Verifactu: Complete Guide to the Invoicing Regulation

Verifactu is the name commonly given to Royal Decree 1007/2023 of 5 December: the regulation that sets out the requirements any accounting software must meet if a Spanish entrepreneur or professional uses it to issue invoices in Spain. It is not a standalone rule. It develops Article 29(2)(j) of the General Tax Law, which Law 11/2021 against tax fraud introduced to eliminate so-called double-use software: programmes that allow maintaining a shadow set of books, concealing sales or doctoring already-issued invoices. Verifactu specifies how an invoicing programme must behave in order to make that technically impossible.

In practice it means three visible changes. Your software will have to generate, for each invoice, a chained record with a cryptographic fingerprint that nobody can alter without leaving a trace. All your invoices will carry a QR code. And you will be able to choose between transmitting those records to the Spanish Tax Agency (AEAT — Agencia Estatal de Administración Tributaria) at the moment of issuing each invoice — the mode that gives the system its name, VERI*FACTU — or retaining them electronically signed on your own equipment. The deadlines, after two postponements, are now final: 1 January 2027 for companies and 1 July 2027 for the self-employed and other obligated parties. This guide covers the entire regulation: who it binds, what it requires from your software, how it differs from mandatory e-invoicing, what fines apply and how to plan the adaptation quarter by quarter.

Who Verifactu binds and from when

Article 3(1) of the regulation defines the obligated parties in four groups:

Corporate Income Tax taxpayers: any trading company that issues invoices, from a sole-member private limited company to a large enterprise.
Personal Income Tax (IRPF) taxpayers carrying on economic activities: the self-employed, whether under the direct assessment or simplified (modules) method.
Non-resident income tax taxpayers operating in Spain through a permanent establishment.
Entities under the income attribution regime with economic activity: civil partnerships and communities of assets, among others.

The regulation also reaches those who manufacture the software. Producers and distributors of invoicing programmes are responsible for ensuring their systems meet the requirements, evidenced by a declaration of conformity that must appear in writing and visibly on each version of the programme (Article 13).

The most significant exclusion is in Article 3 itself: those who already maintain VAT record books through the Immediate Information Supply (SII — Suministro Inmediato de Información) system — large companies, VAT groups and those registered in the REDEME register — are exempt, because the AEAT already receives the detail of their invoicing via that route. Verifactu also does not apply in the foral territories: the Basque Country applies its own system, TicketBAI, and Navarre has its own regional regulation.

Who	Deadline	Legal basis
Companies (Corporate Income Tax taxpayers)	Before 1 January 2027	Final Provision 4, RD 1007/2023
Self-employed (IRPF with economic activity), non-residents with permanent establishment, income attribution entities	Before 1 July 2027	Final Provision 4, RD 1007/2023
SII users	No obligation to adapt software to Verifactu	Art. 3, RD 1007/2023

A note on these dates, because a lot of outdated information circulates: the current wording of Final Provision Four was given by Royal Decree 254/2025 of 1 April (first postponement) and Royal Decree-Law 15/2025 of 2 December (the definitive one). The original schedule referred to July 2025 and there was an intermediate version with 2026 dates. If an old article or a vendor's marketing email gives you different dates, it is citing already-repealed wording.

VERI*FACTU or the "non-verifiable" mode: the two ways to comply

The regulation allows two modes of operation. It is worth understanding them before talking to your software vendor, because the choice has practical consequences in cost, technical burden and relationship with the tax authority. Systems that transmit records receive the official designation of "Verifiable Invoice Issuance Systems" or "VERI*FACTU Systems"; those that do not transmit operate in the so-called non-verifiable mode. Here is how the obligations are distributed:

	VERI*FACTU mode (transmission to AEAT)	Non-verifiable mode (local retention)
Transmission to AEAT	Automatic and at the time of issuance, for all records the programme generates (Articles 15 and 16)	No continuous submission: records are retained in full, readable and accessible, and provided when the AEAT requests them
Electronic signature of records	Not required: the hash alone suffices (Article 16.3)	Mandatory for each registration and cancellation record
System event log	Not required	Mandatory, in addition to the invoicing records
Presumption of compliance	The system complies "by design" with the technical requirements (Article 16.2)	No presumption: the full burden of demonstrating compliance rests on the user
Legend and QR	QR plus the legend "Invoice verifiable at the AEAT electronic headquarters": any client can scan and confirm the invoice is declared	QR without the verifiable legend
Best fit for	SMEs and self-employed with off-the-shelf software	Organisations with proprietary systems and operational reasons not to transmit in real time

Which to choose? For an SME or self-employed person with off-the-shelf software, VERI*FACTU mode will almost always be the shorter path: most vendors are implementing it by default because it spares them the electronic signature of records and the system event log management, and because Article 16(2)'s presumption of compliance reduces the regulatory risk of their product.

