Indian compliance requirements for an ERP: audit trail, e-invoice, e-way bill, MSME, TDS

Which rules apply to you

Most rules turn on two facts: whether the business is a company, and its turnover. The requirements builder applies these for you.

Audit trail: every company keeping books in software

Since 1 April 2023, a company that keeps its books in accounting software must use software that records an audit trail of every transaction: an edit log of each change, with its date, that cannot be disabled. The rule is a proviso to rule 3(1) of the Companies (Accounts) Rules, 2014, inserted in March 2021 and deferred twice to 1 April 2023. The company's auditor reports on it.

For an ERP that keeps the books, this means the old value, the new value, who changed it and when, for every entry, with no setting anywhere that turns it off. It also means no gap at cutover: the trail has to run through the move from the old system to the new one. See the audit-trail requirement.

E-invoice, and the 30-day limit

From 1 August 2023, registered persons whose aggregate turnover exceeded ₹5 crore in any financial year from 2017-18 must e-invoice: each B2B invoice, credit note and debit note is registered on the invoice registration portal (IRP), which returns an IRN and a signed QR code. Notification 10/2023–Central Tax lowered the threshold from ₹10 crore.

From 1 April 2025, taxpayers with annual aggregate turnover of ₹10 crore and above cannot report a document to the IRP more than 30 days after its date; the portal refuses it. An ERP for such a business should show which invoices are still unreported and how many days each has left. See the e-invoice requirements.

E-way bill

Under rule 138 of the CGST Rules, an e-way bill is needed before goods move with a consignment value exceeding ₹50,000. The ERP should produce it from the invoice and the dispatch, not have someone retype the consignment into the portal at the gate. See the e-way bill requirement.

MSME payment limits, and why they matter for tax

Section 15 of the MSMED Act, 2006 (the MSME payment rule) requires a buyer to pay a micro or small enterprise supplier by the agreed date, and the agreed period can never exceed 45 days from acceptance; with no written agreement, the Act's appointed day applies. Section 16 adds compound interest on late payment.

The Income-tax Act, 2025, in section 37(2)(g), allows the deduction for an amount owed to such a supplier only when it is actually paid, if it is paid beyond that limit, and the usual grace until the return due date doesn't apply to it. So the ERP needs to know which suppliers are micro or small enterprises, and show each of their bills with its due date. How the rule applies to a particular business, a trader for example, is a question for your CA. See the MSME requirements.

TDS on purchase of goods

Under the Income-tax Act, 2025, a buyer whose turnover exceeded ₹10 crore in the preceding tax year deducts tax on payments to a seller for goods beyond ₹50 lakh in the year (TDS on purchases) (section 393(1), table row 8(ii), formerly section 194Q). The provision is a table, so it is cited here rather than quoted: read row 8(ii) and its note in the Act. The ERP has to keep each seller's running total for the year and start deducting on the bill that crosses it. See the TDS requirement.

Personal data

A business holding digital personal data, of employees, customers or contacts, is a data fiduciary under the Digital Personal Data Protection Act, 2023. Section 8 requires reasonable security safeguards to prevent a personal data breach and intimation of a breach in the prescribed way. For an ERP, that means access to personal details limited by role and logged, and a way to see who saw what. The Digital Personal Data Protection Rules, 2025 (13 November 2025) set out how: the safeguards (rule 6) and breach intimation, including a detailed report to the Board within 72 hours (rule 7), come into force eighteen months after publication, in May 2027 (rule 1(4)). The Act's own sections are brought into force by separate notification, so check which are in force when you buy. If the system comes with an AI assistant, see what it sends out. See the personal-data requirement.

What changed, and when

What to ask a vendor

Ask the vendor to do each test on the checklist, in front of you: change an entry and show the audit trail; generate an IRN for a test invoice; list the invoices that are near the 30-day limit; produce an e-way bill from a dispatch; show an MSME supplier's bills with due dates. A vendor who can't show it doesn't have it yet. Ahrom Labs states its own gaps the same way: it has not yet built an IRP connection, and its e-way bill client is built but not yet live.

Quoted from the official text (10) ›

“has a feature of recording audit trail of each and every transaction, creating an edit log of each change made in books of account along with the date when such changes were made and ensuring that the audit trail cannot be disabled”

Companies (Accounts) Rules, 2014, rule 3(1), proviso

“the figures, letters and words “1st day of April, 2023” shall be substituted”

Companies (Accounts) Second Amendment Rules, 2022

“the words “five crore rupees” shall be substituted”

Notification No. 10/2023–Central Tax

“taxpayers with an AATO of 10 crores and above would not be allowed to report e-Invoices older than 30 days from the date of reporting on IRP portals”

GSTN advisory, 5 November 2024

“consignment value exceeding fifty thousand rupees”

CGST Rules, 2017, rule 138

“Provided that in no case the period agreed upon between the supplier and the buyer in writing shall exceed forty-five days from the day of acceptance or the day of deemed acceptance”

MSMED Act, 2006, section 15, proviso

“amount payable by the assessee to a micro or small enterprise beyond the time limit specified in section 15 of the Micro, Small and Medium Enterprises Development Act, 2006”

Income-tax Act, 2025, section 37(2)(g)

“reasonable security safeguards to prevent personal data breach”

Digital Personal Data Protection Act, 2023, section 8(5)

“Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication”

Digital Personal Data Protection Rules, 2025, rule 1(4)

“within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing in this behalf”

Digital Personal Data Protection Rules, 2025, rule 7(2)(b)