Verifactu 2027: 1 January deadline, planned 2028 delay and software changes

Summary. On 7 November 2026 Spanish law still requires corporate income taxpayers to use Verifactu-compliant invoicing software before 1 January 2027, and other covered taxpayers, including the self-employed, before 1 July 2027. Those dates come from Real Decreto-ley 15/2025, which Congress validated in December 2025. On 5 October 2026 the Ministry of Finance announced a plan to move the pending obligations to October 2028, to match mandatory B2B e-invoicing for businesses with turnover up to €8 million. No decree doing so had appeared in the BOE by 6 November 2026, and the Cortes were dissolved for elections on 29 November. Treat 1 January 2027 as the legal baseline. The technical rules are unchanged: every invoice produces a billing record chained to the previous one by a SHA-256 hash and carries a QR code, and the system either sends each record to the AEAT (Verifactu mode) or signs records and keeps an event log (No Verifactu mode). Fines reach €150,000 per year per system type for producers and €50,000 per year for businesses holding non-compliant software. SII filers are outside the scope.

About this article. For finance and IT leaders at companies that invoice in Spain, and for software vendors, including Indian ERP and SaaS teams. We checked every date and requirement on 7 November 2026 against the BOE, the AEAT electronic office and the Ministry of Finance. We read Real Decreto 1007/2023 in its consolidated text last updated on 3 December 2025, still current on the check date; Orden HAC/1177/2024 in its unamended text of 28 October 2024; and article 201 bis of the General Tax Law as consolidated on 21 December 2024. The October 2028 postponement is an announced plan, not law. This is general information, not tax or legal advice; confirm your position with a Spanish tax adviser. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

Where the Verifactu dates stand on 7 November 2026

The rules sit in Real Decreto 1007/2023 of 5 December 2023 (the AEAT abbreviates it RRSIF; most people call it the Verifactu regulation) and its technical order, Orden HAC/1177/2024 of 17 October 2024. Its date clause, final provision four, has been rewritten twice: by Real Decreto 254/2025 of 1 April 2025, then by Real Decreto-ley 15/2025 of 2 December 2025, the version in force. The timeline also draws on the election decree and the AEAT's e-invoicing calendar.

What the 5 October 2026 note says

The Ministry's press note proposes postponing the pending obligations of RD 1007/2023 to October 2028, aligned with e-invoicing for SMEs and the self-employed. A second change would then move scope and some technical details towards the EU's VAT in the Digital Age (ViDA) reporting rules, keeping the integrity, traceability and inalterability requirements substantially the same. If it happens, companies gain 21 months (January 2027 to October 2028) and others 15 (July 2027 to October 2028).

Why 1 January 2027 still counts

The AEAT's information note (updated 13 October 2026) and FAQ (updated to 21 October 2026) still give the RDL 15/2025 dates as mandatory, and its Verifactu page (updated 3 November 2026) calls the Ministry's message a forecast. The BOE record for RD 1007/2023 lists no amendment after RDL 15/2025, and the BOE daily summaries from 5 October to 6 November 2026 contain no decree on invoicing systems.

Politics adds risk. Real Decreto 806/2026 dissolved the Cortes, called elections for 29 November and set the new chambers' first sitting for 23 December. SuperContable notes that an ordinary royal decree needs consultation and reports, a decree-law would need validation by the standing committee of Congress, and after polling day the government is caretaker. The government has issued five decree-laws since the dissolution, none on invoicing. Do not plan on October 2028 until it is in the BOE.

Until each deadline the AEAT treats the period as a test phase: a business may stop sending test records from a Verifactu-mode system and invoice with another system until 31 December 2026 or 30 June 2027.

Who must comply, and who is outside the scope

Article 3.1 covers anyone who uses an invoicing system, even for part of their activity, and is a corporate income taxpayer, an IRPF taxpayer with an economic activity, a non-resident with a permanent establishment, or an income attribution entity with an activity. Article 3.2 adds producers and sellers of those systems.

