Update, 6 October 2026. What now has a firm date is mandatory B2B e-invoicing: Order HAC/1028/2026, in force since 6 October 2026, has started the deadlines of Royal Decree 238/2026 (twelve months for businesses with a turnover above €8 million and twenty-four for everyone else, i.e. October 2027 and October 2028 by our calculation). Spain's Ministry of Finance has announced that it will postpone VeriFactu to October 2028 so that it converges with e-invoicing, but that change is not yet in the BOE (Official State Gazette): until it is published, the dates set by Royal Decree-Law 15/2025 remain in force (1 January 2027 for Corporate Income Tax filers and 1 July 2027 for everyone else). We will update this page once the regulation is published.
Since 2017, Spain's SII has required large companies (over 6 million euros in turnover) to submit VAT records within 4 calendar days, excluding Saturdays, Sundays and national public holidays; Verifactu, from 2027, will apply to anyone invoicing with software, chaining records by hash with a QR code. A business that keeps its VAT ledgers through SII falls outside the Verifactu Regulation (art. 3.3 of RD 1007/2023).
When the AEAT (Spanish Tax Agency) drives two fiscal control initiatives with similar names and close deadlines, confusion is guaranteed. SII (Suministro Inmediato de Información — Immediate Supply of Information) and Verifactu (invoicing records verification system) are two separate obligations, affecting different groups of taxpayers, with different technical impacts and different deadlines. Confusing them can lead you to believe you are already covered when you still have work ahead, or conversely, to invest in adaptations that do not apply to you. This article clarifies exactly what each one is, how they differ, and what you need to review in your management system.
What is SII and who does it affect?
The Suministro Inmediato de Información (SII) is a system for keeping VAT record books through the AEAT Electronic Headquarters, introduced by Royal Decree 596/2016. Instead of submitting forms 340 and 347 periodically, obligated companies send records of issued and received invoices within a maximum of four calendar days, excluding Saturdays, Sundays and national public holidays, from the date of issue (issued invoices) or from their entry in the accounts (received invoices).
SII has been mandatory since 1 July 2017 for the following groups:
- Large companies (volume of transactions exceeding 6,010,121.04 euros in the previous year).
- VAT groups registered in the Monthly Refund Register (REDEME).
- Taxable persons subject to the Special Group of Entities Regime (REGE).
Standard SMEs, self-employed individuals, and companies with a transaction volume below the threshold are not obligated to use SII, although they may voluntarily opt in. As of June 2026, more than 60,000 taxpayers operate under SII in Spain, according to AEAT data.
What is Verifactu and when does it come into force?
Verifactu is the invoicing records verification regime established by Royal Decree 1007/2023, of 5 December, which implements the Anti-Fraud Law 11/2021. Its objective is to guarantee the integrity and immutability of issued invoices through a system of chained records with a digital fingerprint (hash) in the invoicing software, with the voluntary option of sending those records to the AEAT in real time (VERI*FACTU mode).
Verifactu applies to all entrepreneurs and professionals who issue invoices in Spain and use invoicing software to do so, regardless of their size or transaction volume. The main exceptions are taxpayers already subject to SII (who have their own traceability requirements) and certain special regimes.
The official deadlines, according to Royal Decree 1007/2023 as currently in force as of June 2026 — amended by Royal Decree 254/2025 and Royal Decree-law 15/2025 of 2 December — are:
- Companies subject to Corporate Income Tax: adaptation before 1 January 2027.
- Self-employed and other obligated taxpayers: before 1 July 2027.
If your software provider has not yet communicated the Verifactu update to you, this is a red flag you need to address immediately.
