Hardware, software, or hybrid fiscalization: know your regime.

A POS vendor that's live in Madrid signs a restaurant group with sites in Brussels, Budapest, and Berlin. Each city's law asks how a sale is protected against later changes, and the four answers differ.

In Madrid, the protection lives in the invoicing software. In Brussels, the till system and a black box at the counter each need a government certificate. In Budapest, the receipt has to come from a register the tax authority has licensed. In Berlin, the restaurant group can choose between a certified device and a certified cloud service.

That split derives from the law that differs by country. Each regime decides where the protection has to sit, and knowing which kind a market runs settles most of the technical conversation before the first scoping call.

TL;DR

European fiscalization regimes come in three types. Software regimes, such as Spain's Verifactu, set rules for the invoicing system and involve no device. Hardware regimes, such as Belgium's certified cash register system for horeca (now moving to the connected SCE/GKS 2.0) and Hungary's cash register rules, require certified or licensed equipment at the point of sale. Hybrid regimes, such as those in Germany, Austria, and Sweden, define a security function and accept either a local device or a cloud service.

The one question that sorts every market

A fiscalization rule exists to stop a recorded sale from being quietly changed or deleted. What differs is who the legislator makes answer for that. It can hold the software producer responsible, require equipment the authority has approved, or set a technical standard and accept any form that meets it.

Software regimes: the rules live in the invoicing system

Spain is the clearest case. Royal Decree 1007/2023 sets the requirements for invoicing software (sistemas informáticos de facturación): what each billing record has to contain, and how records are chained and protected so they can't be altered. There's no fiscal device anywhere in it. The Basque provinces run their own regime, TicketBAI, and it also regulates software rather than hardware.

The proof sits with whoever ships the software. Under Article 13 of the regulation, the producer issues a declaración responsable, a statement built into the product that it meets the rules, and keeps it available to the customer and the Agencia Tributaria (AEAT). In effect it's self-certification: no government lab tests the product and no registry takes it in.

Spain isn't the only software regime, and the others prove compliance differently. In France, cash register software has to meet four conditions (inalterability, security, conservation, and archiving), shown either by certification from an accredited body or, since February 21, 2026, by the publisher's own attestation. In Portugal, invoicing software has to be certified by the tax authority, the Autoridade Tributária e Aduaneira (AT). Neither market requires a fiscal device, and fiskaly's piece on third-party versus self-certification compares the proof models.

Hardware regimes: the law names the equipment

In a hardware regime, the authority examines and approves the equipment that records the sale. Compliant software on its own doesn't meet the rule, because the protection has to sit in a component the authority has certified or licensed.

Belgium applies this to horeca, its term for hotels, restaurants, and cafés. A restaurant or caterer whose meal-service turnover exceeds €25,000 a year excluding VAT has to issue receipts from a registered cash register system (Royal Decree no. 1, Article 21bis); drinks don't count toward the threshold. That system has two certified parts, the till system itself and a fiscal data module (FDM), known as the "black box".

FPS Finance, Belgium's federal tax administration, certifies both under the Law of July 30, 2013, and its implementing decrees, most recently the Ministerial Decree of April 29, 2024. The producer applies, has a prototype certified, and then registers every unit it sells.

The second generation of the system, SCE 2.0 (SCE stands for système de caisse enregistreuse), became mandatory for new horeca businesses on July 1, 2026, under a royal decree published on June 3, 2026. Businesses on the first generation migrate by July 1, 2027, July 1, 2028, or January 1, 2029, depending on when they bought their newest till. Both the till and the FDM need SCE 2.0 certification.

SCE 2.0 connects the box to the internet, but it's still a box. Under FPS Finance's technical description, the new FDM has its own status display or LEDs and at least 2 GB of buffer storage, and it links to the till by cable or Wi-Fi. What's new is that it forwards transaction data to the FPS Finance cloud.

Hybrid regimes: the law names a function, not a form

Germany, Austria, and Sweden each define what the security component has to do, then accept both a device at the till and a service in the cloud. The legal obligation sits with the business, which in practice makes the choice together with its POS vendor.

