The complete VeriFactu guide for lawyers: what you need to know

Start with the date, because half the internet still gives the wrong one. VeriFactu is not in force. Royal Decree-Law 15/2025, published in the BOE on 3 December 2025, postponed the calendar by a year: companies subject to corporate income tax are bound from 1 January 2027, and everyone else — self-employed professionals included, which means most independent lawyers — from 1 July 2027. If your firm still issues fee notes from a Word template, it is not breaking anything today. What it has is a deadline, and a shorter one than it looks.

This guide explains where the obligation comes from, what exactly it requires, and what changes in the daily practice of a small or mid-sized firm. No alarmism — the postponement is real and we are not going to manufacture an urgency the rules no longer impose — but no sugar-coating either: it’s a real obligation, with real penalties, and it is coming.

Where the obligation comes from

The origin is Law 11/2021, Spain’s anti-fraud law, which added letter j) to article 29.2 of the General Tax Law (LGT). That letter creates a new duty: any software that supports invoicing processes must guarantee the integrity, conservation, accessibility, legibility, traceability and inalterability of its records. In plain terms: the program you invoice with cannot allow an invoice to be deleted or touched up without leaving a trace.

The detail arrived with Royal Decree 1007/2023, which approves the Regulation on requirements for invoicing software, and with Order HAC/1177/2024, which sets the technical specification: how each record is built, how it chains to the previous one, and how it communicates with the AEAT. Royal Decree 254/2025 then set the calendar at January and July 2026 — and Royal Decree-Law 15/2025 moved it again by a year, to 1 January 2027 for corporate income tax payers and 1 July 2027 for everyone else. Those are the dates in force as this is written; the calendar has been revised three times, so confirm yours at the AEAT before planning around it.

What your invoicing software has to do

The regulation doesn’t govern the design of your fee note; it governs what happens underneath it. Compliant invoicing software must do at least four things.

First, generate an invoicing record for every invoice issued (and another for every cancellation), with prescribed content: issuer details, number and series, date, amounts, invoice type. Second, chain those records together: each one incorporates a fingerprint — a hash — of the previous one, so the full series forms a chain into which nothing can be inserted, removed or altered without breaking it. Third, keep an event log: the system itself notes what happens inside it. And fourth, print a QR code on every invoice that allows it to be verified, along with the corresponding legend.

The practical consequence is the one you suspect: Word and Excel can do none of this. They generate no records, chain nothing, and let anyone modify any document without a trace. It’s not that they’re discouraged; it’s that they don’t comply.

The two modes: VERI*FACTU or the hard way

The regulation allows two ways to comply. The first is to operate as a verifiable-invoice system — VERI*FACTU mode proper: the software sends each invoicing record to the AEAT automatically at the moment of issue, and the invoice carries the legend saying so. In exchange for that continuous submission, the system is relieved of some additional requirements, and the client can check their invoice by scanning the QR code against the AEAT itself.

The second is not to send the records. That’s legal, but more demanding: the system must electronically sign every record, preserve them with full guarantees, and be able to hand them over whenever the tax authority asks. In practice, most software on the market has opted for VERI*FACTU mode, because it’s simpler to operate and leaves the user in a more comfortable position if an inspection comes.

For a law firm, the choice of mode is mostly a decision made by its software vendor. What falls to you is to check that the program you use complies under one of the two, and that the vendor declares it through the corresponding responsible declaration.

Who is outside the scope

Not everyone is caught. The most relevant exclusion covers those who already keep their VAT ledgers through the Immediate Supply of Information system (SII): large companies, VAT groups and REDEME registrants already send their invoicing data to the AEAT by another route and are not subject to VeriFactu. If your firm invoices through a company under the SII, your regime is a different one.

The foral territories are a separate case: the Basque Country runs TicketBAI, its own system with its own dates and requirements, and Navarre has its own foral rules too, so none of the above applies there as written. And there are specific situations — invoicing carried out by third parties, certain special regimes — where the sensible move is to go straight to the AEAT’s official materials before drawing conclusions.

What changes in the firm’s day-to-day

For a small firm, the visible change is less dramatic than the volume of regulation suggests. A fee note is still a fee note: same line items, same deadlines, same VAT and same withholding. What changes is the instrument that issues it, and the discipline that instrument imposes.

Series and numbering are managed by the system, not by an Excel cell someone increments by hand. An issued invoice is no longer corrected by “opening the file”: if there’s a mistake, you issue a corrective invoice, and that corrective invoice generates its own chained record. Retainers and payments on account are documented as they always were, but through the same compliant system. And the QR code on every invoice is visible to the client — which, as it happens, projects an image of orderliness no firm can have too much of.

What disappears is the room for informality: the invoice that gets redone, the numbering that gets tidied up at year end, the draft that was sent as final. That room was precisely what the rules were aimed at.

The penalties are real and specific

Law 11/2021 didn’t just create the obligation; it created its penalty regime too, in article 201 bis of the LGT. For manufacturers and sellers of non-compliant software, fines reach 150,000 euros per financial year. For the user, the mere possession of systems that don’t meet the requirements — or that aren’t duly certified where required — is fined at 50,000 euros per financial year.

That figure deserves a calm reading: no concealment of income needs to be proven. The infringement is having and using the non-compliant system. It’s exactly the kind of risk a law firm — which makes its living managing other people’s risk — shouldn’t be carrying in its own house.

How Mandato solves it

Mandato’s billing is built for this landscape: series, invoicing records and QR codes in line with the regulation, inside the same tool where the firm’s matters and time entries already live. If you want to see what a fee note issued this way looks like and what it means for your workflow, the VeriFactu in Mandato page shows it plainly.

Where to go from here

If you want the full detail — calendar, modes, edge cases and a checklist for your firm — we keep a longer VeriFactu guide for law firms that goes beyond this article. And for the borderline situations, the source is always the same: the VeriFactu section of the AEAT’s official website, which publishes the FAQs and the consolidated rules.

The conclusion fits in one sentence: VeriFactu arrives in 2027, the postponement is a year of margin rather than a reprieve, and the only decision still pending at most firms is which tool to comply with. The sooner it’s made, the calmer the migration — and in a law firm, changing invoicing systems goes better in a slow month than the week before a deadline.