Why Issuing Invoices in Word or Excel Is Illegal in Portugal: Certified Software and SAF-T Rules

Chief Compliance Directive: In Portugal, billing is not a typographical layout exercise; it is an unalterable cryptographic ledger. If your company issues even a single commercial invoice or receipt outside an AT-certified billing engine, you are committing a statutory tax infraction carrying severe financial penalties and criminal tax exposure.

Over my thirty-five years auditing businesses and managing accounting organizations across Portugal, I have seen newly minted entrepreneurs and foreign executives arrive in Lisbon or Porto assuming that billing works the same as in the UK or the United States. In the Anglo-Saxon world, a business owner can open Microsoft Excel, type a professional invoice template, export a PDF, email it to the client, and record the payment upon receipt.

Try that in Portugal, and you will find your business subject to immediate tax sanctions under Decree-Law no. 28/2019 and the General Regime of Tax Infractions (Regime Geral das Infrações Tributárias - RGIT). In Portugal, an invoice generated in Microsoft Word, designed in Canva, or calculated in an Excel sheet is legally classified as an invalid, non-compliant document—and in severe cases, as tax fraud.

Portuguese fiscal architecture relies on an immutable chain-of-custody model. Every certified billing platform must incorporate asymmetric cryptographic hashing (RSA encryption) certified directly by the Autoridade Tributária e Aduaneira (AT). Each invoice links cryptographically to the preceding document in the series, ensuring that no invoice can ever be altered, backdated, or deleted without breaking the entire chain.

To eliminate compliance exposure, modern businesses must implement an integrated business digitalization starter pack alongside enterprise digitalization workflows.

PORTUGUESE CERTIFIED INVOICING CRYPTOGRAPHIC CHAIN

• Invoice Creation Event (AT Certified Engine)
• DOCUMENT PAYLOAD DATA: Invoice number, date, NIF, line items, VAT breakdown
• PREVIOUS INVOICE HASH: Cryptographic signature of Invoice N-1 in same series
• Asymmetric Encryption (Private RSA Key)
• NEW GENERATED HASH & QR CODE
• Unique 172-character signature stored in SAF-T database
• First 4 characters printed on invoice footer (e.g., “Ab3F-Processado”)
• Two-dimensional QR code & ATCUD code embedded on invoice page
• MONTHLY SAF-T (PT) BILLING EXPORT
• Submitted to Portal das Finanças by the 5th day of the following month

The Legal Framework: Decree-Law 28/2019 and AT Certification

The requirement to use certified invoicing software is codified in Portaria n.º 363/2010 (subsequently modified by Portaria n.º 195/2020) and consolidated under Decreto-Lei n.º 28/2019.

Under current Portuguese legislation, any entity carrying out commercial, industrial, or agricultural activities in Portugal must use certified billing software if it meets any of the following statutory conditions:

1. It maintains an annual turnover exceeding €50,000 (or when the company exceeds that threshold in the following fiscal year).
2. It utilizes any form of electronic or computerized data processing to issue billing documents.
3. It is legally obligated to maintain organized commercial accounting (contabilidade organizada), regardless of turnover volume.

The second condition is the crucial legal trap: if you do not use pre-printed typography-stamped manual receipt books (livros de faturas impressos em tipografias autorizadas), any computerized document you generate must be produced by an officially certified software platform. This completely outlaws Word, Excel, Google Docs, or custom in-house software scripts that have not undergone the grueling certification process at the Tax Authority.

When software is certified, the AT assigns a unique 4-digit certification number (e.g., “Software Certificado n.º 2145/AT”). That exact number, along with the software name, version, and the cryptographic hash snippet, must appear legibly in the footer of every invoice, credit note, proforma, or debit note issued.

How the Cryptographic RSA Hash and ATCUD Work

Why is the Portuguese Tax Authority so obsessed with certified software? Because the software creates a mathematically unbreakable digital audit trail using RSA public-private key cryptography.

Here is the exact mechanism that occurs in milliseconds when you click “Emitir Fatura”:

1. The software compiles the transactional data: the document date, exact timestamp, invoice series, invoice number, customer NIF, taxable lines, and VAT rates.
2. It retrieves the full cryptographic hash of the immediately preceding invoice in that exact same series (Document N-1).
3. The software combines the current invoice payload with the prior invoice hash and signs the combined string using its private cryptographic key, which is registered exclusively with the Tax Authority.
4. The system outputs a new 172-character base64 hash. The software extracts the 1st, 11th, 21st, and 31st characters of this hash and prints them on the physical document (e.g., Hash: a4K9 - Processado por Programa Certificado n.º XXXX/AT).
5. The software embeds the unique ATCUD code (a unique validation code assigned by AT to your registered invoice series) and the mandatory two-dimensional fiscal QR code.