Bear in mind that transmitting records does not substitute your VAT returns or add new tax obligations: it is an information channel about the invoices you issue, not a tax.

A naming nuance that avoids confusion: strictly speaking, VERI*FACTU is only the transmission mode. But the term has ended up colloquially naming the entire regulation, and that is how media, advisory firms and vendors use it. In this guide, "Verifactu" is the regulation; "VERI*FACTU mode" is the AEAT transmission option.

What the regulation requires from your invoicing programme

The regulation defines an invoicing computer system (ICS) deliberately broadly: the set of hardware and software used to issue invoices, admitting, retaining and processing their information (Article 1.2). If you issue invoices with a programme — any programme: an ERP, an invoicing app, the shop's point-of-sale terminal — that programme is an ICS and falls within scope.

On that basis, Article 8 imposes six guarantees on invoicing records: integrity, conservation, accessibility, legibility, traceability and inalterability. The most illustrative is the last: once a record is generated, the system must detect and flag any alteration attempt. Deleting an inconvenient invoice and renumbering the subsequent ones — the classic double-use software manoeuvre — becomes impossible without leaving a trace.

How is this implemented? Through a specific mechanism:

Registration record: the system generates it automatically, simultaneously with or immediately before the issuance of each invoice (Article 9). If an invoice is cancelled, a cancellation record is generated; nothing is ever deleted.
Prescribed content: each record includes the issuer's tax ID and name, the invoice number and date, description of the transactions, tax base, VAT amount and applicable regime, among other data (Article 10).
Hash chaining: each record incorporates part of the hash of the previous record. The records form a chain: if anyone alters one, the chain breaks and the manipulation becomes visible.
Electronic signature: in the non-verifiable mode, registration and cancellation records must be electronically signed (Article 12). In VERI*FACTU mode, that signature is replaced by the transmission to the AEAT.
QR code on each invoice: all invoices issued by an ICS include a graphic representation of their partial content via a QR code (Article 6.5 of the invoicing regulation, RD 1619/2012, added by this regulation). The recipient can scan it and voluntarily share that information with the AEAT. The "VERI*FACTU" legend beside the QR only appears when the system transmits the records.
Producer's declaration of conformity: the software producer certifies by means of a declaration of conformity that the system complies, with the details identifying the programme, its version and the producer (Article 13). This is the document you must be able to demand from your vendor.

The detailed technical specification — record format, hash algorithms, QR specifications, exact content of the declaration of conformity — is not in the royal decree but in its implementing rule: Order HAC/1177/2024 of 17 October. This is the rule your software vendor has to be implementing; for the end user it is enough to know it exists and that the declaration of conformity of their programme refers to it.

What if you invoice by hand? The regulation governs computer systems; those who issue invoices entirely on paper, without any programme, do not have an ICS to adapt. That scenario is increasingly residual, however, and the mandatory B2B e-invoicing discussed next will push almost everyone towards software.

Verifactu and mandatory e-invoicing are not the same thing

This is the most repeated confusion in 2026, and it is worth clearing up because they are two distinct obligations, with different rules, calendars and rationales that will coexist.

	Verifactu	Mandatory B2B e-invoicing
What it regulates	How invoices are generated: full and unalterable records, transmitted to the AEAT where applicable	How invoices are exchanged: electronic invoices in structured formats between entrepreneurs and professionals
Purpose	Anti-fraud: tax control	Against late payment: makes payment dates traceable
Regulation	RD 1007/2023	Law 18/2022 ("Crea y Crece") + RD 238/2026 of 25 March
Invoice format	Imposes none: a PDF or paper invoice generated by an adapted ICS, with its QR, complies perfectly	Structured: Facturae, UBL, CII or EDIFACT
Dates	Fixed: 1 January 2027 (companies) and 1 July 2027 (others)	No date on the calendar yet: depends on a pending ministerial order

The regulatory development of e-invoicing, pending for years, now exists: Royal Decree 238/2026 of 25 March accepts four syntaxes and creates a public e-invoicing solution managed by the AEAT, free of charge, which will function as a universal invoice repository and will use UBL syntax.

And its deadlines? Here precision is needed, because part of the mechanism is still pending development. The obligation will be enforceable at 12 months for entrepreneurs with turnover above €8 million and at 24 months for others, but that clock is not yet running: effective application is deferred and linked to the entry into force of the ministerial order activating the AEAT public solution, which as of this guide has not yet been published. Until that milestone arrives, the exact dates of mandatory B2B e-invoicing cannot be put in the calendar; Verifactu's dates can.

The practical consequence: adapting to Verifactu does not leave you ready for e-invoicing, nor vice versa. They are different layers of the same future: software that generates unalterable records (Verifactu) that also issues and receives structured invoices through the exchange channels (Crea y Crece). When choosing or renewing software in 2026, ask about both.

Penalties: Article 201 bis of the General Tax Law

The sanctions regime is not in the regulation but in the General Tax Law, whose Article 201 bis — introduced by Law 11/2021 — classifies two infringements, both classified as serious.

