AI-driven Fraud Detection and Digital Reporting Requirements: A Path Towards Reducing Europe’s VAT Gap? (Part 1)

2.3.1 Reverse charge and quick reaction mechanisms

At the EU-level, the most notable countermeasure is arguably the adoption of rules that permit Member States to impose reverse-charge mechanisms (or suspension of tax) in specific sectors or transactions particularly sensitive to VAT fraud, including, for example, mobile phones. For instance, Sweden has introduced reverse charge for construction services, greenhouse-gas emission allowances, waste and scrap of certain metals, as well as mobile phones in certain cases.27

A complementary instrument is the quick reaction mechanism, which allows Member States to tackle sudden cases of VAT fraud with major financial impact by swiftly introducing the reverse charge mechanism on these goods or services.28 While reverse-charge tools can be effective against specific targeted forms of fraud, their impact is structurally limited. In practice, they tend to displace fraud across jurisdictions and sectors, as fraudsters are known to shift activity to Member States that have not adopted the measure or to goods and services outside its scope.29

2.3.2 The Kittel doctrine

In addition to legislative countermeasures, the European Court of Justice (ECJ) has played a significant role through the development of the Kittel doctrine. According to the ECJ, the right to deduct input VAT may be refused where a taxable person knew or should have known that it was participating in a transaction connected with VAT fraud. The Kittel test entails that even if a business does not have actual knowledge of the fraud, it can be denied deduction unless it, based on objective criteria, has taken all measures that could reasonably be expected of it to ensure that the transactions were not connected with the fraud.30

Like the reverse charge mechanism, the Kittel doctrine primarily serves a preventive rather than fraud-detecting function, ensuring that parties deemed complicit in already identified VAT fraud cases do not evade legal consequences. At the same time, it is widely noted that the Kittel doctrine imposes demanding due-diligence expectations on bona fide actors, who are sometimes used as “buffer” companies to complicate detection of MTIC fraud schemes. Meeting the requirements under the Kittel test generally presumes that accounting personnel have both the knowledge of the commercial aspects of transactions and the time to investigate each one in detail, which is generally not the case in practice.31

2.3.3 Administrative cooperation: VIES, Eurofisc, the Transaction Network Analysis tool and CESOP

A further strand of EU-level countermeasures has focused on strengthening administrative cooperation and data exchange between Member States. A central component is the VAT Information Exchange System (VIES), which enables Member States to exchange data on VAT-registered entities and intra-Community supplies and allows businesses to verify the VAT numbers of trading partners.32 VAT registration data in VIES is drawn from national registers, while information on intra-Community supplies is derived from recapitulative statements (EC Sales Lists) submitted for cross-border supplies.33 This framework is complemented by Eurofisc, a network of liaison officials that facilitates early warnings about suspected fraudulent traders. More recently, Eurofisc has been supported by the Transaction Network Analysis tool, which uses data-mining techniques to detect suspicious activity by analyzing the information exchanged through VIES.34

A further recent development concerns the adoption of new reporting obligations for EU payment service providers in 2020. These requirements are intended to support the prevention of VAT fraud by enabling tax authorities to verify taxpayer-reported information against third-party payment data. Since April 2024, payment service providers are required to monitor the payees of cross-border payments and to transmit information on payees who receive more than 25 cross-border payments per quarter to their respective home tax authorities. The tax authorities then forward this information to the European Commission, where it is aggregated in the Central Electronic System of Payment information (CESOP). CESOP is designed to support the detection of VAT fraud in e-commerce, including sales by sellers established both within and outside the EU. The data can then be consolidated, cross-checked against other EU databases, and made available to Member States’ anti-fraud experts through Eurofisc.35

However, the effectiveness of present administrative cooperation remains constrained by the quality, volume, and timeliness of the under­lying data.36 In particular, the data exchange through VIES is subject to a material time lag. It has been reported that, on average, five months elapse between the identification of a potential fraud risk within Eurofisc and the invalidation of a VAT number in VIES, thereby bringing the fraudulent transactions to an end.37 As part of addressing these shortcomings, the ViDA package includes a replacement of VIES with a new “Central VIES”, which will be designed to accommodate the upcoming digital reporting and e-invoicing requirements.38

