VeriFactu for law firms: what it is, when it applies, and how to prepare

VeriFactu is, in one sentence, the requirement that invoices be issued with software that does not let you alter them afterwards. Behind that simple idea sit a regulation, a calendar that has changed several times, and a fair amount of commercial noise. This guide separates what the rule actually asks for from what people will try to sell you, and explains what a firm needs to do to be compliant.

A warning up front: the compliance dates have been modified more than once since the regulation was approved. No guide — this one included — replaces confirming with the AEAT or your tax adviser the deadline that applies to you today. What has stayed stable is what you must do; what has moved is the when.

What VeriFactu is, without the jargon

VeriFactu comes from Royal Decree 1007/2023, which approves the Regulation setting the requirements for invoicing software, later developed by Order HAC/1177/2024. It is one piece of Spain’s Anti-Fraud Law (Ley 11/2021). Its purpose is to end dual-use software: programs that let you issue an invoice and then delete or change it without a trace.

To achieve this, the regulation requires the invoicing system to generate, for each invoice, a billing record with three properties:

• Traceability and chaining. Each record includes a fingerprint (a hash) of the previous one, so they form a chain. Altering an invoice in the middle would break the chain and be detectable.
• Immutability. Once issued, a record cannot be modified or deleted without leaving evidence. Corrections are made with corrective invoices, not by rewriting the past.
• Retention and legibility. Records are kept and must be available to the administration.

The regulation allows two ways to comply. In the VeriFactu mode proper, the system sends the records to the AEAT — or keeps them available to it — and the invoice carries a QR code and the legend that it is an invoice verifiable at the Tax Agency’s electronic office. In the “non-verifiable system” mode, records are not sent automatically, but in exchange the software must meet stricter internal requirements, such as the electronic signing of each record. For most firms, the VeriFactu route is the easier one to sustain.

It’s worth clearing up a common misunderstanding: there is no official VeriFactu logo to download and paste. The system’s real identifier is the invoice QR alongside that verifiability legend. Any green document-and-tick emblem you are offered is a third party’s interpretation, not an AEAT seal.

Who it binds and from when

This is where you must tread carefully, because the calendar has been the most changeable part of the whole rule.

The starting point affects who makes the software: producers and vendors of invoicing systems had to have their products adapted by an early date (set in July 2025). That is the vendor’s concern, not the firm’s — but it is worth asking about: software that was not adapted in time is a warning sign.

For whoever issues invoices, Royal Decree 254/2025 set two staggered dates: first corporate income taxpayers, then everyone else — the self-employed and other obligated parties. Royal Decree-Law 15/2025, published in the BOE on 3 December 2025, postponed both by a year. The calendar in force today is this:

From	Who it binds
1 January 2027	Corporate income taxpayers.
1 July 2027	The self-employed under IRPF, non-residents with a permanent establishment, and income-attribution entities.
July 2025	Producers and vendors of invoicing software — the supplier’s obligation, not the firm’s.

2026 is a voluntary period. You can already issue through a VeriFactu system and send records to the AEAT, but nobody is obliged to yet. That said, and because the calendar has already moved twice, confirm the deadline that applies to you at the AEAT’s electronic office or with your adviser before making a buying decision. The prudent thing is not to wait for the limit: adaptation is done better in a quiet month than the week before the date.

What a firm actually has to do

With the “when” set aside, the “what” is more stable and more manageable than the noise suggests. For a firm, preparing for VeriFactu comes down to four things.

Bill with software that complies. This is 90% of it. If you issue your invoices with a program that generates chained, immutable records, most of the obligation is covered by design. If you issue them from a spreadsheet template or a word processor, that is precisely the practice the rule wants to end.

Stop correcting invoices “by hand.” The habit of reopening an already-issued invoice to change an amount or a detail disappears. From now on, you correct with a corrective invoice. It is a change of habit more than of technology, but it is the one that takes most getting used to.

Retain the records. The system must keep the chain of records and be able to export it. This isn’t done by hand; the software does it. But it’s worth confirming your tool allows it.

Don’t confuse invoicing with accounting. VeriFactu governs how invoices are issued; it does not replace accounting or the filing of tax returns. Many firms sensibly separate firm management from the accounting books, and that remains perfectly valid.

How Mandato fits

It pays to be precise about what Mandato does and doesn’t do, because in regulated matters, imprecision has a cost.

Mandato generates the firm’s invoices — money on account, pro formas, retainers — from tracked time and each matter’s billing model. Those records are issued chained, with sequential numbering and immutable, with the traceability the regulation requires. In that sense, Mandato is VeriFactu-ready: the record structure and the chain of fingerprints are built to the rule’s requirements.

What Mandato does not do is replace your accounting or file your tax returns. For full compliance — including submission and bookkeeping — Mandato exports to Holded, which is where the accounting and the fiscal side live. The split is deliberate: Mandato runs the firm; Holded runs the books and the relationship with the tax agency. You can see the detail of this division on the VeriFactu page and on the AEAT integration, where we explain with the same candour what is connected and what is not.

Put another way: Mandato does not promise to “send your invoices to the AEAT out of the box,” because that claim, without a configured certificate and a production environment, would not be true. It promises something more honest and more useful: that your firm’s billing is born already in the shape the rule asks for, and that the handover to accounting is solved.

A four-week preparation plan

If you want to reach your date — whatever it is — without stress, this rhythm works.

In week one, confirm the deadline that applies to you and review how you bill today: who issues, with what tool, and how many “by hand” corrections you make a month. That number tells you how much habit needs to change.

In week two, choose and configure the invoicing software, and connect its output to your accounting. If you separate firm and books, define the handover point.

In week three, issue in parallel: a few invoices through the new system, checking the chain and the QR, while keeping the old one as a safety net. This is the phase where the details surface.

In week four, train the team on the one genuinely new habit — correcting instead of rewriting — and set the cut-off date after which everything is issued through the new system.

---

VeriFactu is more frightening for the noise than for its content. The underlying obligation — to bill with a system that won’t let you alter the past — is reasonable and, with the right software, almost invisible day to day. If you want to see how Mandato solves it without overstating what it does, start with the VeriFactu page or the guide to digitalising the firm, where this piece fits into a wider change.