For those who manufacture or sell the software. It is an infringement to manufacture, produce and sell systems that allow keeping separate sets of accounts, failing to reflect or concealing transactions, recording transactions different from those noted, altering ones already recorded, or that fail to meet the technical requirements of Article 29(2)(j) of the General Tax Law. The fine: €150,000 per financial year in which sales occurred and per distinct type of system. Marketing systems without the required certification is penalised at €1,000 per system sold.

For those who use it. Possessing systems that do not comply with what is required, where they are not duly certified when they should be or where certified devices have been altered, is penalised at €50,000 per financial year. The law itself clarifies that those already penalised as manufacturers cannot also be penalised as holders for the same systems.

Two things tend to be overlooked about the fines. The possession penalty does not look at the size of your business: €50,000 per financial year weighs the same on a large company's accounts as on a self-employed person's.

The other: the possession offence turns on the certification required "by regulatory provision" and on system alteration, and the mechanism the regulation has envisaged is the producer's declaration of conformity. Your practical defence as a user is twofold: use software whose declaration of conformity you can produce and never touch its operation. Patching the programme to "adjust" records puts you squarely in the conduct the rule is targeting.

Beyond the fine, there is a less visible effect: from the deadline dates onwards, invoicing with a non-adapted system leaves you in a weak position before any audit, because your own invoicing records will lack the integrity guarantees the inspection will expect to find.

Adaptation plan: from now to 1 January 2027

If you pay Corporate Income Tax, you have two quarters. This is a realistic plan, quarter by quarter, designed to arrive without unpleasant surprises.

Third quarter 2026 (August–September): inventory and questions

List all the points in your business where invoices are issued: management software, point-of-sale terminal, invoicing app, home-made templates. Each is an ICS (or should be).
Write to each vendor with three specific questions: is the version adapted to RD 1007/2023 available? In which mode does it operate (VERI*FACTU or non-verifiable)? Where is the Article 13 declaration of conformity?
If you invoice with Word or Excel templates, assume they will not be able to comply and start evaluating alternatives now (see the FAQ below for the reason).
Check whether you are on the SII; if so, Verifactu is not your concern.

Fourth quarter 2026 (October–December): decision, update and testing

Choose the mode. If your vendor is implementing VERI*FACTU by default, validate that it works for you (issuing from multiple devices, stable connection, invoice volume).
Install the adapted version and issue test invoices in November, not on 30 December: verify the QR appears, the record is generated and, in VERI*FACTU mode, that the AEAT transmission responds.
File the declaration of conformity of each programme you use.
Train whoever invoices in your company: what a cancellation record is (invoices are no longer "deleted"), what the QR legend means and what to say if a client asks.

January 2027: obligation in force for companies

From 1 January, every invoice of a company must be issued from an adapted system. Reserve the first week to monitor the numbering, chaining and transmissions.

First half of 2027 (for self-employed and others): extra time, same script

Your date is 1 July 2027. The same plan works shifted by two quarters, with the advantage that vendors will be well-practised after the January launch. Do not leave it to June; advisory firm schedules at quarter-end closes are what they are.

Frequently asked questions

Is Verifactu mandatory for the self-employed?

Yes. Every Personal Income Tax (IRPF) taxpayer carrying on an economic activity is included in Article 3(1) of RD 1007/2023, under any assessment method. The deadline for the self-employed is 1 July 2027, six months after companies. The only exclusions are those already reporting through SII and those who do not use any computer system to invoice.

Can I continue invoicing in Word or Excel?

As an invoicing system, no. A Word template or an Excel spreadsheet fits the definition of an invoicing computer system as soon as you use it to issue invoices, and there is no reasonable way for it to generate chained records with a hash, unalterable and electronically signed or transmitted to the AEAT, as Article 8 requires. The realistic alternative is adapted software — there are free and low-cost options on the market — or invoicing entirely by hand on paper, which is legal but increasingly unworkable.

Will I have to send all my invoices to the Tax Authority in real time?

Only if you choose VERI*FACTU mode, and in that case it is your programme that does it automatically when issuing; you do not need to do anything. The legal alternative is the non-verifiable mode: you transmit nothing continuously, but your system must sign and retain all records and deliver them when the AEAT requests them. Neither mode changes your VAT returns or your tax deadlines.

What happens if my invoicing programme does not comply?

You are exposed to the possession infringement in Article 201 bis of the General Tax Law, with a fine of €50,000 per financial year in the cases it describes (systems without the required certification or with altered certified devices), as well as the evidential weakness of records without integrity guarantees before any audit. Primary liability for manufacturing or selling non-compliant software rests on the vendor (fines of €150,000 per financial year and type of system), but that does not protect you if you continue using it past your deadline: demand the declaration of conformity and, if your vendor does not have one, change software sooner rather than later.