Certification Requirements by Country
What you need to legally operate fiscalization software in each supported country. This covers pre-approval processes, signing requirements, costs, and timelines.
Quick Reference
| Country | System | Pre-Approval? | Cost | Timeline | Hardest Part |
|---|---|---|---|---|---|
| France | NF525/LNE | Yes (mandatory audit) | ~€6-9K + €2-3K/yr renewal | 1-6 months | 2-day on-site audit |
| Spain - TicketBAI | Regional registration | Yes (provincial) | €5-10K | 3-4 months | Provincial variations |
| Spain - Verifactu | Self-certification | No | €0 | N/A | Responsible declaration per version |
| Spain - SII | None (cert required) | No | €0 | N/A | Mutual TLS with FNMT cert |
| Italy - SDI | Channel auth | No | €0 | 2-4 months | Async notification handling |
| Italy - DC/SSW | Software certification | Yes | €3-8K | 6-12 months | QTSP electronic seal |
| Portugal | AT certification | Yes (free) | €0 | 1-6 months | 30-day standard review |
France — NF525/LNE Certification
Status: Mandatory since March 1, 2026 (self-certification ended February 16, 2025)
What It Is
All POS and invoicing software used in France must be certified NF525-compliant by an accredited body. This proves your software meets the ISCA requirements:
- Inalterability — transactions cannot be modified after recording
- Security — digital signatures on all transactions (ECDSA P-256)
- Conservation — 6-year minimum data retention with integrity mechanisms
- Archiving — immutable Technical Event Log (JET)
Certifying Bodies
- Infocert (NF525 Certification, managed by AFNOR Certification)
- LNE (Laboratoire National de Métrologie et d'Essais)
Certification Process
- Registration — Submit application with certification rules acknowledgment
- Development (1-6 months) — Implement ISCA requirements in software
- Training (optional) — Half-day session on audit expectations
- Audit — 2-day on-site compliance audit by certified auditors
- Decision — Certificate issued within 30 days of audit
Cost
- Initial certification: €6,000-€9,000 per software product
- Annual renewal: €2,000-€3,000
Technical Requirements
- ECDSA P-256 signing with SHA-256 hash chaining
- Receipt signature extract (4 characters from signature)
- JET (Technical Event Log) — append-only, per-register
- Grand totals tracking (daily, monthly, yearly, perpetual)
- Chain verification capability (re-verify from genesis)
Penalties for Non-Compliance
- €7,500 per non-compliant system
- 15% of turnover for software publishers
- Accounting rejection by tax authority
Our Implementation
- Adapter:
rust/adapters/france/src/ - Signing:
signing.rs— ECDSA P-256, chain per register_id - JET: Managed in adapter state
- Receipt: NF525Receipt with fiscal_id, signature extract, cert ref
Spain — Three Systems
TicketBAI (Basque Country)
Status: Fully operational and mandatory
Who: Businesses in Gipuzkoa, Araba, and Bizkaia
Pre-Approval: Must register as "guarantor software" with provincial tax authorities. Shared certification across all three provinces.
Signing: XAdES-EPES baseline signatures with qualified electronic certificates from CERES or ANF AC (Spanish trust service providers)
Transmission:
- Gipuzkoa/Araba: Real-time XML POST to regional authority
- Bizkaia: Daily LROE batch at 2 AM UTC
Cost: €5,000-€10,000 (certification + certificate costs) Timeline: 3-4 months
Penalties: 20% of previous year's turnover (minimum €20,000)
Our Implementation:
rust/adapters/spain/src/ticketbai/— XML generation, XAdES signing, LROE batch, TBAI ID generation- Per-NIF invoice chaining
Verifactu (Rest of Spain)
Status: Mandatory from January 1, 2026
Who: Small/medium businesses outside Basque Country
Pre-Approval: None. Self-certification via "Responsible Declaration" — a template provided by AEAT that you embed in your software confirming technical compliance. Each software version requires a separate declaration.
Signing: SHA-256 hash chaining for invoice integrity
Transmission: Real-time SOAP to AEAT, within 4 calendar days of invoice issue
Cost: €0 (self-certification)
Penalties: €50,000 per fiscal year for non-compliant software; €150,000 per year per client for software developers
Our Implementation:
rust/adapters/spain/src/verifactu/— SOAP/XML submission, SHA-256 hash chain, QR code generation- Chain module:
verifactu/chain.rs
SII (Large Businesses)
Status: Live since July 2017
Who: Businesses with €6M+ annual turnover
Pre-Approval: None, but requires recognized electronic certificate from FNMT or AEAT-recognized CAs
Transmission: Real-time SOAP to AEAT within 4 calendar days. 7 record types (issued invoices, received invoices, intra-community, collections, payments, cash collections, investment goods).
