VeriFactu Software · 2027 Guide

Comply with VeriFactu without surprises

Signed, chained records verifiable directly by the AEAT on every invoice. This guide covers the RD 1007/2023 regulation, the definitive deadlines under RD 254/2025, and how to comply without the hassle — before the €50,000 penalty becomes a real risk.

Start free with Cofactu Browse the guide by topic
Companies Jan 1, 2027 Self-employed Jul 1, 2027
Invoice accepted by the AEAT SHA-256 hash + .p12 signature Verification QR on the AEAT site Data hosted in the EU
50.000 €

fixed penalty per fiscal year for using non-compliant software (art. 201 bis LGT)

2027

mandatory: January 1 for companies, July 1 for the self-employed (RD 254/2025)

May 2026

first Cofactu invoice accepted in the AEAT's official test environment

What it is and when it applies

The verifiable system that the Ley Antifraude makes mandatory

VeriFactu (RD 1007/2023) requires every invoicing software to generate signed records, chained by hash, with a verification QR. These are the definitive deadlines and the regulations behind them.

29 Jul 2025 Software manufacturers Software sold from this date must be compliant. RD 254/2025
1 Jan 2027 Corporate Tax (Impuesto sobre Sociedades) Mandatory for companies (SL, SA…). RD 254/2025
1 Jul 2027 Self-employed (IRPF) and others Mandatory for everyone else. RD 254/2025

Legal framework

Base law Ley 11/2021, art. 29.2.j LGT Ley Antifraude BOE 10/07/2021
Technical regulation RD 1007/2023 VeriFactu requirements BOE 05/12/2023
Technical specification Orden HAC/1177/2024 XML formats and fields BOE 28/10/2024
Deadline extension RD 254/2025 Extension of dates BOE 2025
Technical requirements

What your software must do to be compliant

Required by RD 1007/2023 and Orden HAC/1177/2024. Compliant software meets all of them, not just some.

Record chain intact
F-2026-0141 e8b2…1c07
F-2026-0142 7b1e…d4a0
F-2026-0143 c4a0…9f33
Key requirement

Chained SHA-256 hash + signature

Every invoicing record includes the digital fingerprint of the previous invoice in its series and is signed with your digital certificate (.p12). Modifying any record breaks the chain — detectable by the AEAT at any time.

  • SHA-256 fingerprint of the previous invoice in every record
  • Electronic signature with your .p12 certificate
  • Altering a record breaks the chain, no exceptions
Mandatory verification QR

Every invoice issued with invoicing software from the compliance date must carry the QR code with the verification URL on the AEAT site.

System event log

The software must log relevant events (start-up, shutdown, errors, configuration changes) with a timestamp, with no way to delete them.

Tamper-proofing and retention

Records are immutable once generated and must be kept for the tax statute-of-limitations period. They can't be corrected — only voided and reissued as a new record.

Ability to submit to the AEAT (VeriFactu mode)

If the software opts into VeriFactu mode, records must be transmittable to the AEAT in real time. In exchange: the official logo and a lighter burden of proof.

Two modes

VeriFactu with or without submission to the AEAT

The regulation allows both. Cofactu implements submission because it reduces the burden of proof and grants the right to the official logo and the verification QR on the AEAT site.

Cofactu's mode

VeriFactu (with submission)

Invoice
AEAT
CSV received
Burden of proof under inspection Low

The software sends every record to the AEAT in real time when the invoice is issued. The AEAT returns a confirmation CSV. Grants the right to the 'Verifiable invoice' logo and the verification QR on its site.

  • Official 'Verifiable invoice on the AEAT site' logo.
  • QR linking to the AEAT site.
  • Lighter burden of proof under inspection.
  • Immediate confirmation of receipt.

Cofactu adopts this mode: first invoice accepted in the AEAT sandbox in May 2026.

Also valid

No VeriFactu (without submission)

Invoice
Sealed and kept locally
Burden of proof under inspection High

The software meets all the technical requirements (hash, signature, event log, tamper-proofing) but doesn't send records to the AEAT. Allowed under the regulation, but with a heavier burden of proof.

  • Doesn't depend on the availability of the AEAT's servers.
  • Legally valid as long as all other requirements are met.
  • No right to the 'Verifiable invoice' logo or the verification QR on the site.
  • You must be able to prove the integrity of the records under inspection.

Cofactu recommends submission. If you use other software, check that it meets all the technical requirements even if it doesn't submit.

Penalty regime

The fine is fixed, no matter your size

Art. 201 bis of the Ley General Tributaria doesn't scale with revenue: it's a fixed amount per fiscal year. Complying on time is far cheaper than a single penalty.