2.3.4 EPPO and OLAF

Another important EU-level measure has been the creation of the European Public Prosecutor’s Office (EPPO) in 2017.39 EPPO is an independent body responsible for investigating, prosecuting, and bringing to judgement crimes affecting EU’s financial interests, including MTIC fraud. It cooperates closely with the European Anti-Fraud Office (OLAF), which serves as the EU’s administrative anti-fraud body.40 EPPO has competence to investigate cross-border VAT fraud cases involving damage above EUR 10 million. In practice, this threshold is both a strength and a structural limitation. On the one hand, EPPO has already proven successful in uncovering several large MTIC fraud schemes. For example, in February 2024, EPPO enabled the investigation of a EUR 195 million fraud scheme spanning across 17 countries.41 On the other hand, many fraud cases fall under EPPO’s EUR 10 million threshold, leaving such cases largely dependent on national detection, investigation and prosecution. Moreover, even within its mandate, the effectiveness of EPPO in MTIC fraud cases remains constrained by the general time-lag and lack of granularity of the current national VAT reporting requirements.42

3.3.1 Expert systems

In the categorization of risk detection systems, a general distinction may be drawn between expert systems and data-driven approaches. Expert systems are an older rule-based technology which builds on the experience of human experts.71 The understanding of fraudulent behavior is formalized into predefined, binary “if–then” rules, implemented as decision trees or rule engines.72 It can be recalled that, although such systems are not traditionally considered “AI” in a technical sense, some expert systems can nonetheless fall within the definition of AI systems under the EU AI Act.

Traditionally, expert systems have been used by tax administrations to support “anomaly” or “outlier” detection. Anomaly detection is a data analysis technique used to search for and identify instances that do not conform to the typical data in a data set, such as a higher than normal VAT deduction claimed by a taxpayer.73 A higher than normal claim for deduction could indicate that the taxpayer is a “missing trader” in an MTIC fraud scheme.

Some Member States continue to primarily rely on expert systems for the detection of MTIC fraud.74 One such example is Ireland.75 Although the Irish Revenue Commissioners (IRC) have expressed a commitment to integrating data-driven approaches into their operations, they reportedly only deploy expert systems for MTIC fraud detection. More specifically, expert systems are used to perform anomaly detection in the form of risk scoring, problem detection, and case selection across multiple taxes, including VAT. In addition, expert systems are used to identify potentially false refund claims in real time,76 which is a key component of MTIC fraud schemes.

From a legal and evidentiary perspective, expert systems offer a relatively high degree of transparency and interpretability. However, they suffer from several structural limitations. They are costly to maintain, depend on manual input from experts, and tend to become outdated or excessively complex when new rules are continuously added. Because fraudulent behavior is inherently dynamic, expert systems require constant revision.77

These limitations are especially pronounced in the context of MTIC fraud. Such schemes are ever evolving, structurally complex and frequently linked to organized criminal networks, which possess both the knowledge and the capacity to undertake extensive measures to complicate detection. Identifying sophisticated or concealed transaction chains within vast amounts of heterogenous, multi-sourced data is therefore difficult using purely rule-based systems.

3.3.2 Data-driven approaches: supervised and unsupervised learning

In contrast, data-driven fraud detection conducted by tax administrations is typically operated by systems incorporating different levels of machine learning. Machine-learning can be understood as a subset of AI within data science that enables systems to learn from higher dimensional data and its structure, to identify and classify subtle patterns, and make predictions without being explicitly programmed.78 This approach has gained prominence because it combines greater detection power with operational efficiency. Compared with expert systems, an important advantage lies in that machine learning systems do not require hard coding. Moreover, these models tend to be more cost-effective compared to expert systems once established, since their learning processes allow continuous adaptation to new data. Within data-driven systems, two main strands can be distinguished: supervised and unsupervised learning.79

Supervised learning appears to be the predominant machine learning approach used by tax administrations for MTIC fraud detection.80 It relies on labelled historic datasets in which the outcome, such as “confirmed fraud” or “non-fraud”, has been determined by human investigators. The model learns the statistical relationship between input variables, such as transaction patterns and business lifespan, and the labelled output.81

In tax fraud detection, supervised learning can be used for predictive analytics,82 which is a data analytics technique aimed at estimating what is likely to happen in the future.83 For instance, risk-scoring models, which are a form of predictive analytics, can be trained on historical VAT cases and subsequently applied to new cases in order to estimate the probability that a trader is involved in an MTIC fraud scheme. By assigning risk scores to new cases, such models enable tax administrations to prioritize audits, delay VAT refunds, or initiate enhanced monitoring based on the predicted likelihood of participation in fraudulent trading chains.84

The main advantage of supervised learning lies in its precision. Models can be calibrated to minimize false positives and are comparatively robust against deception when trained on high-quality data. However, they depend on comprehensive and reliable labelled datasets and perform poorly when confronted with novel or evolving fraud schemes that deviate from historical patterns.85 They also lose precision in the event of legislative change(s).