Each of the three puts its trust in a certification or a certificate rather than in where the component sits:

• Germany: § 146a AO and the KassenSichV require a technical security system (TSS) that secures every transaction. It can be a USB stick, SD card, or embedded module, or a cloud TSS. Either way, the Federal Office for Information Security (BSI) has to certify it.
• Austria: the RKSV requires a signature creation unit. § 12 RKSV allows two forms, a smartcard or a hardware security module (HSM), and the HSM can sit with a trust service provider and be reached over the internet. Austria has no fiscalization-specific product certification like Germany's; instead, the hardware has to be certified under eIDAS as a qualified signature or seal creation device, and the signing certificate also comes from a trust service provider.
• Sweden: chapter 39 of the Tax Procedure Act (SFS 2011:1244) requires cash registers to work with a control system. The original form is a physical kontrollenhet; a cloud-based kontrollsystem has been permitted since January 1, 2021 (SKVFS 2020:9). The Swedish Tax Agency (Skatteverket) requires both to be certified by an accredited body.

For a closer look, see fiskaly's comparison of hardware and cloud fiscalization.

Italy: hybrid in law, with the move to software already underway

Italy sits between the categories, but it is closer to the cloud than it looks. Today a business can send its daily sales data (corrispettivi telematici) through a registratore telematico (RT), a fiscal device at the till that needs a verificazione periodica at activation and then every two years (AdE Provvedimento of October 28, 2016, § 1.7), or through the AdE's free "Documento Commerciale Online" web procedure, which rests on § 1.11 of the same provvedimento and requires no hardware at all.

That web procedure is where the transition has already begun. fiskaly SIGN IT lite is a simple, fast API that connects the POS to the AdE, sends corrispettivi telematici and generates commercial documents in line with the latest tax rules, all without an RT device.

The next step is the certified software route, set out in Legislative Decree 1/2024, Article 24, and AdE Provvedimento no. 111204 of March 7, 2025. It takes two steps: an authorized body certifies the solution, then the Commissione Misuratori Fiscali decides on homologation. Some providers, fiskaly among them, are already in the pilot phase. No solution has been homologated yet, but the first certifications and homologations are expected in the coming months, as fiskaly's guide to Italy's certification requirements explains.

Where the law lets you choose, cost and scale decide

Once a market lets you choose, the question becomes operational, and that's where the cloud route pulls ahead. A cloud signing service is renewed, patched, and scaled centrally. When a certification runs out or a vulnerability turns up, the provider handles it once, for every till at the same time. Adding new locations takes minutes.

Hardware puts that work at the counter. Every till needs its own unit, every unit has an expiry date, and every swap or firmware update has to reach each site individually.

The usual objection is that a cloud service fails when the connection drops. It can, but hardware fails too, and the hybrid regimes set out what a business has to do when its security component is unavailable, whichever form it takes.

The real difference, then, is who maintains the hardware and how many sites a fix has to reach. With a cloud service, that's one provider and zero sites.

What this means for your POS roadmap

For a POS vendor planning its next market, the regime sets the shape of the work before anyone writes code.

Software markets make compliance a feature of your product, whether you build the recording and chaining logic yourself or take it from an API. Under Spain's self-certification model, the producer of the invoicing system signs the declaration.

Hardware markets make the authority's approval of your equipment the gate. In Belgium, your till system needs its own FPS Finance certificate and has to work with a certified FDM.

A hybrid market leaves you with an architecture decision, and its cost grows with every new site. A hardware route adds a unit, an installation, and an expiry date to each till. A cloud route adds one API integration and a dependency on the provider behind it.

Regimes also move, so check where a market stands before you plan.

For the restaurant group from the opening, that adds up to four projects: a software integration in Madrid, a certified till and black box in Brussels, a NAV-licensed register in Budapest, and a choice between device and cloud in Berlin.

Key takeaways

• Classify before you scope: whether a market regulates the software, approves the equipment, or offers a choice decides whether you're building a feature, getting hardware certified, or choosing an architecture.
• Software markets tie compliance to your product: Spain accepts the producer's own declaration, France accepts certification or a publisher attestation, and Portugal requires AT certification.
• Hardware markets keep the approval on the equipment: Belgium's connected black box hasn't changed that for the businesses in scope.
• Hybrid markets put the cost in the fleet: each hardware unit has to be installed and replaced on its own, so the gap between the two routes widens with each site.
• Italy is already moving to software: the AdE's web procedure needs no device today, and the first certified software solutions are expected in the coming months.

How fiskaly fits

fiskaly is a cloud-native fiscalization API provider trusted by 1,900+ B2B customers. It works in software and hybrid regimes, where compliance can live in the cloud.

In the hybrid markets, SIGN DE is the market-leading BSI-certified cloud TSS, SIGN AT covers the Austrian RKSV, and SIGN SE provides a cloud kontrollsystem certified against Skatteverket's SKVFS 2020:9 standard. In Spain, SIGN ES covers Verifactu, SII, TicketBAI, and NaTicket through one API. SIGN FR and SIGN PT cover the software regimes in France and Portugal.