In short:
- Invoices and accounting records must be kept for eight years since 1 January 2025, no longer ten.
- Electronic invoices must be archived in their original electronic format - printing them out is not enough.
- There is no official "GoBD certificate"; responsibility lies with the business, not the software.
- The GoBD were last updated on 14 July 2025, partly because of the mandatory e-invoice.
What is the GoBD, exactly?
The GoBD ("principles for the proper management and retention of books, records, and documents in electronic form, and for data access") is an administrative circular from the Federal Ministry of Finance. It spells out how the statutory bookkeeping and retention obligations (§§ 140-147 AO, § 14b UStG) are to be implemented in digital accounting. The base version dates from 28 November 2019; it has since been amended several times - most recently on 11 March 2024 and on 14 July 2025, partly to account for the e-invoice mandate in the B2B sector that has applied since 1 January 2025.
Retention periods at a glance
| Document type | Period | Legal basis |
|---|---|---|
| Invoices, accounting records | 8 years (since 1 Jan 2025, previously 10) | § 147 AO, § 14b UStG |
| Books, inventories, annual financial statements | 10 years | § 147 AO |
| Commercial and business correspondence | 6 years | § 147 AO |
The period only starts at the end of the calendar year in which the last entry was made, or the document was created or received - not on the invoice date itself.
The key GoBD principles for archiving
- Completeness: all business-relevant records must be captured, without gaps and without later removal.
- Traceability: a knowledgeable third party must be able to get an overview of the business transactions within a reasonable time.
- Immutability (audit-proof security): once archived, records must not be altered in substance without anyone noticing. Any later change must be traceably logged.
- Timely recording: bookings should happen promptly, not reconstructed from memory months later.
- Retention in the original format: an electronically received invoice (PDF, XRechnung, ZUGFeRD) must also be archived electronically - a printout does not replace the original, and for structured e-invoices it's outright insufficient because the machine-readable data is lost. For what technically distinguishes a structured e-invoice from a PDF, see our article "What is XRechnung?".
The myth of the "GoBD certificate"
Many software vendors advertise an alleged "GoBD certificate." In reality, no such thing exists: the tax administration does not issue positive certifications for accounting software and does not make generally binding statements about the GoBD compliance of individual products. What's marketed as a "certificate" is usually an assessment note from a private auditor or consulting firm - useful as a decision aid when buying software, but not binding on a tax auditor.
The consequence: even the best software doesn't relieve you of your own duty of care. GoBD compliance is first and foremost a question of your internal processes - for example, that you actually don't delete or retroactively alter an invoice once it's been sent, and instead consistently cancel it via a credit note (see our article on invoice numbering) - and only secondarily a question of the tool you use.
A practical archiving checklist
- Check the format: keep e-invoices (XRechnung, ZUGFeRD) in their original electronic format, not just as a printout.
- Track the deadline: count the 8-year period from the end of the respective calendar year, not from the invoice date.
- Ensure access: documents must remain available and readable for the entire period - even after a possible change of software or provider.
- Document changes: never overwrite corrections to a record; represent them traceably via cancellation invoices or invoice corrections instead.
- Keep procedural documentation: write down how you capture, archive, and protect records from loss - the GoBD explicitly requires this, regardless of which software you use.
Invoices you create on our platform stay available in structured form for as long as your account is active; for the full 8-year statutory retention period, though, you as the business remain responsible for keeping your records available and unaltered - for example through your own regular exports or backups. You can create an e-invoice at any time and check the structure of the files with our ZUGFeRD Validator.
Frequently Asked Questions (FAQ)
How long must invoices be kept in Germany? Invoices and other accounting records must be kept for eight years since 1 January 2025 (previously ten years). Books and annual financial statements must still be kept for ten years. The period starts at the end of the calendar year in which the invoice was created or received.
Is there an official "GoBD certificate"? No. The tax administration does not issue positive certifications for software. Third-party "certificates" are marketing tools with no binding effect on a tax auditor - responsibility for GoBD-compliant processes rests with the business itself, not with the software it uses.
Do I have to print out a received XRechnung and file it on paper? No, and doing so is actually wrong: electronic invoices must be kept in their original electronic format. A printout alone is not sufficient because it loses the machine-readable original data.
What does "immutability" mean for GoBD archiving? Once archived, a document must not be altered in substance afterwards without the change being traceably logged. This applies both to the technology used and to your own internal processes.
Is regular cloud storage (e.g. Google Drive) enough for GoBD archiving? Generic file storage without change tracking and without structured, machine-evaluable filing generally does not fully meet GoBD requirements. A solution designed for accounting purposes is the safer choice.
Conclusion
GoBD-compliant archiving isn't a software feature you buy once and check off - it's an ongoing process: the right retention periods, the right format, and traceable procedures for corrections. Anyone who relies solely on a marketing "certificate" without having their own processes under control isn't automatically protected in the event of a tax audit.