If anyone attempts to alter an invoice retroactively, delete a transaction, or insert a missing number into the sequence, the cryptographic hash chain breaks instantly. When the monthly SAF-T (PT) billing file is generated and validated by the AT portal, the validation engine detects the broken mathematical sequence and flags the company for an immediate criminal tax audit.

NON-CERTIFIED INVOICING PENALTY CASCADE

• Issuing Invoices via Excel / Word / Manual PDF
• DIRECT CORPORATE FINES: RGIT Art. 128: €1,500 to €37,500 per infraction
• TAX DEDUCTION COLLAPSE: Clients cannot deduct VAT or corporate income tax
• CRIMINAL TAX EVASION EXPOSURE (RGIT)
• Presumption of fraudulent billing & suppressed sales
• Reversal of burden of proof onto corporate directors
• Formal notification to Portuguese Public Ministry

The Catastrophic Sanctions: RGIT Fines and Client Contagion

The consequences of issuing non-compliant billing documents in Portugal extend far beyond minor administrative reprimands. The statutory penalties hit both the issuer and their corporate clients with devastating force:

1. Fines on the Issuing Company (RGIT Article 128)

Under Article 128 of the Regime Geral das Infrações Tributárias, issuing invoices without using officially certified billing software, or failing to communicate invoice series to the AT, carries corporate fines ranging from €1,500 to €37,500. For deliberate systems designed to evade tax, managers can face personal subsidiary liability and criminal indictment for fiscal fraud (fraude fiscal).

2. Client Invalidation and Commercial Fallout

When you send an uncertified Word or Excel invoice to a Portuguese corporate client, their certified accountant will immediately reject it. Why? Because under Article 19 of the VAT Code (CIVA) and Article 23 of the Corporate Tax Code (CIRC), a company cannot deduct input VAT or record a deductible corporate expense based on an invoice that lacks valid AT certification, ATCUD, and cryptographic hashes.

Your client will refuse to pay your invoice until you issue a legally compliant replacement document from a certified system. If an audit discovers that a client previously accepted non-certified invoices from you, the Tax Authority will disallow their tax deductions, assess back taxes, and initiate an inspection against your company.

The SVAT Seal: Ensuring Accounting Integrity

Beyond billing software, Portuguese legislation introduced the Selo de Validação da AT (SVAT) for commercial Enterprise Resource Planning (ERP) and accounting software systems (Portaria n.º 293/2017).

While basic billing certification guarantees that invoices cannot be manipulated, the SVAT seal certifies that the accounting software accurately maps financial transactions to the official Portuguese standard chart of accounts (SNC - Sistema de Normalização Contabilística) and correctly produces the SAF-T (PT) da Contabilidade.

When choosing your corporate software stack in Portugal, always verify whether your accounting and ERP vendors carry both:

• Active AT Billing Certification Number.
• Formal SVAT Seal validation for general ledger compliance.

Using non-compliant software platforms forces your accounting team to perform costly manual data conversions, increasing human error rates and inviting regulatory scrutiny during periodic financial reporting.

Best Practices for Modern Invoicing Architecture

Complying with Portuguese billing law does not mean drowning in administrative bureaucracy. Modern cloud platforms and open APIs have made compliance seamless, automated, and secure.

First, banish manual invoicing completely. Never allow sales representatives or department managers to draft “interim invoices” or “draft receipts” on desktop software. Every commercial quotation must flow through an approved, cloud-based certified billing platform with multi-factor authentication.

Second, automate your monthly SAF-T submissions. By configuring real-time webservice communication with the Portal das Finanças, your certified software transmits billing records to the Tax Authority automatically by the 5th day of every month, eliminating the risk of late-filing fines.

Third, consult experienced fiscal and technological advisors. Through professional management advisory at helderconta.com and enterprise technology integration from webxtek.com, your organization can implement compliant, cloud-native billing architectures that satisfy every requirement of Portuguese fiscal law while accelerating customer collections.

In practice, we apply these exact architectural standards across specialized sectors including traditional accounting firms and accounting outsourcing firms. Whether you are modernizing core workflows through the smart way to digitalize your offline business and business digitalisation, connecting sector-specific requirements to disciplined execution is what turns technical theory into compounding commercial advantage.