The UK’s tax authority has handed roughly 28,000 employees access to Microsoft 365 Copilot and is preparing to switch on agentic-style AI features, a move that pushes generative AI deeper into one of the most sensitive administrative machines in the British state. The deployment follows a large government pilot that saved users an average of 26 minutes a day but also warned that generative AI struggles with complex, nuanced, and data-heavy work—exactly the kind of tasks that define tax administration. The rollout puts a spotlight on whether HMRC can govern AI fast enough to match its own ambition.

What actually happened

At the Think AI for Government event in London, HMRC’s chief AI officer James Mitton confirmed the department has issued around 28,000 Microsoft Copilot licenses. The tool is already available to staff across the tax authority and will soon gain agentic capabilities that allow it to coordinate steps, call internal services, and support more structured workflows. Mitton framed the ambition as making HMRC “the most AI-enabled tax authority on the planet,” signalling a shift from limited experiments to operational infrastructure.

The rollout builds on a cross-government trial run by the Government Digital Service in June 2025. Across 12 departments and 20,000 civil servants, participants reported saving an average of 26 minutes per day, with 82 percent saying they would not want to return to pre-Copilot workflows. The tool proved most effective at reducing friction: summarising long email threads, drafting meeting notes, turning rough bullet points into polished prose, and finding information buried inside Microsoft 365.

Yet the same evaluation highlighted clear limits. The report noted “limitations… when dealing with complex, nuanced, or data-heavy aspects of work” and flagged ongoing concerns about security and the handling of sensitive data. Those are not minor caveats for a department that handles taxpayer identities, confidential business filings, payment histories, compliance investigations, and legally sensitive case notes.

What it means for you

For taxpayers and businesses
The immediate rollout is internal, but its effects will eventually ripple outward. If Copilot helps caseworkers find current guidance faster, summarise complex histories more accurately, and reduce repetitive administrative work, citizens could see quicker, clearer service. The optimistic version is that routine correspondence gets answered more swiftly and explanations become more consistent.

The less optimistic version is that AI-generated text makes official communication more polished without improving the underlying decision. A taxpayer does not need a beautifully drafted wrong answer. HMRC must keep a bright line between AI-assisted administration and automated decision-making. Staff who use Copilot to draft correspondence remain accountable; if agents begin preparing case material, the department must be able to show—for audit and appeal—what sources were used, what was excluded, and where human judgment entered the process.

For civil servants
Copilot will sit inside Outlook, Teams, Word, Excel, SharePoint, and other Microsoft 365 apps that staff already use daily. The promise is that ambient AI assistance reduces small daily burdens. But the trial made clear that useful output depends heavily on user skill and organisational guidance. Reviewing AI-generated material is a different discipline from writing from scratch—fluent text can mask subtle errors, and staff will need strong verification habits. HMRC must invest in mandatory training that covers hallucinations, prompt hygiene, data handling, and when not to use the tool.

For IT and security teams
Microsoft’s enterprise pitch emphasises that Copilot respects existing Microsoft 365 permissions. That is important, but it is not the same as saying every permission in a large organisation is correct. If a SharePoint library is too broadly accessible, Copilot can make that overexposure more visible by retrieving and summarising information that a user could technically access but might never have found. In a tax authority, data that was theoretically available but practically buried may become operationally available in seconds. Governance is not a side concern; it is the product.

How we got here

HMRC has spent years trying to modernise one of the most complex administrative machines in the British state. The department collects tax, administers customs, runs compliance investigations, and answers millions of taxpayer interactions annually—often across a mixture of modern cloud services and legacy back-end systems. It has already claimed around £8 billion in benefits from earlier automation efforts used to close the tax gap, treating AI as an extension of existing number-crunching rather than a fundamental rethink.

The current push sits inside a broader government drive to make AI a normal part of public-sector work. Since 2024, Whitehall has moved from speculative pilots to an explicit “scan, pilot, scale” model, with departments encouraged to test commercial tools, gather evidence, and expand what works. The June 2025 trial provided the evidence base: 26 minutes saved per person per day, strong user satisfaction, and accessibility gains for staff who benefit from help structuring text. These numbers gave ministers and digital leaders a politically useful proof point.

Yet the trial also underlined that Copilot is a context amplifier, not a universal productivity engine. When the underlying information is clean, accessible, and appropriate, it helps. When the content environment is messy, over-permissioned, or contradictory—as is common in large, long-lived organisations—it can confidently surface outdated drafts, duplicated policy notes, or conflicting guidance. The department’s legacy technology problem does not disappear just because a conversational AI layer sits on top.

What to do now

HMRC’s deployment offers practical lessons for any organisation—public or private—considering a large-scale Copilot rollout inside a sensitive information estate.

Immediate steps for HMRC (and organisations like it)
- Publish clear AI usage policies that differentiate between low-risk personal productivity tasks and high-risk operational use involving taxpayer data, casework, or Official Sensitive material.
- Define agentic guardrails before turning on agentic features. Move through stages: personal productivity → team knowledge support → controlled workflow assistance → only then higher-assurance decision support, with each step requiring independent review and documented escalation paths.
- Require human review for all taxpayer-facing outputs. AI may draft, but a qualified staff member must verify sources, accuracy, and appropriateness.
- Establish transparent incident reporting. If AI-generated errors occur or data is surfaced inappropriately, the department should disclose (to auditors, Parliament, or data protection specialists) what happened and how it is being fixed.

Actionable checklist for IT and compliance teams
1. Audit SharePoint and Teams permissions. Run a permission hygiene review before Copilot reaches wide deployment. Close broad “everyone” groups; archive stale collaboration spaces; enforce least privilege.
2. Apply and enforce sensitivity labels consistently. Labels must reflect data classification and be automatically applied where possible. Copilot can respect labels only if they exist.
3. Configure Microsoft Purview audit logs and data loss prevention policies to capture AI interactions without creating a surveillance culture.
4. Define role-based AI policies aligned to job function and data sensitivity. Not every user needs the same Copilot scope.
5. Deliver mandatory training that covers hallucinations, prompt engineering, when not to use AI, and how to recognise over-reliance.
6. Create an AI incident response plan that covers data exposure, biased or misleading outputs, and user complaints.
7. Designate data owners accountable for stale, duplicated, or overexposed content that Copilot might retrieve.

The bottom line: Copilot readiness begins with information hygiene, not prompt-writing workshops. A fast search tool pointed at a poorly governed document estate is a risk amplifier.

Outlook

The next phase will reveal whether HMRC is treating Copilot as a controlled productivity tool or as the first layer of a deeper operational AI platform. Watch for whether the department publishes specific boundaries for use with sensitive data, and whether agentic features arrive with independent assurance or on the back of vendor enthusiasm. If HMRC demonstrates that Copilot can be deployed safely at scale in a high-stakes public body, Microsoft gains a powerful reference case. If problems emerge—over-permissioned data surfaced to the wrong authorised user, misleading AI-generated summaries that influence decisions—the rollout may become a cautionary tale for every enterprise rushing to put generative AI inside its document estate. The real achievement will not be handing out 28,000 licenses; it will be proving that AI can support tax administration without weakening accuracy, accountability, or public trust.