What the ATO's Record Keeping Rules Mean When You Use AI to Write Invoices and Quotes

Your AI tool drafts a quote in about twenty seconds. It pulls the client details, assembles the line items, writes the covering paragraph and formats the lot. Then someone adjusts the price, regenerates it, sends version three, and versions one and two quietly cease to exist. That last part is where an ordinary productivity win turns into a record keeping problem.

The ATO's rules for business records did not change when AI arrived. They apply to a quote drafted by a language model exactly as they apply to one typed by hand. What changed is how easily an automated system can breach them without anyone noticing, because the breach looks like tidiness.

The five rules, in plain terms

The ATO sets out five record keeping rules for business. You must keep all records relating to your tax and superannuation affairs. The information in them must not be changed, and they must be stored in a way that protects them from being altered or damaged. Most records must be kept for five years. You must be able to produce them if the ATO asks, including an explanation of how your record keeping system works. And they must be in English, or able to be easily converted to English.

Four of those five are unremarkable for most businesses. You already keep your invoices, you already file your BAS, and your records are already in English. It is the second rule that automation trips over, and it does so in a way that feels like good housekeeping right up until someone asks a question.

"Must not be changed" is the rule automation breaks

Most AI quoting and invoicing setups are built to regenerate. You change an input and the document rebuilds itself. That is the entire appeal, and it is genuinely a good thing when you are three revisions deep on a Friday afternoon. The problem is that regeneration usually overwrites.

If your system produces a quote, sends it, then produces a revised quote over the top of the same record, you have not kept a record that cannot be changed. You have kept the most recent one. The ATO's position is that where your system changes, you need to be able to reconstruct the original data, which is difficult if the original was never written down in the first place.

The fix has nothing to do with AI. Generate to a new record, never over an old one. Every version gets its own file, its own timestamp and its own identifier. Storage is cheap and the discipline costs you nothing once it is set up. What it buys you is the ability to answer "what did we actually send them in March?" with a document rather than a recollection.

The five year clock starts later than you would assume

Five years is the number everyone remembers. The detail most people miss is when it starts. The ATO's wording is that the period starts from when you prepared or obtained the record, or completed the transactions the records relate to, whichever is later.

That matters more than it sounds. A quote drafted in August 2026 for a job that finishes in March 2028 sits on the 2028 clock, not the 2026 one. If your automation has a retention policy that deletes anything older than five years from creation, it will start binning records that are still live. Retention should key off the end of the job, not the birth of the document.

English, and what that means for a pile of structured data

The English requirement is rarely a problem for a PDF. It becomes one when the record your system actually stores is a database row or a structured file that only your automation knows how to render. If the human readable invoice is assembled on demand by a tool you may not still be paying for in four years, then what you have retained is not really the record. It is the ingredients.

Keep the rendered document alongside the data. A PDF costs a few hundred kilobytes and remains readable without a subscription.

One thing to do today

Open whatever writes your quotes or invoices and answer a single question: when a document is revised, does the previous version still exist somewhere you could produce it from? Not in an email sent folder, in the system. If the answer is no, you have found the gap, and it is usually a settings change rather than a rebuild.

Then check the retention rule. If it counts from creation rather than completion, change it, or turn automatic deletion off entirely until you have worked out which records are still on the clock.

None of this is an argument against automating your quoting. It is an argument for building it so the audit trail is a by product rather than an afterthought. That is the part most setups skip, and it is exactly the sort of thing we get right when we build and operate a workflow for a client, the automation saves the hours, and the records still stand up when someone asks for them.