Sif compliance and veri*factu: requirements, timelines and adaptation strategies

The regulatory context applicable to invoicing systems in Spain has undergone a profound transformation as a result of the Regulation establishing the requirements to be adopted by the systems and software that support invoicing processes (RRSIF) -approved by Royal Decree 1007/2023, of 5 December, approving the Regulation establishing the requirements to be adopted by the systems and computer or electronic programs that support the invoicing processes of entrepreneurs and professionals, and the standardisation of invoicing record formats (hereinafter RRSIF). and its technical development by means of Order HAC/1177/2024, of 17 October.

This new framework, popularly known as SIF/VeriFactu, imposes obligations both on manufacturers of invoicing software and on the entrepreneurs and professionals who use them, with the aim of guaranteeing the integrity, traceability and inviolability of invoicing records, as well as reinforcing the fight against tax fraud.

At ECIJA we have analysed in depth the content of the RRSIF, the HAC/1177/2024 Order and the technical and legal implications of its compliance, both for developers and user companies. This briefing note sets out in a clear and practical way the key elements you need to know in order to adapt properly and avoid risks of non-compliance.

What is the SIF and what is VeriFactu?

The Computerised Invoicing System (SIF) is the set of tools, programmes or devices that allow an entrepreneur or professional to record sales transactions and issue invoices or tickets. Since the entry into force of the RRSIF, all systems used in Spain must comply with common and verifiable standards.

Within the SIF, the regulations offer two modalities:

• Standard SIF (without automatic sending to the AEAT): In this modality, the computerised invoicing system complies with all the requirements of the Regulation: it generates the invoicing records in full, traceable and signed form, incorporates their hash, records the mandatory events and produces the standardised files. The essential difference is that it does not automatically send the records to the Tax Agency. The entrepreneur simply uses the system as an internal invoicing tool, with no additional obligation to send invoices to the AEAT, as the SIF regulations do not introduce new supply obligations.
• VeriFactu system: This is a voluntary modality of the SIF in which the system automatically forwards each invoice record to the Tax Agency as soon as it is generated.

There are advantages to using VeriFactu:

1. It reinforces the presumption of veracity of the records.
2. It reduces the risk of extensive checks.
3. It allows to automate formal obligations.

Essential obligations for software manufacturers

The regulations impose an extensive and detailed set of technical requirements on developers of invoicing software. The main ones include

• Inalterability of records: Each invoice must be incorporated as an unalterable record, cryptographically chained by means of a "hash" that connects each invoice with the previous one. This prevents subsequent deletion or manipulation.
• Mandatory digital signature: Each invoice record must be electronically signed in accordance with the requirements defined in Order HAC/1177/2024.
• Generation of the registration file (XML): The software must automatically generate a structured file with the minimum data established, in accordance with the standard format published by the AEAT.
• QRcode on invoices and tickets: All documents delivered to the customer (full and simplified invoices) must include a QR code, except for very specific exceptions (e.g. tickets delivered in cases of technical impossibility or pre-existing machines that cannot be updated during the transitional period). The QR allows the content of the invoice and the integrity of the record to be verified.
• Prohibition of double counting: The software must ensure that it does not allow parallel entries, deletions or alterations without traceability.
• Auditing and traceability: The system must incorporate a complete log of events, including accesses, errors, modification attempts and internal operations.
• Delivery of the "Document of Compliance" to the user: The manufacturer must issue a document certifying that the software complies with the requirements of the RRSIF.

Obligations for companies and professionals 

For their part, businesses and professionals using invoicing systems also have direct responsibilities:

• Mandatory use of RRSIF-compliant software: It will be mandatory for all trades and businesses to use certified SIFs. This affects both issuers of full invoices and simplified invoices (tickets).
• Retention of records: Invoicing files must be kept for the legally established period, unless sector regulations require longer.
• Immediate availability: In the event of a requirement from the AEAT, the company must be able to export and deliver the records in the standard format.
• Information visible on invoices: In the case of using VeriFactu, the indication of automatic sending to the AEAT must appear on the invoice.
• Control of old equipment: Traditional cash registers must be adapted or replaced.

Timetable for the implementation of the SIF and the VeriFactu system

The timetable for the implementation of the Computerised Invoicing System (SIF), set by Royal Decree 1007/2023 and its technical implementing regulations, establishes three main milestones:

1. 29 July 2025 - Manufacturers and marketers: as of this date, all manufacturers and marketers of invoicing software must have their systems fully adapted to the RRSIF and Order HAC/1177/2024. The programs must comply with all the functional, technical and security requirements, which can be accredited by means of the corresponding Document of Compliance.
2. 1 January 2026 - Entrepreneurs and companies: From this date, entrepreneurs and companies must compulsorily use a Computerised Invoicing System in accordance with the RRSIF for issuing invoices and simplified invoices, regardless of whether or not they opt for the VeriFactu modality.
3. 1 July 2026 - Self-employed workers: As of 1 July 2026, the obligation to use a SIF is also extended to self-employed workers, who must issue their invoices and tickets exclusively through systems that comply with the RRSIF requirements.

Consequently, 2025 is the key period for technical adaptation, especially for manufacturers, and 2026 marks the full entry into force of the new certified invoicing model for the entire business fabric.

How ECIJA can help you

Our multidisciplinary team, with experience in technology law, taxation, regulatory compliance and design of trustworthy systems, can accompany you throughout the process of implementation or adaptation to the SIF/VeriFactu:

For manufacturers

• Technical and legal audit of the software.
• Review of the data structure and signature mechanisms.
• Advice on the implementation of QR, XML files and hashes.
• Elaboration of the Document of Compliance and support for its delivery to clients.
• Review of contracts, EULA and licence terms.
• Preparation of technical manuals and internal policies.

For user companies

• Evaluation of your current billing system and compliance diagnosis.
• Risk analysis and adaptation plan.
• Support in the selection of suitable software.
• Training of internal staff.
• Preparation for audits and AEAT requirements.

At ECIJA we offer our legal-technical knowledge and experience with the requirements of the RRSIF to accompany companies and developers in the process of adaptation in a safe, efficient and aligned way with the regulations.

For any additional queries or to initiate a diagnostic process, we remain at your disposal.

Information note prepared by the Data Protection area of ECIJA Madrid.