Is It Safe to Use AI for Your UK Taxes? (HMRC, Self Assessment)

The short answer fits in one line. AI can explain the tax rules, but never hand it your identifiers. A UK tax file holds very sensitive data. Your UTR (Unique Taxpayer Reference). Your National Insurance number (NINO). Your income. Your address. Pasted into a consumer ChatGPT, these identifiers can be retained, reviewed or reused for training. HMRC (HM Revenue & Customs, the UK tax authority) warns against sharing them. Under the UK GDPR, the UK version of the GDPR, they are personal data. There is a clean method: ask your general questions, but anonymise your identifiers before you send.

What a UK tax file lays bare

Self Assessment is the system HMRC uses to collect Income Tax. Some income is not taxed automatically at source. Profits from self-employment. Rent from a property you let. That income has to be reported through Self Assessment. And HMRC can require anyone it chooses to file a return.

To file, you handle precise identifiers. A UTR. A National Insurance number. The detail of your income. Your address. The UTR is issued by HMRC. You can find it in your Personal Tax Account, in the HMRC app, or on tax returns and other HMRC documents. HMRC's own guidance notes a UTR can be 10 or 13 digits long.

The deadlines make this a hot topic every winter. You must tell HMRC by 5 October if you need to file for the previous tax year. The online return and any tax owed are both due by 31 January. Miss these, and penalties and interest kick in. Calendar pressure pushes people to seek help fast. Sometimes from an AI, with the full file in hand.

What HMRC says: keep these numbers to yourself

GOV.UK's official guidance is blunt. To prevent identity fraud, do not share your National Insurance number with anyone who does not need it. It's written plainly in GOV.UK's National Insurance guidance.

GOV.UK also names the limited set of bodies that legitimately need it.

• HMRC and your employer.
• The Department for Work and Pensions (DWP), including Jobcentre Plus and the pension and disability services.
• Your local council and the Electoral Registration Officer.
• The Student Loans Company, pension and ISA providers, and authorised financial-service providers.

One thing stands out. A consumer AI chatbot appears nowhere on that list. It has no legitimate need for your NINO or your UTR. GOV.UK goes further. It tells you to get these identifiers only from official sources: the Personal Tax Account, the HMRC app, or genuine HMRC documents. These are sensitive credentials, not casual reference numbers.

The law: UTR and NINO are personal data

UK law settles the question. Under the UK GDPR and the Data Protection Act 2018, an identifier like the National Insurance number is personal data. It stays protected information whenever it is processed. Including when you paste it into a third-party AI service.

The Information Commissioner's Office (ICO) is the UK's data protection regulator. Its position is clear. The principles of the UK GDPR apply to the use of personal information in AI systems. The law takes a risk-based approach. Organisations must assess and mitigate the risks their AI use poses to people's rights and freedoms. The ICO even publishes a dedicated resource, the AI and data protection risk toolkit.

In plain terms: pasting a UTR or a NINO into a consumer ChatGPT is not a harmless move. It is processing personal data. And it opens a real risk of tax identity fraud — the very thing HMRC works to prevent.

The fix: anonymise before you send

Good news: AI is still useful for your taxes. It can explain how Self Assessment works. It can clarify a deadline, a deduction, a form. For that, it needs none of your identifiers. Ask the question in general terms. Keep your UTR, your NINO, your amounts and your address out of the prompt.

When you really must include a concrete case, anonymise it first. Replace each identifier with a token. The AI reasons about the shape of your situation, without ever seeing the real values. You restore the real values afterwards, locally.

1. 1Spot the identifiers in your text: UTR, NINO, income, address.
2. 2Replace them with reversible tokens, in the browser.
3. 3Send only the anonymized text to the AI.
4. 4Restore the real values in the reply, locally.

That's what ONYRI Sanitize is for. The engine detects sensitive data — UTR, National Insurance number, amounts, address — and replaces it with reversible tokens before sending. Detection and the mapping stay in your browser. Only anonymized text reaches the model. The AI finds only tokens, never your real tax identifiers. You get the help, without the identity-fraud risk that HMRC and the ICO ask you to rule out.