Documents often contain personal data, from names and addresses to citizen service numbers. The GDPR requires you to process no more data, and keep it no longer, than necessary. At the same time, statutory retention periods apply: you generally need to keep invoices for seven years for the Dutch Tax Administration, or ten years if they relate to immovable property. A scan replaces the paper original only if it is an accurate and complete reproduction, including features that establish authenticity. The extracted fields therefore do not replace the document; the original remains linked to the accounting entry.
This is particularly worthwhile for documents you cannot standardise yourself, such as invoices from many suppliers or forms submitted by citizens. If you use a language model in Azure, the deployment type determines where processing takes place: with Global, this may be in any region where the model runs; with Data Zone in the EU, it remains within EU member states. If your data platform runs on Databricks, processing can also take place there, using functions such as ai_parse_document and ai_extract.
Invoice and delivery note processing is not on the AI Act’s list of high-risk applications. The situation is different when the outcome helps determine decisions about people, such as screening job applications or assessing an application for benefits. Following the postponement under the AI omnibus, the obligations for those applications apply from 2 December 2027. We help you identify the applications, prepare their risk classification and establish arrangements for human oversight, including within AI governance. Your legal counsel or compliance team decides on the legal interpretation.