Contents
- Ten years, counted from the end of the financial year
- Why this matters for AI work
- Five entries a replay log keeps for every case
- What the law requires, and what it means in an AI workflow
- How to test whether your log holds up a year later
- What a replay log does not do
- The first step: one question to your tool, one process
- Frequently asked questions
Key points
- Under Art. 958f of the Swiss Code of Obligations (CO), accounting records and vouchers must be kept for ten years, counted from the end of the financial year.
- An accounting voucher is any record needed to verify the transaction behind an entry (Art. 957a para. 3 CO). In our understanding, where an agent helps post entries, the trail of its proposal belongs to that record.
- For rewritable storage, including the cloud, the GeBüV requires a procedure that ensures integrity, tamper-proof evidence of when data was stored, and retention of the related logs.
- Each case in a replay log has five entries: the incoming document with its checksum, the rule version, the agent's proposal, the approval with name and decision, and the result.
- The test of a log: someone who was not involved replays a case from a year ago, using only what was filed.
Ten years, counted from the end of the financial year
The basic rule is in Art. 958f of the Code of Obligations: accounting records, accounting vouchers, the annual report and the audit report must be kept for ten years, and the period begins when the financial year ends. If the financial year matches the calendar year, a receipt from January 2026 has to be kept until the end of 2036. Records and vouchers may be kept on paper, electronically or in a comparable way, provided they correspond to the underlying transactions and can be made readable again at any time.
The Federal Council sets the rules for electronic storage in the ordinance on accounting records, known as GeBüV and published in German, French and Italian. Non-rewritable media such as paper are allowed without further conditions. For rewritable media, meaning hard drives, servers and, according to the federal SME portal, cloud storage, Art. 9 GeBüV asks for more: a technical procedure that ensures integrity, such as a digital signature; tamper-proof evidence of when the data was stored, such as a time stamp; and retention of supporting information such as logs and log files.
The GeBüV dates from 2002, applies in its 2013 version and does not mention AI once. It speaks of vouchers, work instructions and logs. The practical question for any business using agents is where these three arise in an AI workflow. And whether they will still be there in ten years.
Why this matters for AI work
In many offices, a tool already helps with the bookkeeping. It reads a receipt, proposes an account and a VAT code, and someone clicks accept. In an audit, a VAT inspection or a query from a client, someone will want to know years later why an entry looks the way it does. The answer lies in a proposal made by a machine and an approval given by a person.
That is exactly where the gap is. Many automation and AI tools keep their run history for a set period that depends on the subscription or a setting, usually far shorter than ten years. After that, what the agent read and proposed, and who accepted it, is gone. The receipt and the entry are still there. The path between them is missing.
In our understanding, that path is part of the accounting. Art. 957a para. 3 CO defines an accounting voucher as any record needed to verify the transaction behind an entry. Art. 4 GeBüV requires processes, procedures and programs to be documented so that records and vouchers can be understood. Which parts of an AI workflow fall under this in your business is a question for your auditor or legal adviser. A full log from the start spares you answering it later under time pressure.
Five entries a replay log keeps for every case
A replay log is a record that lets you replay a single case later, step by step. What an agent is and how approval works in principle is covered in AI in the fiduciary office, explained simply.
- Incoming document
- The file the agent read, stored unchanged, with the time it arrived and a checksum. A checksum is a digital fingerprint: change a single character in the file and the checksum changes. Years later, it shows that the file is the same one.
- Rule version
- The plain-language rules the agent worked to on that day, with a version number and the date from which they applied, plus the AI model and its version. A case from back then is replayed with the rules from back then.
- Proposal
- What the agent proposed, stored unchanged: account, VAT code, amount, and every point it flagged as unclear, with its location in the document.
- Approval
- Who decided, when and how: accepted, changed or rejected. Where something was changed, the old and new values sit side by side. The person is recorded by name, not through a shared login.
- Result
- What ended up in the system, with the entry number that links the case to the accounts.
If one of the five entries is missing, the case can only be told as a story. The rule version is the easiest to lose: rules get adjusted, and nobody keeps the old wording. For work instructions, the GeBüV requires the opposite: keep them up to date and retain them as long as the records kept under them (Art. 4 para. 2 GeBüV).