The exclusions come from articles 3 and 4 of the regulation, the invoicing regulation provisions that article 4 cites, and the AEAT's scope FAQ. Simplified invoices (tickets) are covered; systems that only issue other documents are not. One system can serve several taxpayers if their records stay separate (article 7), and invoicing can be delegated to the customer or a third party, with the supplier still responsible (article 6).

Verifactu or No Verifactu: the first design choice

The AEAT writes the modes as VERI*FACTU and NO VERI*FACTU. Article 7 lets a taxpayer use a compliant system of its choice or the AEAT's free invoicing application, and a compliant system runs in one of two modes.

Sources: regulation articles 14 and 16, order articles 3, 7, 9, 14, 17 and 20, and the AEAT's test-period FAQ. Verifactu mode drops the signature, event log and several checks but puts the AEAT submission pipeline in your billing path; No Verifactu mode keeps data local but needs certificates, an event log and verifiable exports.

Billing records: what each invoice must generate

Article 9 requires a billing record (registro de facturación de alta) generated automatically with the invoice or immediately before it. Article 10 lists its content:

• issuer and, where required, recipient NIF and name, and who issued the invoice;

• invoice number, series, issue and operation dates, type (full or simplified) and corrective details;

• description, total, VAT regime keys, reverse-charge flag, bases, rates, VAT, surcharge and exemption causes;

• the preceding record's number, series, date and part of its hash;

• system ID, installation data, producer details and the generation time to the second.

Amounts must be in euros (article 10.2). Corrections never overwrite: any change needs an additional record (article 8.2.a), and a cancellation record (article 11) is only for invoices issued in error. Records are XML in UTF-8, and each carries its generation date, time and time zone. In No Verifactu mode the clock must also be accurate to within one minute, and before each new record the system checks that the last one is correctly chained and not timestamped more than a minute ahead.

Hash chaining, step by step

Each record gets a hash (huella) over a fixed subset of its fields, set by article 13 of the order; the annex lists SHA-256 as the only hash type.

Each record also carries the previous record's NIF, series and number, issue date and the first 64 characters of its hash (the full SHA-256 hex digest). The first record is flagged as the start of the chain, and each system keeps one chain per taxpayer for both record types.

The AEAT's hash specification (version 0.1.2, 27 August 2024) fixes the input: the fields as name=value pairs joined by &, using the XML field names and trimmed values, an empty value for a missing field (so the first record has an empty previous hash), encoded as UTF-8. The output is 64 upper-case hexadecimal characters. This sketch reproduces the specification's first worked example:

            # Verifactu invoice-record hash per the AEAT hash specification v0.1.2
import hashlib

def huella_alta(r, previous_hash):
    fields = [("IDEmisorFactura", r["nif"]), ("NumSerieFactura", r["num"]),
              ("FechaExpedicionFactura", r["date"]), ("TipoFactura", r["type"]),
              ("CuotaTotal", r["vat"]), ("ImporteTotal", r["total"]),
              ("Huella", previous_hash), ("FechaHoraHusoGenRegistro", r["generated"])]
    text = "&".join(f"{k}={v.strip()}" for k, v in fields)
    return hashlib.sha256(text.encode("utf-8")).hexdigest().upper()

first = {"nif": "89890001K", "num": "12345678/G33", "date": "01-01-2024", "type": "F1",
         "vat": "12.35", "total": "123.45", "generated": "2024-01-01T19:20:30+01:00"}
assert huella_alta(first, "") == "3C464DAF61ACB827C65FDA19F352A4E3BDC2C640E9E9FC4CC058073F38F12F60"
          

Hash the exact XML values. A chain cannot fork, so concurrent invoicing across app servers, POS terminals or queue workers needs a single writer or a lock per chain. Decide early what counts as one system (records carry a system ID and an installation number), and keep migrations, restores and test data out of production chains.