Comparison table: SII vs Verifactu at a glance
| Aspect | SII | Verifactu |
|---|---|---|
| Legal basis | Royal Decree 596/2016 | Royal Decree 1007/2023 / Law 11/2021 |
| Who is affected? | Large companies, REDEME, REGE | All those who issue invoices using software (except SII and exceptions) |
| Volume threshold | More than 6 M€ in transactions | No threshold; affects SMEs and self-employed |
| What is sent to the AEAT? | Records of issued and received invoices | Invoicing records with chained hash (voluntary submission in VERI*FACTU mode; otherwise records are handed over when the AEAT requests them) |
| Submission deadline | 4 calendar days after issue (excluding Saturdays, Sundays and national public holidays) | Immediate in «Verifactu» mode (at the moment of issuance) |
| Impact on software | Communication API with the AEAT (WSDL/SOAP) | Internal record chaining engine + QR code on invoice + possible submission to AEAT |
| Does it replace 347/340? | Yes, for obligated parties | No; it is an integrity control, not a periodic declaration |
| Compatible with each other? | They do not overlap: RD 1007/2023 excludes anyone under SII (art. 3.3) | |
| Start date | 1 July 2017 | 1 January 2027 (companies subject to Corporate Income Tax) / 1 July 2027 (others) |
Can they coexist in the same company?
Not at the same time: article 3.3 of Royal Decree 1007/2023 excludes anyone who keeps VAT ledgers through SII from the Verifactu Regulation, so while the company stays under SII, its invoicing software does not need to meet Verifactu’s technical requirements (hash record chaining, verification QR code, etc.). If it ever stops being under SII, it becomes subject to Verifactu.
For SMEs not in SII, Verifactu is currently the nearest obligation with a fixed date. And the adaptation is not trivial: it requires the manufacturer to have issued the responsible declaration required by RD 1007/2023, that historical data in the ERP is managed correctly, and that the invoice issuance process generates the control record automatically and in a chained manner.
What all this means for your ERP or invoicing software
If you use a market ERP such as Odoo, Sage 200, Microsoft Dynamics 365 Business Central, Holded, or any other invoicing software, the concrete impact you need to verify is the following:
For companies under SII
Your ERP should already have the SII module operational for several years; that module does not change because of Verifactu, since while the company stays under SII, the Verifactu Regulation does not apply to it (art. 3.3 of RD 1007/2023). The only thing worth watching is whether the company ever stops being under SII — that is the day the Verifactu adaptation clock starts.
For SMEs and self-employed (not SII)
The minimum checklist you need to confirm with your software provider:
- Does the software generate the invoicing record with the mandatory fields from RD 1007/2023 (issuer VAT number, invoice number, type, base, tax amount, date, previous hash)?
- Does it implement hash chaining SHA-256 between consecutive records?
- Does it include the QR code for verification in the invoice PDF?
- Does the manufacturer hold the responsible declaration required by RD 1007/2023? (the AEAT publishes no list of certified or approved software)
- Have the submission parameters been configured (voluntary or in Verifactu mode with immediate submission to the AEAT)?
If any of these answers is «no» or «I do not know», the company faces a real risk of non-compliance. The penalties in Article 201 bis of the General Tax Law (introduced by Law 11/2021) are fixed fines for a serious infringement: 50,000 euros per fiscal year for users who hold non-compliant software; 150,000 euros per fiscal year and per type of program for those who manufacture or market it; and 1,000 euros for each system marketed without the required certification.
Relationship between Verifactu and B2B electronic invoicing (Crea y Crece Act)
There is a third acronym that gets mixed into the conversation: the mandatory B2B electronic invoice required by Law 18/2022 (Crea y Crece). This is a separate obligation from Verifactu: it requires that invoices between companies be issued in a structured format (the EN 16931 model in UBL, CII, EDIFACT or Facturae syntax, under RD 238/2026) and exchanged through interoperable platforms.
The regulation has already been approved (Royal Decree 238/2026 of 25 March, published in the BOE on 31 March 2026 and in force since 20 April 2026); the 12- and 24-month periods start when the ministerial order on the public solution enters into force, and that order is still unpublished. However, the technical requirements of Verifactu are compatible with and in some cases complementary to B2B electronic invoicing: both systems require the software to generate invoices with structured and intact data.