By contrast, unsupervised learning seems to be much less common than supervised learning in MTIC fraud detection.86 It relies on processing raw, unlabeled data to expose patterns, high dimensional structures or deviations within the dataset. In practice, it is associated with descriptive analytics , that is, a data analysis technique focused on explaining what has happened or what is currently happening by summarizing historical or real-time data, often with the goal of anomaly detection. In contrast to predictive analytics, descriptive analytics focuses on what is unusual or structurally distinctive within existing datasets rather than predicting a specific predefined outcome.87 When combined with information about known cases in the dataset (i.e., in a supervised setting), unsupervised learning can also help users generate new knowledge and insights by revealing latent structures in the data.

This difference between supervised and unsupervised learning can be illustrated with the example of one specific application of clustering analysis, a type of unsupervised learning algorithm which automatically organizes unlabeled data into groups (clusters) based on similarity.88 Presume that a clustering algorithm organizes a set of VAT cases into three distinct clusters. Two clusters might correspond to known categories (fraud and non-fraud), while a third, previously unidentified cluster emerges. The reason for this cluster must then be examined by human analysts. It may, inter alia , reveal a new fraud scheme (e.g. companies sharing a common beneficial owner), but it could equally reflect irrelevant correlations (e.g. that companies have a non-calendar “broken” financial year).

Because unsupervised models do not rely on labelled data, they can in principle uncover new or previously unseen forms of MTIC fraud. At the same time, the absence of labels makes it difficult to interpret and explain the generated results.89 It is reasonable to assume that this is one contributing reason as to why unsupervised approaches are uncommon in MTIC fraud detection. Another plausible reason is that unsupervised models have comparatively lower precision and higher risk of false positives.90 In tax administration, such errors carry significant consequences, as incorrectly flagging does not only divert administrative resources but also puts undue burdens on compliant individuals and businesses.

A further challenge concerns data preparation. Machine learning depends heavily on extensive pre-analytical work. This includes (i) selection of data, which requires identifying relevant data sources; (ii) preprocessing, which includes the removal of noise, errors, and biases; (iii) reduction and projection, where the data is reduced into analytically manageable formats; and (iv) data enrichment, which means that the selected data is combined with other datasets in order to generate deeper insights.91 While these steps are important also in the case of supervised learning, unsupervised models arguably raise particular challenges related to the pre-processing of data in the context of tax fraud detection.ty results. Existing reporting obligations may simply not generate sufficiently rich data to detect entirely new fraud typologies. Finally, a central challenge is that many algorithms are designed to operate on complete datasets,

One key challenge is that, contrary to supervised learning, unsupervised learning entails that there is no predefined target variable to guide the assessment of whether the collected data is suitable for the intended analytical purpose. Moreover, unsupervised learning typically requires a much larger volume of training data compared to supervised learning to achieve high-quality results. Existing reporting obligations may simply not generate sufficiently rich data to detect entirely new fraud typologies. Finally, a central challenge is that many algorithms are designed to operate on complete datasets,92 whereas tax datasets frequently contain missing values because the information was not collected or reported.

A common data-science response to this problem is to impute missing values, sometimes by generating synthetic data. While imputation may be workable in supervised settings where the relevant fraud features are already known, it can be detrimental in unsupervised detection because it tends to “normalize” incomplete records by smoothing over atypical features.93 This may erase or distort precisely the signals the model is trying to detect. For example, a missing entry in a tax return could in itself be indicative of non-compliance. Hence, imputation in unsupervised systems entails a particular risk for lowered detection rates or false positives in tax fraud detection.

3.3.3 Social network analysis

Social network analysis is a data analysis technique that is used to detect patterns of potentially fraudulent behavior in a network of linked entities.94 Its underlying premise can be described as “guilt by association”, that is, the probability that a taxpayer engages in non-compliance may be influenced by the entities to which that taxpayer is connected.95 Rather than focusing solely on the characteristics of individual taxpayers, social network analysis therefore examines the relationships between entities, such as common contact details, common beneficial ownership, or transactional links between supply chains. These connections are visualized as networks, enabling tax administrations to identify clusters that may indicate MTIC fraud. This way, social network analysis complements traditional risk scoring models based on supervised learning, which assess cases individually and may fail to detect structurally embedded fraud risks.

