricultural income and exemptions. These are legitimate and often untaxed, but they need to be documented. A large unexplained deposit simply labelled "agriculture" without supporting records is likely to be questioned.
What to do if your return is flagged
Treat a flag as a to-do item, not a crisis. Work through it in this order:
1. Read the flag carefully. Log in to IRIS and read the full notice. Identify exactly which figures or transactions are being questioned — the period, the amounts, and the source records the system matched against. Do not guess; match the flag to your own records line by line.
2. Do not ignore the deadline. You have at least seven days for the first response, and another reminder window after that. But responding early is always better. Ignoring the flag does not make it go away — it moves the file toward the officer's desk without your explanation attached, which is the worst position to be in.
3. Gather your records. Pull together everything that explains the flagged items: bank statements showing the nature of deposits (loan agreements, gift deeds, transfer slips between your own accounts), salary slips and employer certificates, property purchase/sale documents with payment trails, business books and invoices, and evidence for any exemption or deduction claimed. Scan or photograph them clearly — IRIS uploads need to be legible.
4. Rectify genuine errors. If the flag caught a real mistake — a transposed figure, an income head filled in the wrong column, a credit claimed twice — correct it. The draft rules expressly allow rectification of errors during the response window. Fixing an honest mistake early is exactly what the system is designed to encourage.
5. Upload records and write a clear clarification. If the figures are correct but the system misread the context, explain it plainly and upload the proof. Write in short, numbered paragraphs: state what the item is, why it appears the way it does, and which attached document proves it. Assume the reader is a busy officer who has never seen your file before.
6. Keep a copy of everything. Save your submitted response, the flag notice, and every uploaded document. If the matter proceeds to formal assessment, this paper trail shows you engaged honestly and promptly.
7. Consider professional help early. If the flagged amounts are large, or if the mismatch involves complex transactions, have a tax consultant or advocate review your response before you submit it. A well-framed clarification at the flag stage can prevent a full assessment proceeding later.
Deadlines and the extended filing date
Two timelines run in parallel and should not be confused:
The filing deadline. For Tax Year 2026, the FBR extended the return filing deadline to 31 October 2026 through Circular No. 04 of 2026-27, and indicated this would be the final extension. If you have not filed yet, that date is your hard stop. Filing late attracts its own consequences under the Ordinance — separate from anything Rule 38-B does.
The flag-response deadlines. Under the draft, a flagged taxpayer gets a minimum of seven days to respond, and if that passes without a response, an automated reminder and another window of at least seven days. "At least" is doing work here — the FBR could allow longer, and individual notices will state the actual date. Treat the date on your notice as the real deadline, not the minimum in the rule.
A practical point: the filing rush matters. Around 6.9 million returns had been filed by mid-October 2026, with the usual last-week surge still to come. Returns filed at the very end of the window may be processed through the automated system in the same way — there is no indication that filing early or late changes whether you get flagged, but filing early does give you breathing room to handle any flag before other year-end matters pile up.
Your rights and officer oversight
The draft rules build in several protections that are worth knowing explicitly, because they are what separate a data-matching exercise from an arbitrary one:
A human officer, not the machine, decides. The designated Inland Revenue officer reviews the system's findings and your explanation before deciding whether to start a formal assessment. The AI proposes; the officer disposes. If your explanation resolves the mismatch, the matter can end there.
Correction before punishment. The two response windows exist precisely so that errors can be rectified and explanations heard before any penal step. No penalty under the Income Tax Ordinance can be imposed without the statutory process — show-cause notices, an opportunity of being heard, and written orders.
The right to be heard and to appeal. If the officer does proceed with an assessment you disagree with, the ordinary rights under the Ordinance apply: you can contest the assessment, file appeals to the Commissioner (Appeals) and the Appellate Tribunal, and so on. The flag does not reduce any of these rights.
Keep the department's communications. Every notice, reminder and order creates the record of whether you were given a fair opportunity. If a notice ever claims you were informed and you were not, your IRIS inbox and registered contact details are the evidence either way — check your IRIS inbox regularly during this period, and make sure your registered mobile number and email are current.
One caution: the draft is a proposal. Until Rule 38-B is finalised and notified, the exact mechanics — who the designated officer is, how the IRIS alerts will look, whether the minimum periods stay at seven days — could change. Watch for the final notification, and treat guidance from a qualified tax professional as your anchor for anything fact-specific.
Frequently Asked Questions
Q: If the AI flags my return, does it mean I will be penalised? A: A: No. A flag is an alert, not a penalty. The draft rules give you at least seven days to rectify errors or upload an explanation, and a designated officer must review the findings before any formal assessment begins. Penalties can only follow the normal statutory process under the Income Tax Ordinance, 2001.
Q: What happens if I miss the 7-day response window? A: A: The system sends an automated reminder with another window of at least seven days. But do not rely on the reminder — responding within the first window is safer, and ignoring the flag entirely pushes your file toward the officer without your side of the story.
Q: I already filed my Tax Year 2026 return. Can the AI system still flag it? A: A: The draft rules contemplate automated scrutiny of filed returns, so yes — filing early does not exempt a return. The extension to 31 October 2026 only concerns the filing deadline, not the scrutiny process.
Q: What documents should I keep ready in case my return is flagged? A: A: Bank statements for the tax year, salary slips or employer certificates, property transaction documents with payment trails, business records and invoices, loan agreements and gift deeds for large deposits, and evidence supporting any deduction, credit or exemption you claimed. Keep them for at least the period the law requires — and practically, well beyond.
Q: Can I correct a genuine mistake after my return is flagged? A: A: Yes. The draft rules expressly provide for rectification of errors during the response window. If the flag caught an honest mistake — a wrong figure, a misfiled head of income — correct it promptly and keep proof of the correction.
Q: Does the automated system replace the tax officer? A: A: No. Under the draft, Inland Revenue officers keep jurisdiction. A designated officer reviews the automated findings plus your explanation and decides whether formal assessment proceedings under the Income Tax Ordinance are warranted. The machine flags; a human decides.
The Bottom Line
This article provides general legal information for readers in Pakistan and is not legal advice. For advice about your own situation, consult a qualified advocate.