If your ERP is being adapted for Verifactu, use that project to also review the state of readiness for B2B electronic invoicing. They are two separate projects, but they share technical infrastructure.
At Summum Sistemas we support SMEs and mid-sized companies in adapting their ERPs and invoicing software to both Verifactu and B2B electronic invoicing, with a prior technical gap analysis and a concrete implementation plan.
Common mistakes when mixing up SII and Verifactu
In real adaptation projects, Summum Sistemas repeatedly detects the following errors:
- Believing that being under SII also exempts you from B2B e-invoicing. That is not the case: they are independent obligations; SII does not excuse compliance with the future B2B e-invoicing rules once they take effect.
- Trusting that the software provider handles everything without verifying it. The legally responsible party for compliance is the taxpayer, not the provider. Demand documentation of the certification.
- Applying only the update to the invoicing module without reviewing the ticket, delivery note, or credit note modules, which in some ERPs also generate invoicing records subject to Verifactu.
- Not keeping invoicing records for the legal retention period (minimum 4 years, in line with article 70 of the VAT Act). The Verifactu record is a tax document, not just a technical log.
- Launching the Verifactu system without having correctly configured the invoice series, which creates a mismatch in hash chaining that invalidates the sequence from the very first record.
How does Verifactu affect a multi-company or multi-site ERP?
In environments with several companies or branches issuing invoices from the same ERP, each issuer VAT number has its own Verifactu record chain. You cannot mix the chain of one company with that of another. If the ERP manages several legal entities under the same system, the configuration must ensure that the counters and hash chains are independent per VAT number. This point usually requires specific technical intervention in the module configuration.
Likewise, test or staging environments that also issue invoices must be clear about whether they use the AEAT test environment (which exists for Verifactu submission) or whether the invoices generated in those environments are correctly marked as «non-productive» to avoid contaminating the real chain.
Frequently asked questions
My company is in SII: do I need to do anything about Verifactu?
No. If your company keeps its VAT ledgers through SII, the Verifactu Regulation does not apply to you — article 3.3 of Royal Decree 1007/2023 excludes you from its scope. You would only become subject to it if you ever stop being under SII.
What is the practical difference between «Verifactu software» and «non-Verifactu software»?
Royal Decree 1007/2023 distinguishes two modes for the software: the «Verifactu» mode, in which the software automatically sends each invoicing record to the AEAT at the moment of issuance, and the «non-Verifactu» mode (also called computerised systems with records), in which the software generates and stores the records with hash chaining but does not submit them in real time, although the AEAT can request them at any time. Both modes are legally valid, but the Verifactu mode with immediate submission offers greater legal certainty because each invoice is «sealed» on the AEAT servers.
What happens if the July 2027 deadline passes and my software is not adapted?
Using invoicing software that does not comply with the requirements of RD 1007/2023 constitutes a tax infringement under Law 11/2021. For the software user it is a serious infringement, punished with a fixed fine of 50,000 euros per fiscal year (Article 201 bis of the General Tax Law). Moreover, failure to comply can compromise the tax validity of issued invoices, creating risk for your business clients in terms of VAT deductions. The risk of delay is not just a one-off fine; it is a reputational risk with your business customers.
Can I keep using Excel or a spreadsheet to invoice?
Generic spreadsheets (Excel, Google Sheets, LibreOffice Calc) are not invoicing software within the meaning of RD 1007/2023 and cannot meet the requirements for hash chaining and QR code generation. If you currently issue invoices from a spreadsheet, you are required to migrate to invoicing software adapted to RD 1007/2023 before 1 July 2027. There are free or low-cost options that are already adapted, but if your transaction volume justifies an ERP, this is the moment to take that step.
If you need guidance on which technical solution best fits your situation — whether a full ERP, an invoicing module, or an integration with your current system — the team at Summum Sistemas can help you map the shortest path to compliance, a team that has been implementing management software for SMEs in Castilla y León and the Canary Islands since 2017.