If you invoice from Spain, the software you use to create those invoices is about to be regulated. Not the tax on them, not the format you send them in, but the program itself: how it records each invoice, whether that record can be quietly edited afterwards, and what proof exists that it was not. That is VeriFactu, Spain's new regulation of invoicing software, and for a rule that touches every business in the country, it is remarkable how much of what circulates about it is wrong.
The biggest confusion is the date. For most of the last year, the calendar said companies would be obliged from January 2026 and autónomos from July 2026, and a large share of the articles you will find today still say exactly that. Then, in December 2025, the government approved a last-minute delay, and the whole timetable moved by a year. So here is the situation as it actually stands in August 2026: nobody has missed a deadline, the deadlines are real, and the businesses that use the extra year well will spend a fraction of what the businesses that scramble in June 2027 will.
What VeriFactu actually is
VeriFactu is the common name for Spain's regulation of invoicing software, formally the Reglamento de Requisitos de los Sistemas Informáticos de Facturación, or RRSIF, approved by Real Decreto 1007/2023 under the 2021 anti-fraud law. Its purpose is blunt: make it technically impossible to cook the books. For years, so-called dual-use software let a business keep one set of records for itself and a lighter one for Hacienda. VeriFactu closes that door by regulating the record at the moment of creation.
In practice it means that from your deadline onwards, every invoice you issue through a computer, a till, an app, or an online tool must be produced by a system that meets the technical requirements, and the Agencia Tributaria can verify that it does. The penalties are not decorative. Using non-compliant invoicing software carries a fixed fine of €50,000 per financial year, and the developers who build or sell such software face €150,000 per year. The vendor's incentive to comply is therefore even sharper than yours, which is good news, because it means the market has largely done the technical work already. Your job is narrower: make sure the tools you actually use are on the right side of the line, and that your process around them holds up.
How VeriFactu works under the hood
The day-to-day experience of issuing an invoice barely changes. What changes is what happens in the background. Each time you create an invoice, a compliant system generates a billing record alongside the visible document. That record carries a digital fingerprint, a hash, which is chained to the fingerprint of the previous record, so the sequence forms an unbroken line. If anyone deletes an invoice or alters one after the fact, the chain no longer adds up and the manipulation is technically evident. The system must also lock records against editing, keep an event log of everything that happens inside it, number invoices automatically and correlatively against a protected clock, and print a QR code on every invoice it produces.
On top of that foundation sit two ways of operating, and the choice between them is the one real decision the regulation asks of you.
| What differs | VERI*FACTU mode | Non-VeriFactu mode |
|---|---|---|
| What happens to each record | Sent to the Agencia Tributaria as it is created | Stays in your system |
| Who guards the records | Hacienda holds a copy | You do, intact and signed, for four years |
| The QR on the invoice | Your customer can verify it on the AEAT site | Present, but not checkable against Hacienda |
| Signatures and event logs | Handled by the act of submission | You must sign every record and preserve the full chain |
| If Hacienda comes asking | They already have the data | You must export signed records on demand, gaps sanctionable |
The technical process of hashing and chaining is identical in both modes. What differs is custody. In VERI*FACTU mode the record goes straight to the tax agency and your invoice carries the legend that it is verifiable at the AEAT's electronic office. In the other mode you keep everything yourself, which sounds like privacy and behaves like liability: a failed disk, a ransomware incident, or a botched software migration can break the chain you are legally required to preserve, and a broken chain is itself sanctionable. For most small businesses with nothing to hide, sending the records is simply the lighter way to live, and it is worth knowing that Hacienda cross-checks submitted records against VAT returns in close to real time, which means clean submitters are also the least interesting inspection targets.
Who VeriFactu applies to, and who is exempt
The obligation covers businesses and self-employed professionals in common-territory Spain who use any computerized means to issue invoices. It does not matter whether your customers are Spanish or foreign; what matters is that you invoice from Spain with software.