In the context of tax fraud detection, social network analysis has proven effective in uncovering MTIC fraud.96 This can be explained by the fact that MTIC fraud schemes inherently involve multiple traders and are frequently embedded in organized criminal networks. Their structured and relational character makes them especially amenable to network-based analytical techniques.

Methodologically, social network analysis can be implemented using supervised, unsupervised, or hybrid learning approaches. In the field of MTIC fraud detection, however, supervised methods appear to predominate. A possible explanation for this is that social network analysis based on unsupervised learning may not be sufficiently precise to detect novel types of tax fraud using the data currently reported and available to tax authorities.97

The functioning of supervised social network analysis may be illustrated as follows. Presume that a tax administration receives information through Eurofisc that a specific fraud scheme involving mobile phones has been identified in several Member States, with indications that a similar structure may exist domestically. The tax authority may then conduct a targeted network analysis focusing on companies trading in those goods and sharing common beneficial owners or other relevant connections, in order to identify comparable network configurations.

Despite its suitability for MTIC fraud detection, the use of social network analysis arguably raises particular questions in relation to both reporting obligations and data protection rules. Its effectiveness depends on access to comprehensive, high-quality, and validated datasets on, inter alia, transactions and ownership structures between entities, which may be difficult to obtain under current reporting regulations. Moreover, the reliance on large volumes of relational and transactional data creates specific tensions in relation to data protection rules, such as the principles on purpose and data limitation in the General Data Protection Regulation (GDPR).98

4.4.1 Registration and deregistration

A first prerequisite for the collection of data by tax agencies is registration. Under Swedish law, the reporting obligations in the VAT directive have largely been implemented in the Tax Procedure Act ( skatteförfarandelagen, 2011:1244, TPA). The scope of the registration requirement is broad – it covers any person intending to carry out an activity that gives rise to VAT liability.134 Registration is made on a specific form,135 and may be completed either on paper or electronically.

The information received by the STA through the registration form is the name of the company, its identification number, legal form, address, and telephone number, as well as whether the business is newly established, acquired, or reorganized. The registration should also include information on what type of activity is carried out, and, in the case of closely held companies ( fåmansföretag), the identity of the owners. Moreover, details about the applicable accounting period, filing date, accounting date must be included, as well as the reason for VAT registration, for example, that there has been a supply or acquisition of goods from another EU Member State.136

At the outset, the information collected at the point of registration is relevant for detecting several of the key features of MTIC fraud, in particular: (i) the existence of a zero-rated intra-Community transaction, and (iv) whether the company may be a missing trader that has previously been used for fraudulent purposes, since the registration data includes information about ownership as well as whether the business is newly established or reorganized. It also gives some indication about whether (v) certain high-risk goods are used, as it must be stated what type of business is carried out. It should, however, be noted that the registration details do not give any information about what goods will actually be traded within the business, i.e. if non-business-related goods are acquired and sold (for example, if a hair salon begins selling mobile phones). Neither does the information provided at the registration provide any data for detecting whether (ii) transactions are being conducted between a network of entities, or (iii) sudden and significant increases in reported trade volume.

Once registered for VAT, the taxable person is assigned a VAT number. The Swedish VAT number consists of the country code SE, followed by the company’s ten-digit corporate identity number, and ends with the digits 01.137 A particular challenge from the perspective of data-driven analysis is that the registration numbers used for sole proprietorships (enskild firma) are based on the identity number of the natural person. As a result, they constitute personal data under the GDPR,138 which places specific limitations on how the STA can process and analyze such data.

In the context of AI-driven fraud detection, a further challenge arises from the low threshold for VAT registration. In practice, registration may be granted based on relatively limited information concerning the activity the business intends to carry out, even where important details, such as ownership information, are absent.139 Although this issue is mitigated to some extent by the STA’s access to third-party ownership data from the Swedish Companies Registration Office ( Bolagsverket), it is also recognized that it is not subject to a robust verification process and therefore not always reliable.140 From a data analytics-perspective, the lack of (reliable) data related to ownership is problematic because it undermines the effectiveness of learning systems which, as discussed in section 3, generally depend on complete and reliable data to perform as intended. The lack of reliable information concerning the natural person behind a company is arguably particularly problematic for social network analysis, which is based on transaction links between companies and the natural persons connected to them.

