Skip to main content

RD 1007/2023 Explained Step by Step for Freelancers and SMEs: What It Requires and From When

· 12 min read
InvoSeal
InvoSeal
Facturación electrónica y cumplimiento normativo

If you are a freelancer or run a small or medium-sized business in Spain and have heard about RD 1007/2023, the VeriFactu Regulation or the "Anti-Fraud Law" without quite understanding what it means for you, this article is for you. We are going to explain — without unnecessary technicalities — what Royal Decree 1007/2023 requires, who it applies to, from when, and above all, what concrete steps you can take today to reach 2027 without surprises.

What is RD 1007/2023 and why does it matter​

Royal Decree 1007/2023, of 5 December, published in the Spanish Official Gazette (BOE) on 6 December 2023, is the regulation that develops Article 29.2.j) of the General Tax Law, introduced by Law 11/2021 (known as the Anti-Fraud Law). In plain English: it is the regulation that sets out how invoicing software programs must work.

Its goal is not to complicate your life. It is to put an end to so-called "dual-use software": programs that allowed users to keep two sets of accounts, modify already-issued invoices or delete records without leaving a trace. The Spanish Tax Agency (AEAT) estimates that this practice resulted in significant revenue losses, and the regulatory response has been to require any invoicing program (what the regulation calls a Sistema Informático de Facturación or SIF) to guarantee four non-negotiable principles: integrity, conservation, traceability and immutability of records.

For you, as a freelancer or SME, the translation is simple: from the date that applies to you, you will not be able to keep invoicing with Excel, Word, homemade templates or programs that are not adapted to RD 1007/2023. And if you do, the fines are fixed, not graduated, and apply even when there is no fraud whatsoever.

Who does it apply to (and who not)​

Article 3 of Royal Decree 1007/2023 defines the subjective scope. The regulation applies to all individuals and legal entities carrying out economic activities and issuing invoices through a computer system, including:

  • Companies subject to Corporate Income Tax (S.A., S.L., cooperatives, etc.).
  • Self-employed individuals taxed under personal income tax for economic activities.
  • Income attribution entities (community of property, civil partnerships).
  • Permanent establishments of non-residents in Spain.

There are, however, important exclusions worth knowing:

  • Companies under SII (Immediate Information Supply). If your company already sends invoice records to the AEAT through SII, you fall outside the scope of RD 1007/2023. They are different systems that do not overlap.
  • Foral territories. The Basque Country has its own system (TicketBAI) and Navarra is developing its own regulations.
  • Those who do not invoice through computer systems. If you issue all your invoices by hand, on paper and without any program, you would technically not fall within the scope of the regulation. That said, this option is residual and, with the parallel entry into force of mandatory B2B electronic invoicing, will be unfeasible in practice for most activities.

If you have doubts about your specific case, it is best to consult your tax advisor before making decisions.

Specific obligations introduced​

RD 1007/2023 obliges you, from the date that applies to you, to use a SIF that complies with the regulation's requirements. In practice, this means:

  • That the program you use to invoice automatically generates, for each invoice, a structured invoicing record with all the data required by the regulation.
  • That this record is protected with a digital fingerprint (SHA-256 hash) that prevents undetectable subsequent modifications.
  • That each new record is chained with the previous one, forming an immutable sequence.
  • That every invoice issued carries a tax QR code allowing its verification.
  • That the software provider has given you a Responsible Declaration certifying that their program complies with the regulation.

There are two modalities for compliance: VeriFactu (you send records to the AEAT in near real time) or No-VeriFactu (you keep them locally with reinforced security measures). If you want to dive deeper into the differences, we have a dedicated article: VeriFactu vs No-VeriFactu: Key Differences, 2027 Deadlines and Which to Choose.