The exclusions are specific. Large companies already reporting VAT through the SII are exempt, because they answer to a stricter regime that sends invoice data to Hacienda within four days as standard. Businesses in the Basque Country and Navarra follow their own foral systems, TicketBAI among them, rather than VeriFactu. Autónomos taxed under módulos sit outside the obligation for now, though nobody should build a plan on that exemption surviving forever. And a business that genuinely invoices by hand, on paper, with no software involved, is technically out of scope, which describes almost nobody who will read this.
The trap in the middle is the spreadsheet. An invoice template in Excel or Word is invoicing software in the eyes of the regulation, and it is invoicing software that can never comply, because it cannot chain records, lock them, or log events. If your invoices are born in a spreadsheet today, the question is not whether you change, only when and to what.
VeriFactu is not the e-invoice law, and the difference matters
VeriFactu is routinely confused with Spain's other invoicing reform, the mandatory B2B electronic invoice under the Crea y Crece law, and conflating them causes businesses to either panic twice or prepare for the wrong thing. They regulate different layers. VeriFactu governs how the invoice record is created and protected inside your system. The e-invoice mandate governs the structured format in which you will eventually have to deliver invoices to other businesses.
The e-invoice regulation, Real Decreto 238/2026, was published in March 2026, but its countdown only starts when a further ministerial order lands, which at the time of writing it has not. Realistically that puts the largest companies into obligation around late 2027 and everyone else around 2028, after VeriFactu. The practical takeaway is sequencing: solve VeriFactu first, and solve it with tools that already speak structured formats, so the second law arrives as a configuration change rather than a second migration.
How to prepare for VeriFactu between now and your deadline
The work is smaller than the noise around it suggests, and almost all of it is diagnostic rather than technical. Start by finding every place in the business where an invoice is actually born, because there are usually more than the official one: the accounting tool, yes, but also the till in the shop, the booking system that issues receipts, the one client who still gets a Word document because they always have. Every one of those points either becomes compliant or stops issuing invoices.
Then ask each vendor on that list one question in writing: will this product be VeriFactu compliant under the RRSIF, in which modes, and from what version. Compliant products have been legally required on the market since July 2025, so any vendor who cannot answer plainly is telling you something. If the answer is no, or the answer is an upgrade fee that makes your eyes water, this is the moment to weigh alternatives with clear eyes rather than under deadline pressure, the same build-versus-buy reasoning that applies to any system you depend on.
Choose your mode deliberately. For most small businesses we would default to VERI*FACTU mode: no four-year custody burden, no signed-export fire drills, and a QR your customers can actually verify. Then use the migration to tidy what the regulation will expose anyway, invoice series, numbering, how corrections and credit notes are handled, because a system that chains every record is unforgiving of improvised habits.
And do it in 2026. Every advisor and software firm in the country is staring at the same two dates, the January one and the July one, and the queue in the final quarter before each will be long and expensive. The delay was a gift of calendar. It was not a suggestion to stop thinking about it.
The opportunity hiding in the chore
Here is the part of this story nobody regulating it will tell you. The law is about to force almost every small business in Spain to open up its invoicing and touch it, some for the first time in a decade. You can treat that as a compliance cost, swap one program for another, and end up exactly where you started but legal. Or you can notice that the slowest part of your cash flow just became a construction site with the fences already up.
Compliance makes your invoices tamper-proof. It does nothing about the ones nobody has paid. If you have to rebuild the pipe anyway, rebuild the whole pipe.
Because the record-keeping is the easy half of invoicing. The half that hurts is everything around it: invoices that go out late because someone has to remember to send them, reminders that never get written because chasing feels awkward, and no single view of who owes what. Those are not regulatory problems, they are context problems, the system does not know your payment terms, your tone with clients, or which customer always pays on the second nudge. That is precisely the gap our Business Brain exists to close: for €2,995 we write the business down properly within five business days, including how money is supposed to come in, and our Get Paid application reads from it, invoices that send themselves on compliant rails, reminders that chase politely in your voice, and a clear picture of who owes what. Compliance becomes a property of the system instead of a project you repeat, and what the work actually costs is priced in the open, like everything else we do.
Either way, the sequencing advice stands even if you never speak to us: do not buy software in a panic to satisfy a deadline, and do not satisfy the deadline without asking what else the same change could fix.