  • 50.000 € per fiscal year — use of non-compliant software (business owner / professional user)
  • 150.000 € per fiscal year and system type — manufacturing or selling non-compliant software (manufacturer / seller)
See penalties and calculator

Art. 201 bis LGT

Using non-compliant software
50.000 €/fiscal year
Manufacturing or selling it
150.000 €/fiscal year
Complying with Cofactu
from €0/month

«A user who holds or uses non-compliant invoicing software will be fined €50,000 per fiscal year.»

VeriFactu record Accepted
Record status
Correct
First invoice accepted
May 2026
Environment
AEAT sandbox

Secure verification code

A-MMURGK5EJUWRZU

Compliant for real, not just on paper
Cofactu doesn't just «support VeriFactu» in a footnote: its first invoice was already accepted by the AEAT's official servers.

Chained SHA-256 hash, signature with a .p12 certificate, verification QR on every invoice, and real-time submission with its confirmation CSV. Plus automatic detection and repair of the chain (error 4171) if something breaks.

May 2026
first invoice accepted in the AEAT sandbox
€0
to get started — 10 invoices/month, no card
How Cofactu invoices
Compare your options

Cofactu vs. the AEAT's free app

Both generate VeriFactu-compliant invoices. The difference is everything else.

AEAT App
Free · invoicing only
 Cofactu
Full tax suite
Generates VeriFactu-compliant invoices
SHA-256 hash, electronic signature, and QR
Real-time submission to the AEAT
Accounting and journal
Tax forms (Modelo 303, 130, 111…)
POS (point of sale)
Multi-user (team or accounting firm)
API for integrations
Price Free From €0 · €15/month unlimited

More questions about your situation?

Reach out — real people, replies within 24 business hours.

Contact us

See the full comparison with the AEAT app →

Guide by topic

Five key questions, five complete answers

Each link leads to a dedicated page with a direct answer, data tables, and FAQ.

Mandatory status

Is VeriFactu mandatory?

Who's required to comply, who's exempt (SII, regional tax authorities), and what happens if you invoice by hand.
Deadlines

Official dates and deadlines

The definitive calendar with RD 254/2025 deadlines: manufacturers, companies, and the self-employed.
Penalties

Penalties: €50,000 per fiscal year

The penalty regime under art. 201 bis LGT. Interactive calculator included.
Tax QR

The QR code on receipts

Also mandatory on simplified receipts in hospitality and retail: format, size, and deadlines.
Comparison

The AEAT's free app

What the AEAT's official app covers, its objective limits, and when it's not enough.
Art. 13 RD 1007/2023

Responsible declaration

What it is, who issues it, and why you should demand it from your software provider.

FAQ

Questions, answered.

The essentials of VeriFactu: what it is, when it applies, penalties, and modes.

Talk to our team See the official dates and deadlines
What exactly is VeriFactu?

VeriFactu is the verifiable invoicing system regulated by RD 1007/2023 (Ley Antifraude, Ley 11/2021, art. 29.2.j LGT). It requires every invoicing software to generate records signed with a chained SHA-256 hash, a verification QR on every invoice, and an immutable event log. It comes in two modes: with submission to the AEAT (VeriFactu mode) and without submission (No VeriFactu mode).

When does VeriFactu become mandatory?

According to RD 254/2025, the definitive deadlines are: software manufacturers and sellers from July 29, 2025; Corporate Tax (Impuesto sobre Sociedades) taxpayers from January 1, 2027; the self-employed and others (IRPF) from July 1, 2027.

Does the AEAT's free app comply with VeriFactu?

Yes, the AEAT's free invoicing app generates VeriFactu-compliant records. However, it has significant objective limitations: basic invoicing only, no accounting, no POS, no multi-user support, no API, no filing of tax forms. For businesses with more than 2-3 invoices a month or additional needs, a full solution like Cofactu is the practical choice.

What's the difference between VeriFactu and TicketBAI?

They're different systems. VeriFactu is the state-level system for common territory (managed by the AEAT). TicketBAI is the equivalent system in the Basque Country (Araba, Bizkaia, Gipuzkoa), managed by the regional Haciendas Forales. Navarre has its own system. If you operate in these regional territories, TicketBAI applies, not VeriFactu.

How much is the penalty for non-compliance?

Art. 201 bis of the Ley General Tributaria sets a fine of €50,000 per fiscal year for a user who holds or uses non-compliant software. For manufacturers and sellers of non-compliant software, the penalty is €150,000 per fiscal year and system type. The amount is fixed, regardless of the size of the business.

What is the VeriFactu responsible declaration?

It's the document by which the software producer certifies that its system meets the requirements of RD 1007/2023 and Orden HAC/1177/2024. Users must verify that their software has one available — using software without a responsible declaration after the deadlines is equivalent to using non-compliant software.

Comply with VeriFactu without surprises

Start free with 10 invoices/month, no card required. Hash, signature, QR, and submission to the AEAT — all included from the first plan.

Start free See pricing