Form No. 26: Your Accounting Software Is Now a Tax Audit Disclosure

A disclosure that names your software

For twenty years the tax audit report asked about your accounts. It did not ask where they were kept, because for most of those years the answer was a cupboard.

That has changed. The Income-tax Rules, 2026 were notified on 20 March 2026 by Notification 22/2026 (GSR 198(E)) and came into force with the Income-tax Act, 2025 on 1 April 2026. Two provisions in them matter to every business that keeps its books on a computer, which is every business.

Rule 46 sets the standard your electronic books must meet. Form No. 26, the new tax audit report, makes your auditor certify against it — by IP address, by country.

This is a small change in the drafting and a large change in exposure. A rule nobody can see you breaking is a rule most businesses will get around to. A rule your own auditor has to write down is a different thing entirely.

What Rule 46 actually says

The Income Tax Department set out the position in its own FAQ on Form No. 26. Books of account maintained in electronic form must "mandatorily remain accessible in India at all times, and a daily backup shall be maintained in India-located servers".

Read it slowly, because there are two separate obligations in one sentence and businesses routinely satisfy one and not the other.

• Accessibility in India at all times. You must be able to reach the live books from India whenever asked. A cloud service reachable over the internet from an office in Pune generally satisfies this, whatever continent the server is on.
• A daily backup on a server located in India. This is a physical-location test, and it is the one that fails. The backup copy has to sit on hardware inside the country, and it has to be taken every day, not weekly and not when someone remembers.

You can be fully compliant on the first limb and completely non-compliant on the second. Most businesses running foreign-hosted cloud accounting are in exactly that position right now.

What Form No. 26 asks your auditor

Form No. 26 is the audit report under Section 63 of the Income-tax Act, 2025, read with Rule 47 of the Income-tax Rules, 2026. It corresponds to the old Section 44AB, Rule 6G and Forms 3CA, 3CB and 3CD.

Per the Department’s FAQ, where books are kept electronically the auditor must furnish three specific data points: the IP address of the server on which the accounting information is held, the country in which that server is located, and the address of the India-located backup server.

That third item is the one to sit with. It presumes the backup server exists. There is no field for "none".

The four parts of Form No. 26

So the structure is familiar. A company audited under the Companies Act, 2013 files Parts A, B and C. A firm or proprietorship not otherwise subject to audit files Parts A, B and D. What is new is the content of Part B.

Which year does this actually hit?

This is where most of the confusion sits, and it is worth being exact, because getting it wrong in either direction costs you.

The Income-tax Act, 2025 has been in force since 1 April 2026, but it governs income from that date onward. The return in front of you this month is still a 1961 Act return. Our companion piece on whether the new Act applies to the return you are filing now sets that out in full.

The practical consequence is a deadline that reads as generous and is not. Your first Form No. 26 covers the year that started on 1 April 2026 — the year you are trading through right now. The books being examined for that server disclosure are the books you are writing today. The report itself is filed well over a year from now. The daily India backups have to have been running for the whole of that year, which means the fix belongs in this quarter, not in next year’s audit file.

Who is inside the tax audit net

Form No. 26 only matters if you are subject to tax audit. Under Section 63 the thresholds are:

• Business — total sales, turnover or gross receipts above ₹1 crore.
• Business, higher threshold — ₹10 crore, available where cash receipts and cash payments are each 5 per cent or less of the respective totals. Both tests must be met, not either.
• Profession — gross receipts above ₹50 lakh.
• Presumptive opt-out cases — where you declare income below the presumptive rate and your total income exceeds the exemption limit, audit is triggered regardless of turnover.

Form No. 26 is due one month before the return due date under Section 263(1). Where the return is due 31 October, the report is due 30 September. It must carry a UDIN and be signed by an Accountant as defined in Section 515(3)(b). Our income tax audit guide covers the wider audit process.

One point that gets missed by businesses just under the line: Rule 46 is not a tax audit rule. It applies to the maintenance of electronic books generally. Falling below the audit threshold means nobody certifies your server position — it does not mean the requirement stops applying to you. If you cross the threshold in a later year, the earlier books are still the books.

Where your books actually live

Here is the question almost nobody has asked their finance team: which country is our accounting data in?