The 8 minimum SIF requirements​

For an invoicing program to be considered compliant with RD 1007/2023, it must meet the following eight requirements (essentially set out in Articles 7 and 8 of the regulation):

  1. Integrity — Invoice data cannot be altered once generated without leaving evidence.
  2. Conservation — Records are kept for the legally required period (minimum 4 years under the General Tax Law).
  3. Accessibility — The AEAT must be able to access and extract records when required.
  4. Legibility — Records must be readable in electronic format.
  5. Traceability — Every operation must be traceable from its origin.
  6. Immutability — An issued invoice cannot be modified or deleted; corrections are made through corrective invoices.
  7. Chaining — Each record includes the first 64 characters of the previous record's hash, forming a verifiable chain.
  8. Manufacturer's Responsible Declaration — Document from the software provider certifying compliance. Without this document, the program is not considered compliant.

In addition, on the visible invoice, the tax QR code in accordance with the ISO/IEC 18004 standard, with a size between 30 and 40 millimetres, which the recipient can scan to verify the invoice.

If you want the exhaustive detail of the fields each record must contain, we break it down in this complementary article: Complete Checklist: What an Invoice and a SIF Must Contain Under RD 1007/2023.

Implementation timeline: key dates 2026 and 2027​

This is probably the most important section for you, because it has changed twice in the past year and much content online remains outdated. The dates currently in force (as of April 2026), following the latest modification introduced by Royal Decree-Law 15/2025, of 2 December (BOE of 3 December 2025), are:

MilestoneDateStatus
Publication of RD 1007/20236 December 2023✅ In force
Publication of Order HAC/1177/2024 (technical specifications)28 October 2024✅ In force
Deadline for software manufacturers (9 months from the Order)29 July 2025✅ Met
AEAT free application availableOctober 2025✅ Available
Obligation for companies (Corporate Income Tax)1 January 2027🟡 Upcoming
Obligation for freelancers and other obliged parties1 July 2027🟡 Upcoming

In other words: if you are a freelancer, you have until 1 July 2027 to have your invoicing system adapted. If you are a company, your deadline is 1 January 2027.

There is an additional relevant detail: throughout 2026, a testing environment is maintained on the AEAT's website where obliged parties can submit test records without consequences. It is the ideal time to adapt at a calm pace.

Penalty regime: fines for non-compliance​

The penalty regime is set out in Article 201 bis of the General Tax Law, introduced by Law 11/2021. It distinguishes between two types of offence:

End-user offence (freelancer or SME): the mere possession of a non-certified SIF, when it should be certified, or the use of a certified system that has been modified to bypass controls. The penalty is a fixed pecuniary fine of €50,000 per fiscal year.

Software manufacturer offence: producing, manufacturing or marketing systems that do not comply with the regulation. The penalty rises to €150,000 per fiscal year and per type of software, plus €1,000 for each system marketed without certification when this is required.

The most delicate detail, as confirmed by the AEAT itself in its FAQ, is that the penalty applies for the mere possession or use of non-compliant software, without the inspection having to prove fraud or hidden income. It is enough for the system to be installed and operational. There is a reasonable exception: if you keep the old program only to consult historical invoices but cannot invoice with it, the offence might not be considered committed — always with assessment of the obliged party's behaviour.

The operational recommendation is clear: when you reach your obligation date, uninstall or disable the invoicing function of any old program, export its records and keep them as a historical archive.

How to prepare your business step by step​

These are the concrete steps you can take from today, ordered from least to most effort:

Step 1 — Audit your current situation. What do you invoice with today? If the answer is Excel, Word, a homemade template or an old program, take note that you will need to change before July 2027. If you use a commercial invoicing program, move to step 2.

Step 2 — Ask your provider for the Responsible Declaration. This is the key document, your legal shield. Any legitimate invoicing software provider should be able to deliver it within days. If they stall or do not know what you are talking about, consider changing providers; that is a sign of non-compliance.

Step 3 — Verify the visible elements on your invoices. An invoice issued by a compliant SIF must include, in addition to traditional data: a tax QR code, and — if you work in VeriFactu mode — the mention "Invoice verifiable on the AEAT electronic portal" or the word "VERI*FACTU".