Moreover, deregistering a company that appears to be fraudulent is difficult. Traditionally, VAT registration has been regarded as a formal administrative measure.141 Since 2020, however, verification of a valid VAT registration through VIES has also become a condition for zero-rating intra-EU supplies, making VIES central to the operation of MTIC fraud schemes.142 At present, a VAT registration number appears as invalid in VIES only once the company has been deregistered for VAT purposes in Sweden. In practice, this is difficult for the Swedish Tax Agency, which must show that the missing trader has ceased carrying out economic activity. This is challenging because such traders may continue to make large purchases from other EU Member States. As a result, VAT deregistration is often slow and may require prior reassessment and bankruptcy proceedings.143

From a data-analytics perspective, the current difficulties surrounding deregistration are also problematic. A deregistration by the Swedish authorities does not, in itself, necessarily contribute to more effective data analysis of MTIC fraud within Sweden. The more significant issue is that many other Member States appear to face similar difficulties.144 This is particularly problematic from a timing perspective. If there is a delay before a VAT registration number is invalidated, analyses of the key feature consisting in the presence of a missing trader company cannot be carried out in a timely and accurate manner.

4.4.2 Filing of VAT Returns

Apart from registering, another fundamental reporting requirement is that persons liable for VAT must file a tax return.145 The tax return must be submitted for each reporting period, even in cases when no VAT is due.146 As a general rule, the reporting period is one calendar month.147 However, if the taxable base for VAT, excluding intra-EU acquisitions and imports, is not expected to exceed SEK 40 million in the tax year, the tax return should instead be filed quarterly. For smaller companies with an expected taxable base below SEK 1 million, the reporting should occur annually.148

As already highlighted, the lag in reporting timelines can be exploited in MTIC fraud schemes.149 For example, presume that a fraudulent company incorrectly reports that its turnover is expected to be below SEK 1 million, whereas it in fact is significantly higher. Under the regular procedure, the STA will only become aware of this discrepancy at the time of the annual reporting.

If there are specific reasons to suspect that a company is part of an MTIC fraud scheme, the STA has the power to decide if the reporting period shall be shortened to one calendar month instead of one calendar quarter, or one calendar month or quarter instead of one tax year.150 A shorter reporting period provides the STA with more frequent data points, which is relevant for AI-driven fraud detection. However, such a decision presupposes that a suspicion of MTIC fraud has already arisen.

Moreover, the data reported in the VAT return is relatively limited. As a main rule, it must include the necessary identification details, information on the reporting period to which the return relates, and additional information required for taxes to be calculated and verified.151 For VAT returns, this additional information comprises input VAT, output VAT, and supplies, acquisitions, and transfers of goods transported between EU Member States.152

For data-analysis purposes, this information contributes to a more effective detection of some of the key characteristics of MTIC fraud, in particular: (i) the existence of a zero-rated intra-Community transaction, and (iii) sudden and significant increases in reported trade volume. However, the return does not provide any substantial information on (ii) transactional relationships between different companies, nor on whether (iii) the company is a missing trader, or (v) whether the company trades in certain high-risk goods.

4.4.3 Recapitulative statements

Companies that are required to register for VAT and that are engaging in intra-EU trade in goods and certain services must also file a recapitulative statement.153 This includes information regarding zero-rated intra-EU supplies, which is a key feature of MTIC frauds. The purpose of the recapitulative statement is to ensure that the corresponding intra-EU acquisition is correctly reported by the purchaser, and to that end, the supplier must report the relevant transaction data.

As a general rule, a recapitulative statement must be submitted monthly in respect of goods and quarterly in respect of services. Where the statement contains information relating to both goods and services, it must be submitted on a monthly basis.154

The general rule is that the recapitulative statement must contain information on supplies, acquisitions, and transfers of goods transported between EU Member States. However, according to the STA’s regulations, information is to be reported in relation to supplies and transfers, but not acquisitions.155 The recapitulative statement must include the supplier’s Swedish VAT number, the purchaser’s VAT number in another EU Member State, and the total consideration for the goods or services supplied to each purchaser. In the case of triangular transactions, it must also include information on the intermediary’s supply of goods.156

Recapitulative statements are important for AI-driven detection of MTIC fraud, since they provide some data on (ii) transactions conducted between a network of entities and (iii) the appearance of sudden and significant increases in reported trade volume. They obviously also provide information regarding (i) the existence of a zero-rated intra community transaction. However, apart from details about the registration number, the statements give limited data for detection of (iv) the presence of a missing trader. They also provide limited guidance on (v) the use of certain high-risk goods.

