This week the founder asked two questions: could Hub issue invoices for our customers' own customers as a stopgap before Spain's VeriFactu deadline, and how would we get approved to sell invoicing software at all? The answers were no, and there's no such thing as approval — and both came out of the same regulatory clock, read correctly for once.
Spain's VeriFactu rules give taxpayers until January 2027 (companies) or July 2027 (autónomos) to adopt conforming invoicing software. That looks like a grace period you could build inside. It isn't one for us, because the moment Hub generates invoices on a customer's behalf, Dekimu Labs stops being a business using invoicing software and becomes the producer of it — a Sistema Informático de Facturación under RD 1007/2023. The producer's own adaptation deadline was 29 July 2025. It has already passed. A feature we shipped in 2026 would need to be fully conforming, declaración responsable included, from the day it went live. There is no lawful version of "ship it now, finish the compliance work before January."
The grace period taxpayers get and the deadline producers already missed are two different clocks, and reading the first one as if it covered us was the whole mistake worth catching before it became a feature.
The second question assumed a certificate exists somewhere — submit the software, pass a review, get a stamp. Spain didn't build that regime. It built a declaración responsable: the producer writes a formal statement asserting the software meets the spec, ships that statement inside the product, and carries the liability if the statement turns out to be false. Nobody at Hacienda checks it in advance. Enforcement is ex-post, by inspection, and the penalty for getting it wrong is fixed and specific — a producer fine of 150,000€ per fiscal year per system type, plus 1,000€ per system sold without the declaración attached. There's no approval to seek, only a claim to make and then have to defend.
There is no bridge between 'not compliant yet' and 'selling it,' for a producer — that gap is exactly what the declaración responsable exists to close, and self-certifying into it early is the whole risk.
We'd already ruled on adjacent versions of this question, twice. InvoiceUp was scoped out of EU invoice issuance entirely back in April — it tracks payments, it doesn't issue fiscal documents. And our own VeriFactu build, the one behind id.dekimu.com's billing, was explicitly scoped own-use-only: we invoice ourselves, never our customers' customers. Hub becoming an invoicing platform for other people's clients is the same issuance question wearing a different product's name. Saying yes here would have reversed both calls without ever writing down that it was doing that.
There's a second regime waiting behind this one, too. RD 238/2026 introduces mandatory structured B2B e-invoicing on its own separate clock, starting once its ministerial order takes effect. It isn't VeriFactu and complying with one doesn't satisfy the other. If Hub issued invoices, it would eventually need to answer to both regimes, not one — a second regulated surface stacked on a feature that was already the wrong trade.
The recommendation was no, and it holds: Hub and InvoiceUp stay above the issuance layer, pointing users at certified Spanish tools when they need to issue invoices themselves. But the door on eventually building this properly isn't shut — it's parked at a named date. Our own SIF groundwork, the hash-chain primitive that already exists for our internal billing, covers a meaningful share of the technical distance to a multi-tenant version. What it doesn't cover is the legal distance: an own-use declaración answers for one issuer we control end-to-end, a producer declaración answers for every customer's fiscal record. That's a different risk profile, not a bigger version of the same one, and it's a decision for the October review with counsel — not something to back into because a deadline looked further away than it was.
This post was drafted by an AI system from Dekimu's public engineering record and published with automated checks, without per-post human editing.
← Back to blog