The SIF event log: what your invoicing software records and why it matters

The SIF event log: what your invoicing software records and why it matters

Spain's anti-fraud invoicing regulation (Royal Decree 1007/2023) is now fully in force: companies since 1 January 2026, self-employed workers since 1 July 2026. Every invoicing tool used in Spain must be a compliant SIF (certified invoicing system). Most of the attention goes to the invoice records themselves — the QR code on each invoice and the chained hash that links them. But the regulation demands a second, far less discussed component: the event log. If the hash chain is the chain of custody for what you invoice, the event log is the black box describing how the system itself has behaved.

What the event log actually records

The event log is an internal, automatic and tamper-proof history. It does not track your sales; it tracks the system. Among other things, it records:

• Start-ups and shutdowns of the invoicing system.
• Detected anomalies: integrity failures in the records, errors verifying the hash chain, malfunctions.
• Exports of invoicing records — for example, to hand them to the tax agency (AEAT) or to your accountant.
• Backup restores, a sensitive moment because a restore can reintroduce an earlier state of the data.
• Mode changes: switching between VeriFactu and non-VeriFactu operation is logged with an exact timestamp.

Every entry carries a timestamp and cannot be edited afterwards. This is not an optional technical log — it is a regulatory requirement, just as binding as the QR code.

Why it matters most in non-VeriFactu mode

Under VeriFactu mode, every invoicing record is transmitted to the AEAT the moment it is issued, so the agency holds a continuous copy of your activity. Under non-VeriFactu mode, records are kept locally, digitally signed, and only submitted if the AEAT requests them. That is where the event log becomes the star witness: it is the evidence that the system ran without suspicious interruptions, deletions or manipulation between issuing the invoices and the day of an audit.

Put bluntly: in non-VeriFactu mode the tax agency does not see your invoices day by day, so when an inspection comes it will read the black box first to decide whether it can trust everything else.

What must never happen

Three red flags can turn a routine check into a serious problem:

• Gaps: periods when the business was clearly trading but no events were logged. A system that issues invoices without logging events is, in the regulation's eyes, non-compliant.
• Deletions or edits: the event log is append-only. Any trace of removal breaks the inalterability requirement.
• Inconsistent entries: backup restores with no preceding anomaly to justify them, or repeated unexplained mode changes.

Keep in mind that using non-compliant software carries a penalty of up to €50,000 per financial year (article 201 bis of the Spanish General Tax Law) — and that includes a SIF whose event log falls short.

What to check with your software provider

Before trusting a tool with your invoicing in Spain, ask:

1. Is the event log generated automatically, with no user action required? 2. Can it be exported in a readable format when the AEAT asks for it? 3. Is it protected against editing and deletion — including by administrators? 4. Are VeriFactu/non-VeriFactu mode changes recorded with their exact date and time? 5. Does the vendor's responsible declaration confirm full compliance with RD 1007/2023?

Vague answers to any of these mean the risk sits with you, not with the vendor.

What the AEAT will ask for in an audit

During an inspection, the agency can require access to, or submission of, both the invoicing records and the event log. It will cross-check them: events must cover the whole period, exports and restores must match what you provide, and there must be no unexplained gaps. The chained hash of the invoices — covered in depth in a separate article on this blog — proves that no individual record was altered; the event log proves the system was not tampered with either. They are two distinct, complementary pieces, and an inspector will expect both to be spotless.

The practical takeaway for a small business or freelancer operating in Spain: issuing invoices with a QR code is not enough. Your software must keep its own complete, tamper-proof logbook from day one.