Fiscal compliance in Portugal: What is ATCUD, SAF-T, and QES?

Portugal’s fiscal system combines strict invoicing rules with modern digital standards. While the country does not operate a real-time invoice clearance system like Italy (SDI) or Spain’s digital submission of VAT-related transaction data (SII), its compliance framework is equally robust: Fiscalization in Portugal is built on certified software, standardized invoice formats, digital signatures, and structured reporting obligations.

You're a business or POS provider planning to expand to the Portugese market? Then it's time to get familiar with the terms of fiscalization in Portugal: legal foundations, mandatory formats, and upcoming requirements; including ATCUD, QR codes, digital signatures, and UBL 2.1/CIUS-PT.

The Portugese fiscalization model

Fiscalization in Portugal was introduced gradually, beginning with the adoption of the SAF-T (PT) digital audit file in 2008 and followed by the requirement for certified invoicing software from 2010 to 2011, which marks the true start of the modern fiscal system.

Over the next decade Portugal expanded its controls with monthly SAF-T reporting in 2013, a major regulatory update through Decreto-Lei 28/2019, and finally the rollout of QR-codes and ATCUD between 2021 and 2023, completing today’s fully digital and traceable invoicing framework.

In Portugal, VAT compliance is built on:

• Certified invoicing software approved by the Portuguese Tax Authority (the Autoridade Tributária e Aduaneira, or AT)
• SAF-T (PT) audit file submissions on a monthly basis
• QR code and ATCUD (Código Único do Documento) printed on all fiscally relevant documents
• Standardized e-invoicing (UBL 2.1 via CIUS-PT) for public procurement (B2G)
• Electronic signatures, moving toward mandatory Qualified Electronic Signatures (QES) for PDF invoices, for which the timeline was extended to 2027.

Let’s have a look at each of these requirements.

1. Certified invoicing software

To operate legally in Portugal, invoicing and POS systems must be certified by the tax authority (AT) and meet a defined set of technical and security standards. Certified software must guarantee data integrity, traceability and proper auditability of all tax-relevant documents.

The key requirements for certified invoicing software include:

• SAF-T (PT) compatibility so that fiscal audit data can be exported in the standard format
• Cryptographic signing of invoices using RSA keys, ensuring each document is uniquely identifiable and tamper-proof
• Secure user access control that prevents unauthorized changes and records any alterations.
• No hidden modification functions that allow altering fiscal data without leaving a trace.
• Full audit trail that includes timestamp, invoice number, amounts and link to previous transactions.
• Producer registration and certification with AT, including submission of the software’s public key and formal declaration.
• Listing on AT’s official registry of certified software, with certification subject to revocation if rules are not met.

These requirements have been in place since 2011 and define the foundation of Portugal’s fiscalization framework.

2. SAF-T (PT) for invoice reporting

SAF-T (PT) is the Standard Audit File for Tax, a structured XML file defined by the Portuguese tax authority that contains detailed accounting and invoicing data. Businesses must submit their invoice data to AT every month, which makes SAF-T a central part of fiscal compliance in Portugal.

3. ATCUD (Código Único do Documento): A unique sequential code for each invoice

One of the most significant elements of modern Portuguese fiscalization is a code that uniquely identifies every invoice and fiscally relevant document in Portugal: ATCUD (Código Único do Documento).

It links each document to an authorized invoice series and ensures full traceability for the tax authority. For POS providers, supporting ATCUD correctly is essential for legal compliance.

ATCUD Requirements that POS providers need to ensure:

• Request or validate the invoice series of the taxpayer, who must register each series with AT to obtain the validation code.
• Automatically generate ATCUD for every invoice and document in the series.
• Display ATCUD clearly on printed or digital invoices (header or designated area).
• Ensure strict sequential numbering without gaps or back-dating.
• Maintain an audit trail that stores the ATCUD and the corresponding invoice data.
• Handle multiple series if the client uses separate sequences (e.g., POS, web shop, backup system).

A fully compliant POS system must integrate ATCUD generation into every invoice workflow to meet Portugal’s fiscalization requirements.

4. QR Code on invoices

Portugal also requires a QR code to be printed or displayed on all fiscally relevant documents. This QR code encodes key tax information so the tax authority and consumers can easily verify the invoice and report it digitally. It is a core element of Portugal’s digital fiscalization model.

5. E-invoicing and Qualified electronic signature (QES): Postponed to January 2027

📢 Portugal has postponed full e-invoicing enforcement, including the obligation to use Qualified Electronic Signatures (QES), to January 2027.

Portugal currently requires structured XML e-invoices (CIUS-PT) aligned with the EN 16931 standard for all B2G transactions and encourages PEPPOL-based delivery for greater interoperability. So far, this standardized structure is not applicable to B2B transactions, as they are required to have a Qualified Signature.

QES stands for Qualified Electronic Signature. It is the highest level of electronic signature under the EU’s eIDAS Regulation and has the same legal value as a handwritten signature. A QES is created using a qualified signature creation device and a qualified digital certificate issued by an accredited trust service provider. It guarantees the authenticity of the issuer and the integrity of the document.