What the law requires, and what it means in an AI workflow
| What the law requires | What it means in an AI workflow |
|---|---|
| Ten years of retention from the end of the financial year (Art. 958f para. 1 CO) | The log of a case lasts as long as the entry, even if the tool or the provider changes. |
| Correspondence with the transaction, readable at any time (Art. 958f para. 3 CO) | The original incoming document, in a format readable without the AI tool, such as PDF/A. |
| Changes must be detectable (Art. 3 GeBüV) | Every document has a checksum. A correction is added as a new entry, and the old one stays. |
| Processes, procedures and programs documented, work instructions kept as long as the records (Art. 4 GeBüV) | Every rule version and every model version stays on file, with the date from which it applied. |
| Archive protected from unauthorised access, access recorded (Art. 8 GeBüV) | Anyone who reads or exports logs is recorded. The agent counts as an access like any other. |
| Rewritable media: integrity, time of storage, logs and log files (Art. 9 GeBüV) | Every entry carries a time stamp and sits in storage where nothing can be overwritten unnoticed. |
| Data migration only complete and logged (Art. 10 GeBüV) | When you change tools, the logs move with you, and the transfer itself is logged. |
| Inspection by an authorised person within a reasonable time (Art. 6 GeBüV) | A case can be found and read without the person who built the agent. |
The left-hand column paraphrases the CO and the GeBüV; the right-hand column is our translation, not an official interpretation. Nearly all of the work is filing and discipline. Very little of it is technology.
How to test whether your log holds up a year later
No provider's data sheet tells you whether a log holds up. You find out by replaying an old case with someone who was not involved, using only what was filed.
- 01Draw a casePick an entry that an agent proposed about a year ago. Drawn at random, not the tidiest one.
- 02Check the inputSomeone not involved at the time finds the incoming document and compares its checksum with the log.
- 03Rule and proposalThey open the rule version from back then and check whether the agent's proposal follows from that rule and that document.
- 04ApprovalThey read off who approved it, when and with what decision. Where something was changed, the old value must sit next to the new one.
- 05ResultThey find the entry in the system and compare it with the approved proposal.
The test is passed when that person can answer every step without asking anyone. Every question they have to ask is a finding: a missing entry, a rule that was overwritten, a name that only appears as “admin”. Repeat the test once a year, for example after the annual closing, and file the result. Art. 10 GeBüV already requires storage media to be checked regularly for integrity and readability.
What a replay log does not do
- You still need an archive that meets the GeBüV. The replay log explains how an entry came about and belongs in that same archive.
- A wrong entry stays wrong. The log shows where the error arose: in the document, the rule, the proposal or the approval.
- What you are obliged to keep is for your auditor or legal adviser to decide, not for the log.
- If approval is a click without reading, the log records a click. How an approval has to be built so that it actually checks is covered in the article on the four-eyes principle with AI agents.
The first step: one question to your tool, one process
First ask your current tool how long it keeps run logs and whether they can be exported in full. The answer is in the settings or the provider's contract. If it is under ten years, the five entries need an archive you control yourself.
Then take one process with many similar cases, such as recording receipts, where every case has the same structure. The article on shoebox receipts describes what an agent proposes there and what a person approves, and the Shoebox Calculator counts how many receipts pass through your office each month. At Grow Amplified, every agent has an approval step and a replay log from day one, and the documentation is written during the build. The steps are set out under Approach.
Frequently asked questions
Do I have to keep my AI tool's logs for ten years?
Art. 958f CO requires ten years for accounting records and vouchers, and an accounting voucher is any record needed to verify the transaction behind an entry. Which parts of an AI log belong to that in your case depends on the workflow. Check it with your auditor or legal adviser. If you keep the five entries as long as the receipts, you will not have to resolve the question after the fact.
Is the history in the chat or automation tool enough as evidence?
Usually not as the only record. Such histories are often limited in time, tied to the subscription and in some cases can be edited or deleted. Export the five entries per case into an archive you control yourself.
Can the replay log be stored in the cloud?
According to the federal SME portal, cloud storage is not a non-rewritable medium. The conditions for rewritable media therefore apply: proof of integrity, tamper-proof evidence of the time of storage and retention of the logs. Where the data sits and who can access it is also a data protection question.
What is a checksum, and do I need special software for it?
A checksum is a short string of characters calculated from the content of a file. If the file changes, the checksum changes. Common operating systems can calculate it without additional software. What matters is that it is calculated on arrival and stored in the log.
What happens to the logs if I change tools?
The retention period keeps running. The GeBüV allows data to be moved to other formats or media, provided completeness, accuracy, availability and readability are preserved, and it requires the transfer to be logged. Export everything before you cancel a subscription.
15 years in banking and consulting, in transformation and finance operations. Today he builds review lanes with Grow Amplified: agents read and reconcile, a person approves, and a replay log records who decided what.