GoBD and Software Development: Must Source Code Be Retained for Ten Years?

The claim sounds definitive: “The GoBD require the complete source code to be retained for ten years.” As a blanket statement, it is wrong.

The GoBD require tax-relevant records to remain traceable, auditable, unaltered, available and capable of machine analysis. This can result in extensive requirements for software, configurations, program versions and documentation. The primary sources reviewed, however, do not impose a general duty to archive the entire source code of every business application, together with its compiler and historical build environment, for ten years.

The GoBD are not a standalone statute

GoBD is the German abbreviation for the “Principles for the proper keeping and retention of books, records and documents in electronic form and for data access”. The relevant instrument is the Federal Ministry of Finance letter of 28 November 2019, as amended in 2024 and 2025.[1–3]

The GoBD are administrative guidance. The statutory retention and cooperation duties arise primarily from the German Fiscal Code (AO) and Commercial Code (HGB). Individual GoBD passages should therefore not be detached from section 147 AO and section 257 HGB and expanded into a general IT archiving obligation.[4][5]

Several retention periods apply in 2026

Section 147(3) AO distinguishes by type of document:[4]

• books, inventories, annual financial statements and the work instructions and organisational documents required to understand them: ten years;
• accounting vouchers: generally eight years. Under Article 97 section 19a(2) EGAO, the period applicable since 1 January 2025 generally also covers records whose former retention period had not expired by 31 December 2024; the entities listed in Article 97 section 19a(3) EGAO remain subject to the special rule;[7]
• commercial and business correspondence and other tax-relevant documents: six years.

Section 257 HGB likewise provides ten-, eight- and six-year periods for the commercial-law records listed there. Its categories are not identical to section 147 AO; in particular, section 147(1) no. 5 AO additionally covers other records insofar as they are relevant for taxation. Under section 257(4), second sentence, HGB, the ten-year period remains applicable to certain institutions, insurance undertakings and investment firms; Article 95 EGHGB contains transitional rules.[5][8] Periods may also have a longer practical effect where documents remain relevant to taxes for which the assessment limitation period has not yet expired.

The former shorthand of “ten years for everything” is therefore no longer correct even for conventional accounting records.

Procedural documentation is central

The GoBD require meaningful and complete procedural documentation. It must cover both current and historical aspects of the procedure and correspond to the IT process actually used.[1, paras. 34, 151–155]

Its typical scope includes:

• a general description of the procedure,
• user documentation,
• technical system documentation,
• operations documentation,
• a description of how data is created, processed, stored and retrieved,
• backup and restoration processes,
• version control and a traceable change history.

The benchmark is not the maximum possible volume of documentation. A knowledgeable third party must be able to understand and audit the processing of tax-relevant data. Under paragraph 155 GoBD, inadequate procedural documentation does not automatically result in the bookkeeping and records being rejected for tax purposes; the deficiency becomes material in particular where it impairs traceability and auditability.[1]

What must actually be retained for software

For records generated by software, relevant settings, parameter changes and control data in particular must be documented. The identity of the software, the versions used and changes made must be traceable.[1, paras. 88–89, 111, 154]

Depending on the system, the following information may, for example, be required for fit-for-purpose documentation; not every item is mandatory in every case or under precisely this label:

• identity and version of the software used,
• configurations and parameter histories,
• master, transaction and metadata,
• change, test and approval records,
• data models, tables, fields and relationships,
• technical and functional documentation,
• export and analysis capabilities,
• relevant programming logs for cash-register systems.

The German Federal Fiscal Court confirmed that organisational records concerning cash-register programming may be subject to retention under section 147(1) no. 1 AO and may be stored electronically. It did not endorse a blanket characterisation of their absence as a serious formal deficiency; instead, it required findings on the specific weight of the deficiency.[6] That case-specific decision does not establish a general duty to retain the complete source code of every software product.

When source code may nevertheless become relevant

The primary sources do not generally classify source code as an organisational record that must be retained. For bespoke software, it may be necessary in a particular case to assess whether defined code holdings or documentation generated from them are actually needed to explain tax-relevant processing, program identity or changes. That may arise where:

• tax-relevant entries can only be traced by examining the program logic,
• the deployed program version cannot otherwise be identified,
• the code itself forms part of a documented control and change process,
• or it is specifically required as another tax-relevant document.

