VERI*FACTU: requirements for the software you invoice with

Andrés runs a hardware shop in Burgos set up as a sociedad limitada. He invoices with a program he bought ten years ago for €300, and his supplier now offers an upgrade 'for VERI*FACTU' at €180 a year. Andrés does not know whether it is compulsory or from when. He has heard that the law fines certain non-adapted programs €50,000 per financial year, and read on a forum that everything started in 2026. Before signing anything, he needs the exact rule and the date in force.

Two different obligations that are often confused

Spain has two reforms that are announced together but do not regulate the same thing. One requires the program used for invoicing to be reliable and tamper-proof: that is the regulation known as VERI*FACTU. The other requires businesses to exchange structured electronic invoices with each other. This module covers the first; the next one, the second.

The preamble of Real Decreto 1007/2023 says so itself: there are significant differences between e-invoicing rules, which govern how invoices are documented, kept and transmitted, and the requirements for the computer systems that support invoicing. The two sets of rules are compatible and complement each other, but neither replaces the other.

The Agencia Tributaria puts it more bluntly on its website: invoicing records do not contain all the information on an invoice and are never electronic invoices. A business subject to VERI*FACTU may keep issuing paper invoices, provided its program generates the record that the regulation requires.

Where the obligation comes from

The starting point is article 29.2.j) of Ley 58/2003, the General Tax Law. It requires producers, sellers and users to ensure that systems supporting accounting, invoicing or management processes guarantee the integrity, retention, accessibility, legibility, traceability and unalterability of records, with no changes that go unrecorded.

The same article lets a regulation set technical specifications, require programs to be certified and require standard formats. That regulation is the one approved by Real Decreto 1007/2023 of 5 December, technically developed by Orden HAC/1177/2024 of 17 October, which came into force on 29 October 2024.

Article 8 turns the law into concrete demands. Once generated, a record cannot be altered without the system detecting it and warning the user. Any correction or cancellation is made through at least one further, later record, so the original data stay intact. Deleting a record without the system detecting it stops being possible.

The same article requires records to be chained so their trail can be followed from first to last, correctly dated, kept for the period set by the General Tax Law and exportable to external storage in a readable format. It adds an event log that automatically records certain interactions with the system.

Who is bound and what falls outside

Article 3.1 applies the regulation to anyone who uses a computerised invoicing system, even if only for part of their business. The list covers almost everyone who invoices from a program:

• Corporate income tax payers, except the fully exempt entities of article 9.1 of Ley 27/2014
• Self-employed people and other personal income tax (IRPF) payers carrying on a business
• Non-resident income tax payers with a permanent establishment
• Income-attribution entities carrying on a business
• Producers and sellers of the programs, for their production and sales activity (article 3.2)

Article 3.3 leaves out those who keep their VAT books under article 62.6 of the VAT Regulation, that is, businesses already reporting their invoicing to the Agencia Tributaria in near real time. Article 4 also excludes certain transactions, such as those invoiced by permanent establishments located abroad.

The obligation arises from using a computer system to invoice: someone who invoices without any program does not have to buy one. And the regulation applies in the common tax territory; as regards the Basque Country and Navarre, it only reaches those whose tax domicile is in common territory, under article 1.3.

The Agencia Tributaria sums up the scope in four conditions: invoicing with a program, not being in the SII, no tax domicile in the Basque Country or Navarre, and no non-application decision under article 5. The Canary Islands, Ceuta and Melilla are included. Under the equivalence surcharge, with no general duty to invoice, only invoices issued with a program count.

The invoicing record

Article 9 requires the program to generate an invoicing record automatically, at the same time as or immediately before each invoice is issued. It is not a copy of the invoice but a structured summary of tax and security data, whose format is set out in the annex to the ministerial order.

Article 10 lists its content. It includes the issuer's tax number and name, the recipient's where required, the invoice number and series, the issue date and the transaction date, the invoice type, a general description, the total amount, the VAT scheme applied, the taxable base, the rate and the VAT amount.

Control data are added to the invoice data: the identification of the previous record with part of its hash, the code of the computer system and of its producer, and the date, hour, minute and second of generation. All amounts are expressed in euros, converting those of invoices issued in another currency.

When an invoice has been issued in error, article 11 provides for a cancellation record, carrying the cancelled invoice's data and the same chaining elements. The original record is not deleted: a new record is added that shows the cancellation, in line with the general unalterability rule of article 8.

Hash, chaining and signature

Each record carries a hash, calculated according to the order's specifications. Because it includes part of the previous record's hash, the records form a chain: removing or changing one breaks the sequence and is detected. This is the technique that makes it possible to check that no invoice has been left out.

Article 12 also requires both issue and cancellation records to be electronically signed. There is an important exception in article 16.3: systems that send all their records to the Agencia Tributaria need not sign them, because calculating the hash is enough. That difference shapes the choice of mode.

