VeriFactu is not a recommendation — it is a legal obligation with a specific penalty regime. Fines can reach €150,000 per year for non-compliant software manufacturers, and some infractions directly affect software users. Here is what Spain's Anti-Fraud Law and RD 1007/2023 say about penalties.
Who can be penalised? Two different actors
1. Software manufacturers and resellers
They face the highest exposure. Their obligation is to not produce, sell, or install software that does not meet the requirements of RD 1007/2023.
2. Software users (businesses and self-employed)
They are responsible for not using software that allows dual-record keeping or that alters billing records.
Penalties in figures
Law 11/2021 (Anti-Fraud Law) added three new serious offences to the General Tax Law:
| Offence | Who | Penalty |
|---|---|---|
| Manufacture, produce, sell or obtain dual-use software (allowing record manipulation) or software that does not meet technical requirements | Manufacturers and resellers | Fixed fine of €150,000 per year and product line |
| Use IT systems that do not comply with the regulations (without certification when required, or without the responsible declaration) | Software users (businesses and self-employed) | Fixed fine of €50,000 per year |
| Possess, use, sell or transport software that allows manipulation of accounting or billing data to conceal real activity | Any party | Fixed fine of €50,000 per year |
Important: these are fixed fines, not proportional to benefit obtained. Regardless of transaction volume, the penalty is the same.
From when can penalties apply?
- 1 January 2027: companies subject to Corporate Income Tax.
- 1 July 2027: self-employed under Personal Income Tax, non-residents with a permanent establishment, and income-attribution entities.
What is the responsible declaration of conformity?
Every SIF manufacturer that complies with RD 1007/2023 must publish a responsible declaration on their website and in the AEAT registry. Before purchasing or continuing to use any invoicing software, verify that the manufacturer has published this declaration. If it does not exist, the software does not comply and you face the €50,000 fine.
InvoSeal has its responsible declaration published and accessible from the legal compliance section of our website.
Three measures that protect you
- Use a SIF with a published responsible declaration. This is the fundamental protection. If the manufacturer has the declaration, you are covered as a user.
- Keep records for at least four years. RD 1007/2023 requires billing records to be kept for the statute of limitations period.
- Switch software before the mandatory date, not the day before. Software migrations take time. Don't leave it for December 2026 or June 2027.
Avoid the €50,000 fine: use a certified SIF
InvoSeal is a certified SIF with a published responsible declaration. It complies with RD 1007/2023 from the first minute: chained hash, verifiable QR, record storage. No surprises.
Try InvoSeal free for 14 days →