From January 1, 2026, in Portugal, all electronic invoices will require a qualified electronic signature or a qualified electronic seal. This is a legal obligation that marks a before and after in the reliability, traceability, and validity ofinvoicesand tax documents. For a CFO operating in Portugal, this requirement impacts internal processes, integrations, document security, audits…. In other words: the entire business. Given its importance, at easyap, we explainwhat changes in 2026, what ATCUD is, how this qualified electronic signature is implemented, and the risks to avoid in this regulatory transition.
What Changes in 2026? Summary for CFOs
The first thing to know about the new regulation onelectronic invoicing in Portugaland digital signatures is its application and who it affects:
1. Legal Obligation
- FromJanuary 1, 2026, all invoices will have to include aqualified electronic signature or an qualified electronic seal.
- UntilDecember 31, 2025, PDF invoices without a signature remain valid.
- The measure guarantees the authenticity and integrity of tax documents.
2. Scope of Application
The obligation covers:
- B2B Invoicing.
- B2C Invoicing.
- Invoicing to Public Administration (B2G).
- Important tax documents circulated in PDF (credit and debit notes, receipts, etc.)
All this does not change anything regarding the two mandatory elements that had already appeared as a legal requirement on electronic invoices. These are:
- ATCUD Code, which is the Unique Document Identifier, as we will explain later.
- Verifiable QR Code.
Both will continue to be necessary and will now coexist with the qualified signature or seal.
Key Concepts for Understanding Digital Signatures in Portugal
To be more precise, let’s analyze the three most important aspects of this new regulation.
Qualified Electronic Signature
It is the most advanced form of digital signature, recognized by eIDAS, created using a digital certificate qualified issued by an accredited provider. Its legal value is equivalent to a handwritten signature.
Qualified electronic seal
Identifies the company (not the natural person). It is ideal for automated mass invoicing processes and guarantees the integrity and authorship of the document.
ATCUD
It is the Unique Document Identifier, which was already mandatory for all invoices and fiscally important documents. Now, it must be generated from certified software, and each document requires a unique one per series.
All this legal framework is set out in the Lei n.º 45-A/2024. Even so, the Tax Authority often publishes technical nuances, so it is advisable to follow official communications.
Real operational impact: what will change in your company
Due to all the above, the transition towards mandatory digital signatures in Portugal entails fundamental internal changes. For companies that have not started the process, adaptation will have to be immediate. Therefore, these four aspects must be considered:
1. Invoicing
Your system must:
- Generate invoices with ATCUD.
- Apply qualified electronic signature or qualified seal.
- Integrate with your ERP or POS.
- Integrate with the qualified certificate provider.
- Have strict SLAs for cloud signing, with:
- HSM (Hardware Security Module).
- Auditing of each operation.
- Revocation control.
- Reliable time stamping.
2. Certificates and custody
- The certificate must be issued by an accredited provider under eIDAS.
- It can be:
- For natural persons (qualified signature).
- For entities (qualified seal).
- Key custody must be in HSM or certified cloud providers.
- Do not store keys on local devices without control and encryption.
3. Internal control and auditing
- Complete record of all applied signatures.
- Exportable audit logs.
- Signature evidence (visible or hidden).
- Preservation system that guarantees immutability.
- Document retention compatible with Portuguese regulations.
4. Costs and governance
Compliance with all these aspects, simultaneously, involves the following costs and actions:
- Generate qualified certificates.
- Costs per seal or signature.
- Costs of integrating an ERP and an invoicing module.
- HSM custody costs.
- Process training and updates.
- Assign roles:
- Tax compliance manager.
- Technical manager (IT/Infrastructure).
Example of what mandatory digital signature entails
To better understand how to comply with mandatory digital signature in Portugal, let’s look at a use case:
Company: Lusitania S.L. (manufacturing)
- Headquarters: Spain.
- Subsidiary: Portugal.
- Volume: 45,000 invoices per year.
Solution adopted
- The corporate ERP incorporates a local Portuguese module.
- The system automatically requests a qualified seal via API from a certified cloud provider.
- The invoice is generated in XML-PT/CIUS-PT, the ATCUD is added, the QR is created, and only then is the seal applied on the server.
Result
- Invoices are issued with a qualified seal and are fully valid from 1/1/2026.
- Complete audits of all invoicing are facilitated.
- All operational risk is reduced.
Minimum technical requirements your invoicing software must meet
Therefore, and in a context where e-invoicing in Portugal is already highly regulated, your technological solution must support:
- Automatic generation of ATCUD.
- Qualified electronic signature or qualified seal.
- Custody and key rotation in HSM.
- APIs for integration with ERP and back-office systems.
- Signing capability in batch and in real-time.
- Export of logs and evidence for auditing.
- Compatibility with CIUS-PT, signed PDF and QR.
Risks for your business if you don’t adapt in time
The worrying and dangerous aspect of not complying with the regulations by January 2026 is that you expose yourself to certain risks:
- Penalties for issuing documents that do not comply with the new legal provision.
- Loss of probative value in disputes with suppliers or during audits.
- Operational errors by having to re-process entire batches of invoices.
- ERP system blockage if there isn’t good integration for automatic signing.
- Additional costs due to having to implement emergency solutions or work with unplanned suppliers.
Best practices for secure implementation
Similarly, we will reveal best practices for complying with mandatory digital signatures in Portugal:
- Use a qualified seal for bulk invoicing.
- Use the qualified signature on sensitive or high-value invoices.
- Always work with HSM or with certified cloud services.
- Periodically audit the traceability of signatures and ATCUD.
- Perform a pilot by series before going live.
- Establish a strict recovery and re-issuance policy for invoices.
To make everything clearer and in a unified visual format, here is a table with risks, best practices… and how easyap helps you comply with mandatory digital signatures if you operate in Portugal.
Why easyap is the best option for complying with digital invoicing
Adopting mandatory digital signatures in Portugal affects the technological architecture, tax compliance, and financial processes of the entire organization. In this scenario, easyap is the ideal partner for companies operating in Portugal.
Our e-invoicing platform is ready to manage ATCUD, QR, electronic signature and qualified seal, and legal retention from a centralized environment. This way, you maintain financial flows without interrupting your ERP.
Specifically, easyap automates signatures via a secure API, with HSM custody, timestamping, and comprehensive auditing. This guarantees Portuguese regulatory compliance and eliminates manual tasks, prevents errors, reduces costs, and offers traceability for audits.
Furthermore, we combine technical expertise and tax knowledge, making implementation guided, fast, and risk-free. For a CFO, this translates into lower complexity, reduced exposure to penalties, and a smooth transition towards the 2026 mandate.Contact us and we’ll show you.