Two modes: send or keep

The Agencia Tributaria describes two valid modes. In VERI*FACTU mode, the system sends every record it generates to the tax authority's website, continuously and automatically. In non-VERI*FACTU mode, the system keeps the records, signed, and hands them over when the authority asks for them.

Choosing VERI*FACTU requires no prior application: under article 16.5, the choice is made by systematically starting to send records, and it lasts at least until the end of the calendar year of the first actual submission. Article 17 of the order requires it until 31 December of the last year in which the system has operated as VERI*FACTU.

What changes on the invoice: the QR code and the legend

Through article 6.5 of the Invoicing Regulation, the reform adds two visible elements to full and simplified invoices. First, a QR code representing part of the invoice's content; on an electronic invoice it may be replaced by the content it represents. Second, the legend 'Factura verificable en la sede electrónica de la AEAT' or 'VERI*FACTU'.

The legend may only appear when the system sends all records to the Agencia Tributaria. A program in record-keeping mode prints the QR code but not the legend. Printing it without sending the records would give the customer a false guarantee about the invoice they receive.

The order sets the code's format: between 30x30 and 40x40 millimetres, following standard ISO/IEC 18004, with a medium error-correction level. It holds the address of the checking service and invoice data, starting with the issuer's tax number. The legend must use a clearly visible typeface, similar to the rest of the invoice.

The software producer's declaration

The regulation does not create any prior official approval. Article 13 makes the producer certify, through a responsible declaration, that its program complies with the General Tax Law, the regulation and the order. The declaration must be in writing, visible in the system itself for each version, and given to the customer on purchase.

For Andrés, the consequence is concrete. Before paying for an upgrade, he can ask the supplier for the declaration covering the version he is about to install, which the producer must keep for every version. Without that document, nothing shows that the program has been adapted.

The Agencia Tributaria's free application

Article 7 allows compliance with an in-house or commercial program that respects the regulation, or with the application the tax authority develops. That application counts as a VERI*FACTU system for all purposes, and the tax authority's website already gives access to its invoicing application.

It has limits worth knowing before choosing it. Under the order, it may only be used to invoice in one's own name or through an authorised representative, requires electronic identification, and every invoice must have a recipient. The Agencia Tributaria adds that it only accepts full invoices, not simplified ones, and no invoices with several recipients.

A timetable postponed twice

The VERI*FACTU dates have changed several times. According to Real Decreto 254/2025 of 1 April, the date originally planned was 1 July 2025; that decree moved it to 1 January 2026 for companies and 1 July 2026 for everyone else.

Real Decreto-ley 15/2025 of 2 December amended the fourth final provision of Real Decreto 1007/2023 once more. Its preamble explains the urgency: without that reform, the requirements would have applied from 1 January 2026. The BOE published its validation by a Resolution of 11 December 2025.

The consolidated BOE text, last updated on 3 December 2025, reads as follows on the reading date, 3 October 2026: corporate income tax payers must have adapted their systems before 1 January 2027, and all other obliged parties before 1 July 2027.

The Agencia Tributaria describes the time before those dates as a testing period. During it, a business may stop sending records from a VERI*FACTU system and invoice with another program, without the stay until year-end being compulsory. After the deadline, the minimum-stay rule applies in full.

These dates have already changed twice: Real Decreto 254/2025 and Real Decreto-ley 15/2025. Before fixing an adaptation plan, check the latest update of the fourth final provision of Real Decreto 1007/2023 in the BOE.

The penalties of article 201 bis

Article 201 bis of the General Tax Law, added by Ley 11/2021, defines two serious offences. The first covers making, producing or selling programs that allow separate sets of accounts, hide transactions, record different ones or alter those already recorded, or that fail the technical specifications or are not certified.

That offence carries €150,000 for each financial year with sales and for each different type of program; where the only defect is missing certification, €1,000 per program sold without a certificate. The second offence covers possessing programs that are uncertified when certification is required, or that have been altered: €50,000 per financial year.

The same article rules out stacking them: anyone penalised for making or selling a program cannot also be penalised for possessing it.

Users worry mostly about possession. In its FAQs the Agencia Tributaria answers a common question: keeping the old program only to consult past invoices is not penalised if the business can show that it no longer allows invoices to be issued, for instance by uninstalling it or blocking that function.

The same answer warns that, after 1 January 2027 or 1 July 2027 as the case may be, merely possessing a non-adapted program able to issue invoices would be an offence. The tax authority recommends exporting the old records rather than keeping the program.

What to do before the deadline

The first step is to identify your own date: company or self-employed. The second is to list every program that issues invoices, including the shop-counter terminal and the online store. The third is to ask each supplier for the declaration covering the adapted version and to choose a mode.

Finally, plan the retirement of the old program: export its history in a readable format, check that the export is complete, then uninstall it or block invoicing. A business that chooses VERI*FACTU will also find that the list of records on the tax authority's website makes its VAT returns easier to prepare.