Software Certification, SAF-T, ATCUD, and QES Explained
Fiscalization in Portugal is easier to plan for once you understand the model behind it. The Autoridade Tributária e Aduaneira (AT), the Portuguese tax authority, certifies invoicing and point-of-sale (POS) software before a business may use it. Certified software then sends invoice data to AT once a month in a SAF-T file – as the most common invoice reporting model, but not the only one available. Portugal does not clear each transaction as it happens, so the model differs from Croatia, or from the Czech Republic once its system arrives. POS developers, ERP vendors, and international retailers face a build-and-certify project first, and a steady monthly routine afterwards.
Who Must Comply – Scope of Fiscalization in Portugal
The rules follow the invoice, not the shop floor. Portuguese-established businesses – head office, permanent establishment, or domicile in Portugal – must use software that AT has certified in advance. The same duty falls on non-resident taxable persons whose invoicing obligation sits under Portuguese VAT (value added tax) law.
The obligation applies whenever one of these conditions is met: turnover above €50,000 in the previous calendar year (annualised if the first year is shorter), use of invoicing software, or an obligation to keep organised accounting, including where the business has opted for it.
Scope is also wider than the sales invoice. Portuguese law covers faturas e demais documentos fiscalmente relevantes – invoices and all other fiscally relevant documents. Credit notes, debit notes, delivery notes, and transport documents sit inside the same framework.
| Business scenario | What applies | Notes |
|---|---|---|
| POS or invoicing software vendor | AT certification of the software product | The producer carries the certification duty, not the merchant |
| Portuguese retailer or HoReCa operator | Certified software + monthly SAF-T Billing | Must verify the product appears on the AT list before purchase |
| Foreign retailer with Portuguese stores | Certified software + monthly SAF-T Billing | Local fiscal representation may be required |
| Foreign company with a Portuguese VAT number, no premises | Certified software where PT rules govern the invoice | Physical presence is not the test |
| SaaS or cloud POS provider serving PT merchants | Certification of the platform | Multi-tenant setups still need one certified product |
| Marketplace operator | Depends on who issues the invoice | Scoping call recommended before the build starts |
A foreign company with a Portuguese VAT registration therefore falls in scope on the same terms as a local one.
AT Software Certification – What It Is, How It Works, and Why It Can Be Revoked
Certification is a technical exam, not a form. AT expects the software to sign every document with an RSA key pair registered with the authority, under Portaria n.º 363/2010. It also expects ATCUD generation, a QR code on the printed or digital document, a valid SAF-T export, and a complete audit trail behind all of it.
The route from scoping to listing
- Confirm scope and decide which documents the product issues.
- Map each document type to its fiscal requirements.
- Build the ATCUD, QR code, RSA signature, and SAF-T functions.
- Submit the certification application to AT.
- Pass any compliance tests AT asks for.
- Appear on the AT list of certified software, then go live.
- Monitor rule changes and keep the product aligned.
Timing surprises most teams. AT works to a 30-day decision period, and that period is suspended when compliance tests are required until those tests finish. The preparatory work in front of it is the long part: six months to a year is realistic for a product that starts from zero. Our project management support exists mainly for this stretch.
Certification is not permanent either. AT keeps the certified software list current, and a product that no longer meets the rules can lose its listing. Before you sign with any vendor, check the product on the AT portal – the register is public, and the check takes a minute.
SAF-T in Portugal – Billing, Accounting, and What Each Requires
Two files share one name, and the confusion costs projects time. SAF-T (PT) stands for Standard Audit File for Tax (Portuguese version), an XML file AT uses to read your data in a fixed structure.
| File | What it contains | Who submits | Frequency | Next deadline |
|---|---|---|---|---|
| SAF-T Billing | Invoices and other fiscally relevant documents issued in the period | The taxable person issuing the documents | Monthly | 5th of the following month |
| SAF-T Accounting | The full accounting record for the fiscal year | The taxable person, usually through the accounting system | Annual | Fiscal year 2027, first submission in 2028 |
The 5th-of-month deadline is firm, and AT grants extensions only in exceptional cases. Most POS vendors deal with SAF-T Billing alone, because SAF-T Accounting reaches into the accounting or ERP layer rather than the till.
Connectivity deserves a note here. A POS system can still create fiscal documents locally when the line drops, so the shop keeps trading. What it cannot do is postpone the file forever – you reconcile and submit once connectivity returns.
ATCUD, QR Code, and Document Traceability – The Technical Core
ATCUD ties the whole framework together. The full name is Código Único do Documento, the unique document code, and Decreto-Lei n.º 28/2019 made it mandatory alongside the QR code.
The sequence runs in one direction, and teams that skip a step usually discover it late:
- Register each document series with AT.
- Receive the validation code for that series.
- Build the ATCUD for every document from that validation code.
- Print the ATCUD and encode the document data in the QR code.
- Sign the document with the RSA key, so nobody can alter it afterwards.
