What UK law requires of your ERP system

When a finance director asks about ERP legal requirements, the real question is practical: which rules does the software have to help me meet, and what happens if it does not? In the UK the answer is a short list of obligations, mostly enforced by HMRC and the Information Commissioner's Office (ICO). This guide walks through each one, explains what your ERP must do, and gives you the questions to put to the vendor and to the integrator before you sign.

No ERP is "compliant" in the abstract. Compliance is a property of a configured system, run by trained people, with documented processes. That is why ERP compliance is as much a matter of choosing the right integrator as of choosing the right product.

The UK compliance map at a glance

British rules are less prescriptive about the software itself than those in some European countries. There is no national certification scheme for accounting packages. Instead, HMRC defines what the software must be able to do, and leaves you to prove it.

Cash-register rules are not a concern here: the facts we rely on cover no dedicated till-certification regime, so the question is simply whether your point-of-sale data flows cleanly into the ERP and the VAT account.

VAT: registration, rates and the VAT account

What the rule says

The standard rate of VAT is 20%, and it has applied since 4 January 2011, when it replaced 17.5%. A reduced rate of 5% covers items such as children's car seats and domestic energy, and a zero rate of 0% covers, for example, most food and children's clothing. Some supplies, including postage stamps and financial or property transactions, are exempt.

A business must register when its taxable turnover over the last 12 months exceeds £90,000, or when it expects to exceed that figure within the next 30 days. That threshold has applied since 1 April 2024. Registration must be requested within 30 days of the end of the month in which the threshold was crossed, and takes effect on the first day of the second month after the breach. Late registration can bring penalties. A business below the threshold may register voluntarily, and a business not established in the UK must register from its first taxable supply, whatever the amount.

What the ERP must do

Your ERP needs a tax engine that handles four distinct treatments: standard, reduced, zero-rated and exempt. The difference between zero-rated and exempt matters, because it changes what input VAT you can recover. The system should let you assign treatments at product, customer and transaction level, and report each category separately.

If you are close to the threshold, the ERP should also give you a rolling view of taxable turnover, so that the 30-day test does not catch you out.

What to check

• Ask the vendor how VAT codes are maintained when rates or categories change, and who is responsible for updating them.
• Ask the integrator how exempt and partially exempt income is mapped to the chart of accounts.
• Test a mixed invoice (standard, reduced and zero-rated lines) end to end before go-live.

VAT returns and Making Tax Digital for VAT

What the rule says

A VAT-registered business generally files a VAT return with HMRC every 3 months, its "accounting period", and must file even if no VAT is due or reclaimable. The online filing deadline is normally one calendar month and 7 days after the period ends, which is also the payment deadline.

Making Tax Digital (MTD) for VAT requires VAT-registered businesses to keep digital records and to file returns using software. It started in April 2019 for the first businesses, and all registered businesses are now signed up without having to act. The software must be "functional compatible software": able to keep the required digital records, to prepare the return from those records, and to communicate with HMRC through its application programming interface (API).

Data must move between programs through digital links. Manual entry and copy-and-paste are not accepted; API transfers, CSV or XML imports and linked spreadsheet cells are. Submission to HMRC must always use the API, which can be done through bridging software or an API-enabled spreadsheet. Exemptions exist where MTD is impractical, for example because of disability, location, insolvency or a religious belief incompatible with electronic communication.

What the ERP must do

A modern ERP should hold the VAT account, build the nine boxes of the return from posted transactions, let your finance team review them, and submit directly to HMRC with a recorded audit trail. It should also support the obligations that surround filing: viewing liabilities and payments, and keeping a clear link between each return and its source entries.

Our dedicated Making Tax Digital guide for ERP users covers the digital-link chain in more detail.

What to check

• Is the filing function native, or does it rely on a third-party bridge? Both are acceptable if every link is digital, but the second adds a component to maintain.
• Who holds the HMRC authorisation, and how is it renewed?
• How does the system prove that no manual step interrupts the data journey?
• If your group runs several companies or branches in one ERP, how is each VAT registration kept separate?

Record keeping and retention

What the rule says

Businesses must generally keep VAT records for at least 6 years, longer if other taxes require it. Records include the VAT account, copies of invoices issued to VAT-registered customers, bank statements, cash books, purchase and sales invoices, import and export documents, till rolls and relevant correspondence.

All VAT-registered businesses must keep and preserve certain records digitally in functional compatible software. The complete set of digital records does not have to sit in one program, but some documents, such as the C79 import VAT certificate, must stay in their original form.

