How many days must we keep an invoice?

This article does not give a statutory retention period. Ask your accountant or lawyer. Do not treat a blog post as the deadline.

What if the model misreads an amount?

Do not book it until a person checks the source file. Do not ask the model to guess again and treat that as fact.

07 / 15·PDPO, cross-border data, and private AI

AI on contracts and invoices: minimum data, layered access, human review

15 October 2026

Direct answerAI can draft, classify, and extract fields from contracts and invoices, but each step should take only the minimum data that step needs, split by role. Model output is not a sent document or a booked entry. A person reviews it before it leaves. How long you keep records is an operational and legal question. This article does not state any number of days as law.

Minimum data

A quote draft may need only line items, quantity, and price. Do not drop an ID number, bank account, and the full contract into the same prompt by default. Stop when the step is done.

Layered access

Front line sees a masked summary. Finance sees amounts and invoice numbers. Leadership sees the full contract. Logs should show who opened a file, not one shared admin login for everyone.

Human review

AI can flag missing items and odd amounts. Sending, signing, and booking stay with a person. A flow such as AccountXP connects quote to cash. It does not replace that review.

Questions

How many days must we keep an invoice?: This article does not give a statutory retention period. Ask your accountant or lawyer. Do not treat a blog post as the deadline.
What if the model misreads an amount?: Do not book it until a person checks the source file. Do not ask the model to guess again and treat that as fact.

This article is general information, not legal advice. PCPD guidance changes — check the latest version before you rely on it.

Want a first look at whether one real workflow touches personal data? Book a 1-hour business diagnosis.

Book a 1-hour diagnosis