4.4.4 Assessment of the current reporting framework

The examination in this section shows that the current reporting framework for businesses is not well suited to support AI-driven detection of MTIC fraud. In general, VAT reporting for businesses is limited in scope, largely based on aggregated values, and subject to significant time lags. This is, however, hardly surprising, given that the large-scale AI-based analysis of vast amounts of tax data was not technically feasible until relatively recently. Put differently, the legal architecture of VAT reporting still largely reflects an environment in which ex post audit remains the primary control mechanism, rather than one designed for AI-assisted fraud detection in (near) real-time.

At the same time, the examination shows that the data currently reported to the STA provides a relatively solid basis for detecting a few of the key features of MTIC fraud. Most notably, there is relatively robust data concerning (i) the existence of a zero-rated intra-Community transaction, although also in this case the reporting as a general rule occurs on a monthly basis.

By contrast, the reporting framework arguably provides the weakest support in relation to identifying (ii) transactions conducted within a network of interconnected entities. The only directly relevant information currently derived from reporting obligations appears to be the recapitulative statement, which shows that an intra-EU supply has taken place. Nonetheless, this says little about the wider chain of transactions in which that supply is embedded. To some extent, this picture may be supplemented by data from other reporting obligations. In particular, the recently introduced reporting requirements under the CESOP provides important third-party data.157 Even so, these obligations remain limited to cross-border activity. At present, there is no reporting requirement that systematically provides the STA with transactional data on supplies between two domestic businesses. This substantially limits the possibility of carrying out more advanced automated analysis using supervised learning, especially social network analysis, which depends on transaction data linking a network of entities, but also transaction-level risk detection more generally.

There is also some information relevant to (iii) sudden and significant increases in reported trade volumes, both in the VAT return and in the recapitulative statement. However, that information may reach the STA only after a considerable delay. This is particularly true for domestic transactions, as businesses having estimated that their turnover is below 1 million SEK are only required to file their return annually.

Likewise, there is limited data enabling the detection of (iv) the existence of a missing trader company. The STA receives some information on ownership from the VAT registration, as it includes information about ownership as well as whether the business is newly established or reorganized. However, the low threshold for fulfilling the requirements for registration means that it is not strictly required to provide information about ownership. This connects to one of the broader problems of AI-driven analysis, namely that the underlying data must be sufficiently complete and reliable if the results are to be accurate.158 Where ownership information is missing or unreliable, the quality of the analytical output is correspondingly weakened. Although supplementary third-party information may be obtained from the Swedish Companies Registration Office, it is well known that ownership data in that register is not always reliable. In practice, this entails an increased reliance on information received from other Member States, for example through Eurofisc and the EPPO.

Finally, the reporting framework only provides limited information relevant to (v) trading of high-risk goods. While the STA receives information on the type of business activity for which the company is registered, it does not receive data on the actual goods sold in individual transactions.

From the perspective of AI-driven fraud detection, the most significant missing data points therefore concern (ii) transactions conducted between a network of companies, and (v) the trading of specific high-risk goods. This information is included in what constitutes the basis for the right to deduct input VAT: the invoice. Under the current reporting framework, however, invoice details are not systematically reported to the STA. Moreover, invoices need not be issued electronically and may still be paper-based,159 which further complicates their use for data analysis, since the information is not necessarily available in a structured format. This substantially limits the possibility of performing more accurate AI-driven analysis, especially social network analysis. At present, one way for the STA to gain access to invoice information is to carry out a tax audit. However, before such an audit is conducted,160 the taxable person must be notified of the decision,161 which gives the missing trader time to disappear.

A related problem is that many aspects of the reporting framework are outdated from the perspective of AI-driven analysis. One illustrative example is that VAT registration numbers for sole proprietorships are based on personal identity numbers, meaning that they constitute personal data under the GDPR. Another is that the rules on deregistration still rest on the assumption that VAT registration is primarily a formal administrative measure. As a result, deregistration in VIES remains difficult even in cases of suspected fraud. This illustrates not only that the framework has not been designed with data-driven fraud detection in mind, but also that it may itself facilitate continued abuse while reducing the effectiveness of AI-based analysis by allowing inaccurate or unreliable registration data to persist.

In addition to these gaps in substantial data, a recurring weakness of the current system is the time lag built into the reporting framework. Taken together, the lack of transactional detail and delayed availability of data significantly decreases the usefulness of the current framework for AI-driven MTIC fraud detection. These are also two shortcomings that the digital reporting requirements introduced under the VIDA package are intended to address.