What the ERP must do

The ERP should store invoices and supporting documents against the transactions they support, keep them for the full period, and make retrieval fast when HMRC asks. Attachments matter as much as postings. Where the original document must be preserved, the system or your process should keep it intact, not just a transcription of its figures.

What to check

• Retention settings: can you set a period by document type, and can the system prevent premature deletion?
• Cloud hosting: what happens to your records if you leave the vendor, and in what format can you export them?
• Archiving: are older years moved to cheaper storage without losing searchability?
• Access: who can alter or delete a posted document, and is every change logged?

Making Tax Digital for Income Tax

What the rule says

This regime affects sole traders and landlords registered for Self Assessment, depending on qualifying income. It starts for those above £50,000 (tax return 2024-2025) from 6 April 2026, for those above £30,000 (2025-2026 return) from 6 April 2027, and for those above £20,000 (2026-2027 return) from 6 April 2028. HMRC looks at the Self Assessment return to decide qualifying income; to decide who was caught in April 2026, it examined the 2024-2025 return.

The first quarterly update, covering the first three months of the tax year, was due by 7 August 2026, and no penalty points apply to late updates in the first year. A quarterly update does not replace the annual tax return, which is still due on 31 January. The Income Tax (Digital Obligations) Regulations 2026 (SI 2026 No. 336), made on 23 March 2026 and in force from 1 April 2026, require functional compatible software to keep digital records and send updates, and replace the 2021 and 2024 regulations.

What the ERP must do

For most limited companies this regime does not apply directly, because it is aimed at individuals. It matters in an ERP project when your customers, subcontractors or owner-managers are in scope, or when you build software for a group of self-employed professionals. If you are such a business, your ERP or its companion tools must produce the quarterly updates from digital records.

What to check

Ask the vendor whether income tax updates are part of the product or a separate module, and ask the integrator whether your own situation falls in scope at all.

Payroll, RTI and National Insurance

What the rule says

Under Real Time Information (RTI), the employer reports pay, payroll-integrated benefits and deductions in a Full Payment Submission (FPS) to HMRC on or before the employee's payday, with limited exceptions. An Employer Payment Summary (EPS) must be sent by the 19th of the following tax month for HMRC to apply a reduction, such as for statutory payments, to the amount due. It also replaces the FPS when no employee was paid in a tax month.

A late FPS can be sent with an exception code: code F for an employee paid less than £96 a week or who has worked fewer than seven days (report within 7 days), or code G for a reasonable excuse (within a month).

Payroll software records pay, calculates the tax and National Insurance contributions deducted, calculates employer contributions on earnings above £242 a week, and produces payslips, which may be created in other software if the first cannot. The statement of what is owed to HMRC is available from the 10th of the following tax month, and payment is due on the 22nd (the 19th if paying by post cheque).

What the ERP must do

If payroll sits inside the ERP, it must produce correct FPS and EPS files, apply the right codes for deductions, and give your payroll team a clear reconciliation between pay run, journal and amount due. If payroll is external, the ERP must at least receive a clean payroll journal.

Our guide to payroll software and RTI in an ERP goes into the decision of integrated versus separate payroll.

What to check

• Does the vendor offer a native UK payroll, or is it a partner product? Whichever it is, who supports it when HMRC changes a specification?
• Can the ERP generate payslips, or is another tool needed?
• How are late-submission exceptions recorded?

Pension auto-enrolment

What the rule says

An employer must automatically enrol into a workplace pension any "worker" aged 22 up to State Pension age who earns at least £10,000 a year and usually works in the UK. For 2026-2027 the earnings trigger is £10,000 a year (£768 per four-week period), the lower qualifying earnings limit is £6,240 and the upper limit £50,270, all unchanged from 2025-2026. The Department for Work and Pensions reviews these thresholds each year, effective 6 April.

An employer need not contribute for a worker earning no more than £520 a month, £120 a week or £480 over four weeks, although the worker may still opt in. The employer may defer automatic enrolment by up to 3 months (longer for some types of scheme), must write to the worker on enrolment, and must not encourage or force an opt-out.

What the ERP must do

Payroll inside the ERP should test each worker against age and earnings every pay period, enrol those who qualify, calculate contributions on the right earnings band, and produce the communications and records required. Because thresholds change every April, the vendor must update them reliably.

What to check

Ask how thresholds are updated, how postponement is recorded, and whether pension files can be sent to your provider directly from the system.