Step 4 — Decide your modality: VeriFactu or No-VeriFactu. This is not a minor decision. The VeriFactu modality is operationally simpler (you send and forget) but implies immediate visibility of your invoices for the AEAT. No-VeriFactu requires more technical responsibilities (event logging, electronic signature) but keeps data local until requested.

Step 5 — If you are a freelancer with few invoices, evaluate the AEAT free application. The Tax Agency has made available since October 2025 a free application for issuing invoices compliant with the regulation. It is functional for low volumes and without integration needs.

Step 6 — If you need integration with accounting, POS, e-commerce or other systems, look for a professional solution. The market for adapted SIFs is already wide and there are solutions for all budgets and verticals.

Step 7 — Take advantage of the testing environment during 2026. Configure your system in test mode, issue some invoices, verify that QRs work, that records are generated correctly. It is free and without consequences.

Step 8 — Keep your tax advisor informed. Compliance with RD 1007/2023 has tax and accounting implications. Your advisor must be aware of the software you use and the chosen modality.

Frequently asked questions​

Does RD 1007/2023 require the use of electronic invoicing?

No. RD 1007/2023 regulates the requirements of invoicing software, not the document format. You can keep issuing paper invoices (with QR code) if your activity allows it. The electronic invoicing obligation is a different regulation, coming from RD 238/2026 and the Crea y Crece Law, with different deadlines. They are two obligations that coexist.

What if I am under SII?

If your company is registered under SII (mandatorily or voluntarily), you fall outside the scope of RD 1007/2023. If at any point you exit SII, the regulation would apply to you from that moment.

What if I issue all my invoices by hand, on paper?

Technically, if you do not use any computer system, you are not obliged by RD 1007/2023. In practice, this option is very residual and, with the upcoming mandatory B2B electronic invoicing, will be unfeasible for most activities.

Can I be fined even if my invoicing is correct?

Yes. The penalty under Article 201 bis LGT applies for the mere possession of non-compliant software when it should be certified, without the need to prove fraud. That is why it is so important to adapt before the deadline.

Do I have to change software if I already use one?

It depends on whether your current program is adapted to RD 1007/2023 or not. Ask your provider for the Responsible Declaration: if they have it and it is up to date for your version of the software, you do not need to change. If they do not have it or do not update it, yes you do.

How much does an adapted SIF cost?

There are free options (the AEAT application, valid for freelancers with low volume), options from €5-10 per month for freelancers with medium volume, and enterprise solutions with accounting integration and multi-user functionality in higher ranges. We have a comparative analysis: VeriFactu Invoicing Software 2027: 21 Programs Compared.

Do simplified invoices (tickets) also need to carry the QR?

Yes. Both complete and simplified invoices issued through a SIF must include the tax QR code.

What happens if my system fails and I cannot issue the QR?

The regulation contemplates the possibility of technical incidents. In that case, you must register the event in the system (it is one of the requirements of the event log in No-VeriFactu mode) and issue the pending invoices as soon as the system is operational again. The AEAT does not penalise documented occasional incidents; it does penalise the possession of non-compliant software.

Conclusion: prepare in 2026 to comply in 2027​

RD 1007/2023 is one of the most relevant invoicing reforms in recent years. For you, freelancer or SME, the keys are three:

  • You have until 1 July 2027 (companies, until 1 January 2027) to have an adapted SIF.
  • The penalty for non-compliance is €50,000 per fiscal year, fixed and without the need for fraud.
  • The deadline seems far, but 2026 is the year to prepare: the testing environment is active, the market for adapted SIFs already exists and providers have the capacity to respond.

Do not wait until June 2027 to start. In the last months before entry into force, providers become saturated, support channels collapse and prices rise. The cost of preparing today is minimal. The cost of not being ready, €50,000.

Related reading:

InvoSeal is a SIF adapted to RD 1007/2023 and Order HAC/1177/2024, with dual VeriFactu / No-VeriFactu modality, SHA-256 hash, chaining, tax QR and Responsible Declaration. If you want to reach 2027 without setbacks, check our documentation or get in touch.