The QR code and the invoice wording

Every invoice from a covered system, on paper or as a digital image, must carry a QR code (order, articles 20 and 21):

• size between 30 x 30 mm and 40 x 40 mm;

• ISO/IEC 18004 standard, error correction level M;

• content: a URL for the AEAT's checking service, with the issuer NIF, invoice series and number, issue date and total built in.

The AEAT publishes the URL formats and placement rules. A structured e-invoice carries the URL as a separate field instead of the image. Any recipient, including a consumer, can scan the code to send the data to the AEAT; on Verifactu invoices this confirms the issuer reported it (article 17).

Submitting records to the AEAT

In Verifactu mode the system must connect to the internet, manage certificates, send XML records over secure protocols and process the AEAT's responses (order article 4). Articles 16 and 17 set the mechanics:

• Flow control. The wait between submissions starts at 60 seconds and each AEAT response can update it. The next submission goes when the wait expires or the batch reaches the 1,000-record limit, whichever comes first.

• Validation. A submission with at least one correct record returns a secure verification code (CSV); erroneous records come back with error codes.

• Outages. Pending records go as soon as possible, in order, flagged as delayed; the system retries at least hourly and shows how many records are pending.

• Opting out. Verifactu operation continues until 31 December; to stop, the system declares its last date in a submission field before year end.

The taxpayer can submit directly or through a representative, such as a software company, under the AEAT's social collaboration rules. In No Verifactu mode the AEAT can demand immediate access to records and event logs, or a copy in the same format (regulation article 14; order article 18).

The declaración responsable: self-certification by the producer

There is no AEAT approval, external certification or prior registration. Article 13 makes the producer certify compliance through a responsible declaration, and article 15 of the order fixes its content and order: a set heading, system name, ID code, exact version, components, whether it runs only in Verifactu mode, multi-taxpayer support, signature types, producer name, tax ID and address, the compliance statement, and date and place of signature.

A producer without a Spanish NIF can give another identifier. Extensions by another company need that company's own declaration, and a business that builds invoicing software for its own use must sign one too. The declaration must be visible in the system, given to buyers, and kept for every version.

Penalties under article 201 bis of the General Tax Law

All three are fixed fines. The AEAT's FAQ accepts an old, non-adapted program kept for historical invoices only if it can no longer issue invoices, for example once uninstalled or blocked from a set date; exporting the records and retiring it is safest.

How Verifactu relates to Spain's B2B e-invoicing mandate

Verifactu governs the system that issues invoices; B2B e-invoicing, under Real Decreto 238/2026 of 25 March 2026, governs structured exchange and status reporting. Orden HAC/1028/2026 of 2 October entered into force on 6 October 2026 and started its clock. Businesses with VAT turnover above €8 million must issue and receive e-invoices from 6 October 2027 (with a PDF copy for the first 12 months), everyone else from 6 October 2028. Status and payment reporting follows in 2027, 2028 and, for individuals, 6 October 2029.

A business above €8 million that adapts for Verifactu by 1 January 2027 still needs e-invoicing by 6 October 2027, so one ERP project should cover both. France runs a similar SME timetable, covered in our France e-invoicing guide.

What to do now, by profile

Implementation checklist for vendors and in-house teams

1. Inventory every system that issues Spanish invoices or tickets, including POS, e-commerce and subscription billing, and confirm each entity's deadline and SII status.