Mutual TLS: Required — client certificate validation against AEAT servers
Cost: €0 (certificate cost only)
Penalties: 1% of annual Spanish turnover (min €600); 0.5% of transaction amounts for late reporting
Italy — Two Systems
SDI / FatturaPA (B2B/B2G Invoicing)
Status: Mandatory for B2B, fully enforced
Pre-Approval: No document-level certification. Authentication is channel-based (channel ID, password, API token).
Format: FatturaPA XML v1.2.2
Transmission: Real-time REST API to SDI. Asynchronous response model:
- RC (RicevutaConsegna) — delivered
- NS (NotificaScarto) — rejected
- MC (NotificaMancataConsegna) — delivery failed
Cost: €0 Timeline: 2-4 months for channel qualification
Our Implementation:
rust/adapters/italy/src/sdi_client.rs— REST submission, async notification handling
Documento Commerciale / SSW (B2C Retail)
Status: New system, mandatory from January 1, 2026. Replaces hardware RT devices. Transitional period through 2026.
Pre-Approval: Yes — software must be certified by accredited bodies before commercial use
Signing: Advanced Electronic Seal from a QTSP (Qualified Trust Service Provider), eIDAS-compliant. 4096-bit RSA certificates mandatory from May 31, 2025.
Format: DSW10 XML
Transmission: Binary octet-stream POST to AdE SSW API. Status polling required (PRONTA, IN_ELAB., NON_DISP. states).
Cost: €3,000-€8,000 (certification + QTSP certificate) Timeline: 6-12 months (longest certification path)
Data Retention: 10 years minimum
Our Implementation:
rust/adapters/italy/src/dc_client.rs— SSW API submission, pollingrust/adapters/italy/src/signature.rs— QTSP seal integration
Portugal — AT Software Certification
Status: Fully live (SAF-T since 2013, ATCUD/QR mandatory since 2023)
Pre-Approval: Yes — all POS applications must be certified by AT before use. Free of charge.
Certifying Body: Autoridade Tributaria e Aduaneira (AT), via Direcao-Geral dos Impostos (DGCI)
Certification Process
- Submit official declaration to DGCI
- Technical compliance testing by AT
- Conformity tests if required
- Certificate issued within 30 days (standard), 3-6 months (complex)
Technical Requirements
- ATCUD codes — unique document identifiers (validation code + sequential number)
- QR codes — per Portaria 195/2020 specification on every document
- SAF-T PT monthly filing — XML v1.04_01 format, due by 5th of each month
- Digital signatures — 4096-bit RSA certificates (mandatory May 2025)
- Sequential numbering — gap-free tracking per series
Cost
€0 — Portuguese government charges no certification fees
Penalties
- Individuals: €200-€2,000
- Companies: €250-€3,000
- Missing ATCUD/QR: document invalidity
Our Implementation:
rust/adapters/portugal/src/— ATCUD generation, QR content, SAF-T XML, monthly batch submission
Certification Roadmap
What We Need Before Go-Live
| Country | Certification Status | Blocker? |
|---|---|---|
| France | NF525 audit not yet scheduled | Yes — cannot operate without it |
| Spain - TicketBAI | Provincial registration needed | Yes — per province |
| Spain - Verifactu | Responsible Declaration ready | No — self-cert |
| Spain - SII | FNMT certificate needed | Yes — procurement |
| Italy - SDI | Channel qualification needed | Yes — 2-4 month lead |
| Italy - DC/SSW | QTSP certification needed | Yes — 6-12 month lead |
| Portugal | AT application needed | Yes — 1-6 month lead |
Priority Order (by deadline and lead time)
- Italy DC/SSW — longest certification lead time (6-12 months), Jan 2026 deadline
- France NF525 — requires on-site audit scheduling, Mar 2026 enforcement
- Spain TicketBAI — provincial registration, already mandatory
- Portugal AT — free but requires 1-6 months, already mandatory
- Italy SDI — channel qualification, already mandatory
- Spain Verifactu — self-cert, Jan 2026 deadline
- Spain SII — certificate procurement only