Rolling Out a DMS in 5 Steps: A Roadmap to GoBD-Compliant Document Management

Somewhere between the shared drive, the email inbox, and three differently named folder structures sits the answer to an unglamorous question that comes up in almost every mid-market company: where is last October’s invoice? Anyone who can’t find it right away is in good company - and anyone who does find it has usually burned several minutes that were needed somewhere else. A document management system (DMS) is supposed to put an end to exactly that: a central, searchable, legally sound archive for invoices, contracts, delivery notes, and correspondence.

The reason so many DMS rollouts disappoint has little to do with the software itself. It comes down to the order in which decisions get made. Pick a tool first and only think about structure, retention duties, and legacy documents afterward, and the same clutter just moves house into a newer, more expensive system. The five steps below lay out the sturdier order - along with the points where mid-market projects most often get stuck in practice.

Step 1: Settle Folder Structure and Metadata Before Picking a Tool

Before any vendor gets a call, it should already be clear how documents will be categorized and retrieved going forward. This is organizational work, and it can’t be outsourced to a piece of software - a DMS enforces whatever order you hand it, it doesn’t invent one of its own.

Document Classes Instead of Deep Folder Trees

Nested folder hierarchies like “Customers > A-K > Company > 2024 > Invoices” work noticeably worse inside a DMS than on a shared drive, because they’re rigid and barely scale as the archive grows. A flatter model built around a handful of document classes holds up much better - incoming invoice, outgoing invoice, contract, delivery note, HR record, correspondence - each with its own metadata fields: document date, business partner, amount, cost center, responsible person, retention period. Search then runs through filters and full text, instead of guessing the right folder path.

Nail Down Ownership and Required Fields Early

Every document class needs an owning department that decides which fields are mandatory on filing and who gets access. In practice, a two- to three-day workshop with the relevant teams - accounting, sales, purchasing, HR - pays for itself before software selection even starts. Companies that skip this step end up migrating the same unsorted pile of documents into a system with a better search bar, nothing more.

Step 2: Build GoBD Requirements In From the Start

The German principles for the proper keeping and retention of books, records, and documents in electronic form (GoBD) apply to any system that manages tax-relevant records, well beyond the accounting department’s own filing needs. Check them only after go-live, and you’ll often be retrofitting technology or redesigning processes you thought were finished.

The core obligations, in brief:

• Retention periods: 10 years for books, receipts, and invoices (§ 147 of the German Fiscal Code), 6 years for business correspondence
• Immutability: once archived, a document can’t be altered without a trace - enforced technically through checksums, versioning, or tamper-evident storage
• Process documentation: a written record of how documents are captured, indexed, archived, and secured - auditors ask for this document during every tax audit
• Timely capture: records should be entered within a few days of receipt, not batched up until the end of the quarter
• Data access for tax authorities: under § 147(6) of the Fiscal Code, auditors can demand direct read access (Z1), analysis using their own criteria (Z2), or a data carrier in a defined export format (Z3)

Destroying the Paper Original: Fine, But Document the Process

Companies that want to shred paper records after scanning should follow the German BSI’s TR-RESISCAN guideline: quality control right after the scan, a two-person check for sensitive documents, and a logged sign-off before destruction. A DMS that doesn’t support these steps forces you to keep running a parallel paper archive - which is exactly the extra effort digitization was meant to remove.

Step 3: Configure OCR and Full-Text Search Properly

Optical character recognition (OCR) is the engine behind full-text search - and the component most likely to disappoint expectations. Clean, machine-generated PDFs recognize at accuracy rates above 98%. Badly scanned faxes, handwritten notes, or multi-column forms drag that down noticeably, sometimes well below 90%.

Pair full-text search consistently with the mandatory metadata from Step 1: an invoice that’s findable by supplier, date, and amount is far more reliable than one that only surfaces through a randomly recognized snippet of text. For incoming mail, automatic document splitting via barcode or QR-code separator sheets is worth setting up too - it cuts down manual pre-sorting during scanning considerably, especially for multi-page batch scans. Before signing anything, also check whether the OCR engine handles German and English documents equally well if you buy or sell internationally.

Step 4: Migrate Legacy Files, But With a Sense of Proportion

The instinct to scan the entire ten-year archive in one sweep is understandable - and in most cases a poor use of money. External scanning bureaus in Germany typically charge 5 to 15 euro cents per page, depending on prep work (removing staples, sorting, inserting separator sheets). For a grown archive of 200,000 pages, that adds up to €10,000-€30,000 fast, for documents that mostly never get opened again.

A more workable approach is a two-way triage:

• Active records: documents from the last two to three years, plus anything still accessed regularly in daily operations - migrate fully and tag with metadata.
• Legacy archive: older records still under a retention obligation stay in their original state - paper or an existing PDF archive - and get logged in the DMS only via a box or year-range index, so they can be located within minutes if needed, say during a tax audit.

This split keeps migration costs predictable and puts the bulk of the effort where it actually pays off: the records people use day to day.

Step 5: Selection Criteria, Timeline, and Cost for SMEs

Only once structure, GoBD requirements, and migration scope are settled does vendor selection actually begin. Six criteria decide most projects, for better or worse:

Criterion	What to check
GoBD compliance	Confirmed by an auditor or a recognized certification body, not just a vendor’s marketing claim
Hosting location	Data center in the EU, ideally Germany, with a data processing agreement under Art. 28 GDPR
ERP/accounting integration	Interface to DATEV, Lexware, SAP, or whatever ERP system is already in use
Search and OCR quality	A test run with your own, realistic documents before signing
Roles and permissions	Granular enough for department boundaries without turning maintenance into a full-time job
Scalability	A licensing model that grows with user count and document volume

For timeline and cost, ranges from comparable mid-market projects are a useful guide: for companies with 20 to 150 workstations, rolling out a cloud DMS - including the concept phase, configuration, and training - typically takes 8 to 14 weeks. Add deeper ERP integration or a substantial legacy migration, and that stretches to 4 to 6 months.

Two pricing models dominate the market. Cloud solutions run €8-€25 per user per month, plus a one-time €5,000-€25,000 for setup, data migration, and training. On-premise solutions require a bigger upfront budget of €15,000-€80,000 for licenses and infrastructure, but run afterward without a recurring per-user fee. For most mid-market companies with a lean IT team, cloud is the lower-risk entry point, if only because updates, backups, and GoBD-relevant certifications sit with the vendor.

Conclusion: Structure Before Software, Software Before AI

A DMS pays for itself once employees find a document faster than they used to in a folder, and the next tax audit passes without a scramble. Both outcomes come more reliably when folder structure and GoBD compliance are settled before the software decision, rather than patched in afterward. The order in this article - structure, legal framework, search, migration, then selection - fits into six to twelve weeks of upfront work and heads off expensive corrections down the line.

Once the DMS is running, it’s worth looking ahead to the next stage: AI-assisted analysis of the archived PDFs, for example to flag contract deadlines automatically or push invoice data straight into downstream systems. We cover how that works in Evaluate PDF Documents with AI.

If you’re planning a DMS rollout, we can help with the concept phase, vendor selection, and a GoBD-compliant implementation - get in touch.