1. Choose Verifactu mode, No Verifactu mode or both per product.

1. Map invoice data to the article 10 fields, including VAT keys and euro conversion.

1. Implement chaining with a single writer, and reproduce the AEAT hash examples in your tests.

1. Generate the QR code to specification; add the URL field to structured e-invoices.

1. Build the submission client with flow control, batching, CSV storage and hourly retries.

1. For No Verifactu mode, add XAdES signing, the event log, the clock check and period exports.

1. Block edits and deletes of issued records at database level.

1. Test on the AEAT's test portal and publish a declaración responsable per version, in-house builds included.

1. Lock legacy tools so they cannot issue invoices after your deadline.

Notes for Indian ERP and SaaS teams

The obligations attach to the system and its producer, wherever the code is written. Article 7 requires GDPR compliance when records hold personal data, and article 8 requires records to stay accessible and exportable for the statutory retention period, which shapes tenant exports and offboarding. Teams that already run GST e-invoicing integrations will find the submission client familiar; the hash chain is new. Groups selling into Germany face parallel EN 16931 work, covered in our German e-invoicing checklist.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our application development team can review an invoicing module against RD 1007/2023 and Orden HAC/1177/2024 and build the record chaining, QR generation and AEAT submission it needs, alongside your tax adviser. Talk to us at /contact-us/.

Last updated: 7 November 2026.

References

1. Real Decreto 1007/2023, Reglamento de sistemas informáticos de facturación, texto consolidado (última actualización 3 de diciembre de 2025) — Agencia Estatal Boletín Oficial del Estado

1. Resolución de 11 de diciembre de 2025, convalidación del Real Decreto-ley 15/2025 — Agencia Estatal Boletín Oficial del Estado

1. Nota informativa, 5 de octubre de 2026: previsión de modificación de los plazos del Real Decreto 1007/2023 (archived copy of 21 October 2026) — Ministerio de Hacienda

1. Real Decreto 806/2026, de 5 de octubre, de disolución del Congreso de los Diputados y del Senado y de convocatoria de elecciones — Agencia Estatal Boletín Oficial del Estado

1. Orden HAC/1177/2024, de 17 de octubre, especificaciones técnicas, funcionales y de contenido, texto consolidado — Agencia Estatal Boletín Oficial del Estado

1. Ley 58/2003, General Tributaria, texto consolidado, artículo 201 bis — Agencia Estatal Boletín Oficial del Estado

1. Preguntas frecuentes VERI*FACTU, cuestiones generales: objeto (actualizadas a 21 de octubre de 2026) — Agencia Tributaria

1. Real Decreto 1007/2023, análisis y referencias posteriores — Agencia Estatal Boletín Oficial del Estado

1. Real Decreto-ley 15/2025, de 2 de diciembre — Agencia Estatal Boletín Oficial del Estado

1. Factura electrónica (SPFE): calendario de implantación (actualizada 13 de octubre de 2026) — Agencia Tributaria

1. Nota informativa: ampliación del plazo de adaptación de los sistemas informáticos de facturación (actualizada 13 de octubre de 2026) — Agencia Tributaria

1. Sistemas Informáticos de Facturación (SIF) y VERI*FACTU (actualizada 3 de noviembre de 2026) — Agencia Tributaria

1. Sumario del BOE, 6 de noviembre de 2026 (open data API; summaries from 5 October 2026 checked) — Agencia Estatal Boletín Oficial del Estado

1. Verifactu se aplaza a octubre de 2028, ¿estás seguro?, 9 de octubre de 2026 — SuperContable

1. Real Decreto 1619/2012, Reglamento por el que se regulan las obligaciones de facturación, texto consolidado — Agencia Estatal Boletín Oficial del Estado

1. Preguntas frecuentes VERI*FACTU, cuestiones generales: ámbitos de aplicación — Agencia Tributaria

1. Detalle de las especificaciones técnicas para la generación de la huella o hash de los registros, versión 0.1.2, 27 de agosto de 2024 — Agencia Tributaria

1. Preguntas frecuentes VERI*FACTU, colaboración social — Agencia Tributaria

1. Preguntas frecuentes VERI*FACTU, certificación de los sistemas informáticos: declaración responsable — Agencia Tributaria

1. Real Decreto 238/2026, de 25 de marzo, sistema de facturación electrónica obligatoria entre empresarios y profesionales — Agencia Estatal Boletín Oficial del Estado

1. Orden HAC/1028/2026, de 2 de octubre, solución pública de facturación electrónica — Agencia Estatal Boletín Oficial del Estado