E-invoicing: what is coming

What the rule says

In its response to the consultation on promoting electronic invoicing, the government announced that e-invoicing will become mandatory for all invoices subject to VAT from 2029. It covers business-to-business and business-to-government transactions; consumer sales are excluded, and the smallest businesses not registered for VAT will not be required to adopt it. The UK has chosen a decentralised model, with no central platform through which invoices pass, and that position did not change after consultation. Real-time transaction reporting will not be introduced in 2029, only once e-invoicing is well established.

What the ERP must do

Prepare for structured, machine-readable invoices that can be issued and received without re-keying. The decentralised model means your ERP, or your network provider, carries the burden of exchange.

Our guide to e-invoicing in an ERP sets out the options in more depth.

What to check

Ask each vendor for its roadmap on structured invoices, and ask the integrator how it would connect your supplier and customer invoices once the rules are detailed. Do not pay for a premature module; do insist on a credible route.

UK GDPR and data protection

What the rule says

Article 5 of the UK GDPR sets out seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability. The ICO lists seven lawful bases for processing: consent, contract, legal obligation, vital interests, public task, recognised legitimate interests and legitimate interests. You must determine and document the basis before you start processing.

A personal data breach that risks people's rights and freedoms must be reported to the ICO as soon as possible and, where feasible, within 72 hours. If the risk is high, the people affected must also be told without undue delay.

Organisations, including sole traders, that process personal data must pay an ICO data protection fee unless exempt, in three tiers: £52 for micro-organisations (turnover up to £632,000 or no more than 10 staff), £78 (up to £36 million or 250 staff) and £3,763 for large organisations. Paying by direct debit earns an automatic £5 discount.

The ICO states that the next phase of the Data (Use and Access) Act came into force on 5 February 2026, covering most remaining data protection provisions, except the duty to have a complaints procedure, which applies from 19 June 2026.

What the ERP must do

An ERP holds customer, supplier and employee data, and payroll data in particular is sensitive. It must offer role-based access, audit trails, the ability to correct or erase data where the law allows, controlled retention, and encrypted storage and transfer. It must also support the breach process, since you cannot report in time what you cannot detect.

What to check

• Where is the data hosted, and who are the sub-processors?
• Is there a data processing agreement, and does it cover the integrator's own access during the project?
• Can the system anonymise test data, so that your sandbox does not copy live payroll?
• Who, in your company, owns the register of lawful bases and the complaints procedure?

How the main ERP products respond

Each product reaches UK compliance in its own way, and none is exempt from the questions above.

• Sage: a long-established name in UK accounting and payroll, which makes MTD and RTI familiar territory. Check how the ERP edition, rather than the small-business accounting product, handles your requirements.
• Microsoft Dynamics 365 Business Central: a cloud ERP for growing companies, usually extended with localisation components and, for payroll, partner solutions. Ask which are maintained for the UK.
• Odoo: modular and configurable, so UK compliance depends on which apps and localisation modules your integrator installs and maintains.
• Oracle NetSuite: a cloud suite suited to multi-entity businesses. Confirm how VAT filing and payroll are delivered for UK subsidiaries.

We are neutral between vendors, and the same checklist applies to every one of them. If you are still comparing products, our guide on how to choose an ERP gives a selection method.

The integrator's role in compliance

Software that can comply is not software that does comply. The integrator configures VAT codes, sets up HMRC authorisations, maps the chart of accounts, tests pay runs and builds the retention rules. Ask for a compliance section in the project plan, a named person responsible for each obligation above, and test evidence before go-live.

When you choose an ERP integrator, request references from UK clients who have been through a VAT or payroll audit, and ask how the integrator handles changes when HMRC publishes new specifications. How our matching works explains how we pass your requirements to suitable integrators, free of charge.

A short checklist before you sign

1. List your obligations: VAT, MTD for VAT, payroll, auto-enrolment, data protection, and any group-specific rules.
2. For each, name the ERP function, the person responsible and the test that proves it.
3. Ask the vendor for written confirmation of the UK features included in your licence.
4. Ask the integrator to document the configuration and hand over a compliance file.
5. Plan for change: thresholds move every April, and e-invoicing is on the way.

A final point: legislation moves, and this guide is general information, not legal or tax advice. Confirm your own position with your accountant or tax adviser before relying on any of it.

Software names mentioned are trademarks of their respective publishers and are referred to for information only. This site is independent and is not affiliated with any software publisher.