VeriFactu declaration of responsibility (draft)

DRAFT — not a signed declaration and not a production approval. This reference follows the responsibility requirements in Order HAC/1177/2024, including Article 15 and its Annex. It requires review by Spanish counsel and completion by the actual software producer before release.

Required declaration fields (Article 15, in order)

This is an unsigned template, not a declaration already made. Replace every placeholder from authoritative producer and release records before publication.

DECLARACIÓN RESPONSABLE DEL SISTEMA INFORMÁTICO DE FACTURACIÓN

a) System name: Space Invoices.

b) System identifier: SI.

c) Complete version identifier: 1.0.0.

d) Components and functions: A hosted invoicing system comprising the browser application and embedded React interface; the Hono/Bun HTTP API; PostgreSQL document, fiscal-record and submission-attempt storage; encrypted client-certificate storage; the XML record encoder and SHA-256 hash chain; an HTTPS client using mutual TLS to AEAT; a scheduled retry worker; and shared HTML/React PDF invoice templates. It generates invoices and their fiscal records atomically, preserves issued records, retains submission evidence, provides append-only correction and cancellation operations, and renders the stored verification URL as a QR code. Server infrastructure, networking and a supported client browser provide the hardware execution environment. TO COMPLETE BEFORE SIGNATURE — attach the actual deployed hardware/hosting inventory, component versions and release identifier, and verify this description against that deployment.

e) Exclusive VERI*FACTU operation: S (the current product identity declares TipoUsoPosibleSoloVerifactu=S; verify this remains true for the signed version).

f) Multiple taxpayers: S (the current product identity declares TipoUsoPosibleMultiOT=S; verify the producer’s final statement and scope).

g) Signatures when not VERI*FACTU: N/A for this exclusive VERI*FACTU configuration. If that configuration changes, replace this entry with the signature types actually used.

h) Producer legal name: MISSING — insert the verified legal name of the software producer.

i) Producer tax identity: MISSING — insert the Spanish NIF, or the complete alternative identification type and issuing country where no Spanish NIF exists.

j) Complete producer postal address: MISSING — insert street, number, postal code, locality, province/region where applicable, and country.

k) Compliance attestation: UNSIGNED TEMPLATE — the producer must attest that version 1.0.0 complies with Article 29.2.j) of Law 58/2003 (LGT), Real Decreto 1007/2023, Order HAC/1177/2024, and the AEAT electronic-office specifications that complete that Order.

l) Complete date and place of subscription: MISSING — insert day, month and year; then locality and country, and obtain the authorised signature.

The producer must make the final declaration legible, individually identifiable, and rapidly accessible inside the software and provide it to the commercialiser and customer in a widely usable free format. This draft does not claim producer signature, AEAT approval, or completed live conformance.

External release gates

Before a production release, the responsible producer must complete and retain the HAC/1177 declaration, counsel’s scope review, live conformance evidence, certificate and representative checks, and any current AEAT publication requirements. Production enablement remains gated until those records are complete. Sandbox/test operation is an integration aid and is not evidence that those gates are satisfied.

Suggested compliance annex: producer contacts and website; detailed mapping to the Order’s technical and functional requirements; retention, access, integrity, traceability, and security controls; supported country and tax scope; release version history; test and live-conformance evidence; and the process for reviewing the declaration after a material change.

The declaration should be updated when the software identity, version, supported fiscal scope, record format, or security controls materially change. Retain the signed version with the producer’s compliance records and make the final legal wording match the current official Annex.

References: Real Decreto 1007/2023 (BOE), Order HAC/1177/2024 (BOE), AEAT VeriFactu information, AEAT technical information, and the AEAT deadline notice.