ATCUD belongs on every fiscally relevant document, not only on the standard sales invoice. In a typical retail or HoReCa environment that means:
- invoices and invoice-receipts
- simplified invoices
- credit notes and debit notes
- delivery notes
- transport documents (guias de transporte)
The QES transition
Portugal treats a PDF invoice with a valid QR code as an electronic invoice until 31 December 2026. From 1 January 2027 the position changes. Where invoices or other fiscally relevant documents go out electronically, the authenticity of origin and the integrity of content must be guaranteed by one of three methods: a qualified electronic signature (QES), a qualified electronic seal, or an electronic data interchange system. Product roadmaps for 2026 should already carry this item.
B2G E-Invoicing – A Separate Obligation for Public Sector Suppliers
Suppliers to Portuguese public administration face a second, separate layer. Structured e-invoices travel through the eSPap / FE-AP platform in the CIUS-PT profile, which builds on UBL 2.1 and follows the European standard EN 16931.
This layer is narrow on purpose. Portugal does not operate a general B2B e-invoicing clearance mandate, and readers who compare Portugal with Italy, Spain, or France should keep that line clear.
Compliance Calendar – Key Deadlines and Forward-Looking Obligations
| Date | Obligation | Notes |
|---|---|---|
| 5th of each month | SAF-T Billing submission for the previous month | Hard deadline; extensions are exceptional |
| 1 January 2027 | QES, qualified seal, or EDI for electronic documents | PDF with QR code accepted until 31 December 2026 |
| 2028 (for FY2027) | First SAF-T Accounting submission | Preparation belongs in the 2026–2027 roadmap |
Compliance does not stop at the certificate. Rules move, listings change, and a new mandate can land in the middle of a release cycle, which is why clients pair a build project with regulatory monitoring and on-going support.
Penalties for Non-Compliance – RGIT Fine Structure
Penalties sit in the RGIT (Regime Geral das Infrações Tributárias), the Portuguese general regime for tax infringements.
| Scenario | Legal basis | Fine range |
|---|---|---|
| Failure to use certified invoicing software or equipment | RGIT | €1,500–€18,750 |
| Failure to issue invoices | RGIT | €150–€3,750 |
| Missing QR code or ATCUD on documents | RGIT | Treated as a defective document breach |
| Missed or late SAF-T submission | RGIT | Assessed per reporting failure |
AT auditors tend to look at the same four things: the certified software listing, consistency of the ATCUD chain, validity of RSA signatures, and the record of SAF-T submissions.
Keep the evidence where you can reach it:
- the AT registry listing for your software product
- series registration and validation code records
- SAF-T submission receipts
- the public key or declaration filed with AT
- sample receipts and invoices showing QR code and ATCUD
Frequently Asked Questions
Does my software need to be AT-certified if I am a foreign company serving Portuguese merchants?
Yes. Certification is the duty of the software producer, not the merchant who uses it. If your product issues invoices in Portugal, AT must certify it, and the result appears on the public register at portaldasfinancas.gov.pt. A consulting session is usually the fastest way to settle the scope question for your specific setup.
What is the difference between SAF-T Billing and SAF-T Accounting?
SAF-T Billing is the monthly invoice data file, due by the 5th of the following month. SAF-T Accounting is the full fiscal year file, first due in 2028 for fiscal year 2027. Most POS vendors need to solve SAF-T Billing only, because SAF-T Accounting sits with the accounting system.
Do all our documents need ATCUD – not just invoices?
Yes. Every fiscally relevant document carries an ATCUD and a QR code: invoices, simplified invoices, credit notes, debit notes, delivery notes, and transport documents. This is the most common implementation mistake among POS vendors who enter Portugal.
Is Portugal a real-time e-invoicing country like Italy or Spain?
No. Portugal uses software-based fiscalization with monthly SAF-T reporting, not real-time clearance. B2G e-invoicing runs through eSPap, but there is no general B2B clearance requirement.
What happens if AT revokes our software certification?
AT can revoke certification when a product no longer meets the requirements, and the software cannot legally issue invoices until it is certified again. The list changes over time, which is the practical argument for regulatory monitoring rather than an annual check.
If a POS system achieved fiscalisation/acceptance in Portugal a certain time ago (for example around five years ago), may it continue to be used and installed there, or does it require a new acceptance procedure?
If you have successfully passed the certification with the authorities in Portugal, you are not required to subject the newer versions to new certification procedures. During the initial certification procedure, the developer company had to commit and agree to making updates of the software in question in accordance with all legal requirements which would be introduced after the certification, in order to legally stay on the market with a compliant software.
Can an invoice be used as a transport document?
Yes, it can. If an invoice is issued that also serves as a transport document, it must be included in the table of commercial documents to customers (SalesInvoices) and not in the table of goods movement documents (MovementOfGoods).
Fiscalization in Portugal is a stable framework with a long tail of detail, and most of the risk sits in scope decisions made early. Our Country Essentials page is the quickest starting point.
| The information on this page does not constitute legal advice. JB Fiscal Consulting cannot be held responsible for errors or omissions. Please contact us if you have specific questions about your compliance situation. |
JB Fiscal Consulting offers Consulting Sessions, Fiscalization Essentials Sessions, Regulatory Monitoring, Documentation and Ongoing Support for businesses. Contact us at office@jbfiscalconsulting.com or visit jbfiscalconsulting.com to discuss your compliance situation.
Phone: +381 62 420 541 Monday – Friday, 09:00 – 17:00 CET