For desktop software the answer is wherever the machine is, which is usually straightforward. For cloud accounting it is decided by which regional instance of the product you signed up to, and that decision was probably made years ago by whoever clicked through the signup, on the basis of nothing.

How to check for yourself, in about ten minutes

• Log in to your accounting software and read the domain in the address bar. For Zoho, .in and .com are different data regions holding different organisations.
• Open the account, subscription or organisation settings and look for a data-centre, region or data-residency field. Screenshot it.
• Open your vendor invoice or order confirmation and look for the region on the line item.
• Raise a support ticket asking two questions in writing: in which country is our production data stored, and in which country is our backup stored. Keep the reply.
• If you run anything self-hosted, ask your IT provider for the physical location of the server and of the backup target. "The cloud" is not an answer to either question.

If your books turn out to be on a foreign server

You have three routes, and they differ mainly in cost and disruption.

1. Switch region within the same product

Cleanest where it is available. Some vendors will move an account between data regions, or let you re-provision in an Indian region and import. Expect this to be a migration in practice rather than a settings toggle — chart of accounts, opening balances, historical transactions and integrations all have to come across. Ask about it first, because when it works it is far cheaper than the alternatives.

2. Move to an India-hosted product

The realistic answer for most small and mid-sized businesses. Moving from a US-hosted cloud ledger to an India-region one, or back to a desktop ledger with a properly configured Indian backup target, resolves both limbs of Rule 46 at once. It is a project, not an afternoon: plan a clean cutover at a period end and reconcile both systems before you switch off the old one. Our Tally to Zoho migration service and QuickBooks Desktop to Online migration exist for exactly this kind of move.

3. Keep the foreign system and add an India backup

Viable, and often the pragmatic choice for a group already standardised on a global ERP. You export daily to a server located in India and retain it. What matters is that it is genuinely daily, genuinely automated, genuinely in India and genuinely restorable — a nightly export nobody has ever tested restoring is a file, not a backup. Get the India server address on record, because your auditor has to write it into Form No. 26.

If you are not sure which of the three fits, an accounting software audit will establish where your data sits, what it would take to move it, and what the migration risk actually is before you commit to anything.

The evidence pack your auditor will ask for

Assemble this once and the audit conversation takes twenty minutes instead of three weeks. Assemble it after the year has ended and you will be reconstructing something that cannot be reconstructed.

• A written statement from your software vendor naming the country of production data storage for your account.
• The IP address of the production server, or the vendor’s statement of it for a multi-tenant cloud service.
• The address of the India-located backup server, including the hosting provider and the physical data-centre location.
• Evidence that the backup runs daily — scheduler configuration plus a log covering the year, not a screenshot of one successful run.
• A restore test, dated, with a note of what was restored and by whom.
• A short internal note recording who owns this process, so the answer is not "the person who left".

Mistakes worth avoiding

• Assuming an Indian vendor means Indian hosting. It does not follow. Several India-headquartered products place new signups in non-Indian regions depending on the signup route.
• Treating replication as backup. A cloud provider replicating across its own foreign regions gives you resilience, not an India-located backup.
• Backing up to a laptop. It is in India, and it will not survive the laptop.
• Leaving it to the auditor. Your auditor certifies the position; they do not create it. There is nothing they can do in September about a backup that was not running in April.
• Waiting for further clarification. The Department has already published its FAQ. Whatever else is clarified later, daily India-located backups will not stop being required.
• Forgetting the group. Subsidiaries, an LLP holding the intellectual property, a dormant company with a nil balance sheet — every entity that maintains electronic books is inside this, not just the trading one.

Key takeaways

• Form No. 26 is the tax audit report under Section 63 read with Rule 47, in four parts, replacing 3CA, 3CB and 3CD from tax years commencing on or after 1 April 2026.
• The return you are filing now still uses the old forms.
• Rule 46 requires electronic books to be accessible in India at all times and backed up daily on India-located servers. These are two separate tests.
• Form No. 26 requires the auditor to disclose the server IP address, the country of location, and the India backup server address.
• The compliance is being tested through the year that started 1 April 2026, which is why the check belongs in this quarter.

Frequently asked questions