Verifactu for Attorneys: Complete Guide to Royal Decree 1007/2023

What Verifactu Is and Why Now

Royal Decree 1007/2023 (known as the "Verifactu Regulation") requires all invoicing software systems to generate immutable integrity records. This isn't optional: it's a legal obligation whose violation carries penalties of up to €150,000 or the shutdown of the invoicing system.

The name "Verifactu" comes from "invoice verification", the goal is to make any retroactive invoice manipulation detectable, combating tax fraud.

Mandatory Compliance Deadlines

If your practice uses any software to issue invoices ( from a spreadsheet to an ERP or practice management software ) it falls within the regulation's scope.

What RD 1007/2023 Technically Requires

The regulation establishes three technical requirements for each invoice:

1. Immutable registration record (LROE)

Each invoice must generate a registration record that cannot be modified or deleted. If you need to correct an invoice, you must issue a corrective invoice, never edit the original.

2. SHA-256 hash chain

Each invoice must include:

• Its own SHA-256 hash (calculated on invoice data)
• The hash of the previous invoice in the chain
• A digital fingerprint linking both

This makes it mathematically impossible to insert, delete, or modify invoices without breaking the chain and making it detectable by the AEAT.

3. QR verification code

Each invoice must include a QR code allowing any recipient to verify its authenticity on the Tax Agency portal (sede.agenciatributaria.gob.es).

Why This Specifically Affects Attorneys

Law practices have particular characteristics that make compliance more complex:

Multiple tax regimes: A firm may have attorneys under different income tax regimes, each with different withholding rates (15%, 7% in early years) and VAT depending on territory (mainland VAT, IGIC in Canary Islands, IPSI in Ceuta/Melilla).

Mixed invoicing: Fixed fees + disbursements + retainers. Disbursements don't carry VAT; fees do. This distinction must be correctly reflected in the Verifactu record.

Invoices with withholding: Invoices to companies carry income tax withholding. The system must calculate and reflect it in the integrity hash.

How Verifactu Works in Lexiel

In Lexiel, RD 1007/2023 compliance is completely automatic and transparent:

You create the invoice in Lexiel

↓

Lexiel calculates VAT/IGIC/IPSI per territory

Lexiel calculates income tax withholding per your legal form

↓

Lexiel generates SHA-256 hash of the invoice

Lexiel chains the hash with the previous invoice

↓

Lexiel embeds AEAT-verifiable QR code

↓

Invoice generated as PDF ready to send

There's no "activate Verifactu" button. No extra configuration. No paid add-on. From your first day using Lexiel, every invoice you issue automatically complies with RD 1007/2023.

What Verifactu Does NOT Do (Clearing Up Common Myths)

There's significant confusion about what Verifactu involves:

It's not mandatory B2B electronic invoicing: That's a different regulation (the Crea y Crece Act, requiring electronic invoicing for B2B transactions). Verifactu is about record integrity, not issuance format.

It's not automatic real-time submission to the AEAT: Verifactu requires invoices to be available for AEAT inspection on request, but doesn't require automatic real-time submission for most businesses.

It doesn't apply to already-issued invoices: It only applies to invoices issued from the mandatory date onwards. You don't need to rehash your historical records.

Non-Compliance Penalties

RD 1007/2023 establishes specific sanctions:

• Using uncertified software: up to €50,000 per year of violation
• Tampering with the records system: up to €150,000
• Repeat violations: may result in prohibition from using any invoicing software

The AEAT has technical capacity to detect inconsistencies in hash chains, making the detection risk real.

Compliance Checklist for Your Practice

Before the deadline, verify:

• [x] Your invoicing software generates chained SHA-256 hashes
• [x] Each invoice includes an AEAT-verifiable QR code
• [x] Invoices are immutable (corrective invoices only, never editing originals)
• [x] The system records the date, time, and hash of each invoice
• [x] You maintain record custody for at least 4 years

If you use Lexiel, all these boxes are checked from day one.

Conclusion

Verifactu is neither optional nor deferrable. For practices using management software, the obligation arrives by January 2026 at the latest, and the penalties are high enough to take seriously.

The good news: if you already use Lexiel, you don't need to do anything. If you don't, this is a good time to evaluate whether your current software complies, or whether it makes sense to migrate to a platform integrating legal AI, practice management, and tax compliance in one tool.

See how Lexiel handles Verifactu →