Retention then depends on the code’s particular function and legal classification. The result may be a ten-year period as a required organisational document, or six years as another tax-relevant document. The classification must be made by reference to the specific system and process. It cannot simply be applied to every repository.

Must compilers and build tools be archived?

Here too, purpose is decisive. The GoBD require relevant data to remain available, readable and capable of machine analysis throughout the retention period. They do not generally require every historical application to remain buildable from its source code at any time.

Paragraphs 142–143 GoBD permit a system migration without retaining the old hardware and software, provided the relevant data has been transferred completely and without alteration and the new system offers the same analysis capabilities.[1] The original hardware or software may still be required only where these conditions cannot be met.

For critical bespoke software, a reproducible build environment may nevertheless be prudent for operational, resilience, evidential or contractual reasons. In that case it is a justified control measure. It should not be misrepresented as a general GoBD duty to retain source code.

Practical review questions

For each tax-relevant system, organisations should establish:

1. Which records and data are tax-relevant?
2. What documentation does a knowledgeable third party need to understand the process?
3. How are the program version, parameters and changes evidenced?
4. Will data remain available, readable and capable of machine analysis?
5. Which software functionality is needed for reproduction or analysis?
6. Has any migration been tested completely and with appropriate evidence?
7. Is source code genuinely required to understand this particular system?

Conclusion

The GoBD do not impose a blanket requirement to archive the complete source code of every software product for ten years. They require tax-related traceability, auditability and analytical access to be preserved. The programs, versions, configurations and documents needed to achieve that depend on the system and its tax function.

Professional scope: For material systems, the classification of documents and applicable periods should be determined jointly with tax advisers, process owners, IT and, where appropriate, legal counsel.

Sources

[1] German Federal Ministry of Finance. Grundsätze zur ordnungsmäßigen Führung und Aufbewahrung von Büchern, Aufzeichnungen und Unterlagen in elektronischer Form sowie zum Datenzugriff (GoBD) [Principles for the proper keeping and retention of books, records and documents in electronic form and for data access]. Ministry letter of 28 November 2019, IV A 4 – S 0316/19/10003 :001, BStBl I 2019, 1269, in particular paras. 34, 88–89, 111, 126–129, 142–143, 151–155, 159–160. The position used here is derived from that base circular as published in the Federal Tax Gazette, together with the amendments of 11 March 2024 and 14 July 2025; no officially consolidated text is being cited.

[2] German Federal Ministry of Finance. Änderung der GoBD [Amendment of the GoBD]. Ministry letter of 11 March 2024. https://www.bundesfinanzministerium.de/Content/DE/Downloads/BMF_Schreiben/Weitere_Steuerthemen/Abgabenordnung/AO-Anwendungserlass/2024-03-11-aenderung-gobd.html.

[3] German Federal Ministry of Finance. Zweite Änderung der GoBD [Second amendment of the GoBD]. Ministry letter of 14 July 2025. https://www.bundesfinanzministerium.de/Content/DE/Downloads/BMF_Schreiben/Weitere_Steuerthemen/Abgabenordnung/2025-07-14-GoBD-2-aenderung.html.

[4] Federal Republic of Germany. German Fiscal Code (Abgabenordnung), section 147. https://www.gesetze-im-internet.de/ao_1977/__147.html.

[5] Federal Republic of Germany. German Commercial Code (Handelsgesetzbuch), section 257. https://www.gesetze-im-internet.de/hgb/__257.html.

[6] German Federal Fiscal Court. Decision of 23 February 2018, X B 65/17. https://www.bundesfinanzhof.de/de/entscheidung/entscheidungen-online/detail/STRE201850053/.

[7] Federal Republic of Germany. Introductory Act to the Fiscal Code, Article 97 section 19a. https://www.gesetze-im-internet.de/aoeg_1977/art_97__19a.html.

[8] Federal Republic of Germany. Introductory Act to the German Commercial Code, Article 95. https://www.gesetze-im-internet.de/hgbeg/art_95.html.