Portugal SAF-T Requirements: The Complete Guide

Portugal became the first country in the world to mandate the Standard Audit File for Tax when it began requiring SAF-T submissions between 2008 and 2009. While the framework originates from the OECD's SAF-T standard, Portugal's implementation goes well beyond the base specification, introducing country-specific file types, mandatory monthly submissions, and a certified software ecosystem that no other early adopter attempted at that scale.

The scope of Portugal's SAF-T obligations catches many foreign operators off guard. The system defines four distinct file types — Integrated (I), Accounting/Contabilidade (C), Billing/Faturação (F), and Self-Invoicing (S) — each with its own data scope, submission schedule, and applicability rules.

The most immediate compliance burden is the monthly billing SAF-T, which must be submitted to the Autoridade Tributária e Aduaneira (AT) by the 5th of the following month. Miss that window, and penalties apply. The annual accounting SAF-T (Contabilidade) carries a longer timeline: originally slated for fiscal year 2025, the requirement has been postponed to fiscal year 2027, with the first submission now due in 2028.

This continuous submission model is what separates Portugal from countries like Norway, where SAF-T files are only generated on demand during a tax audit. In Norway, businesses maintain SAF-T-capable systems but never submit files unless the tax authority requests them. Portugal's approach is fundamentally different. Every taxable entity must produce and transmit structured data to the AT on a recurring schedule, regardless of whether an audit is underway.

Portugal was more than a decade ahead of the global curve. According to a Deloitte analysis of global digital tax reporting adoption, more than 60 countries worldwide have now implemented or are in the process of implementing digital reporting obligations such as e-invoicing and standard audit file requirements. For businesses already familiar with understanding e-invoicing fundamentals, Portugal's system represents one of the most mature and demanding implementations in practice today.

Beyond file submission itself, Portugal's compliance framework extends into the tools and documents businesses use daily. All invoicing software used in Portugal must be certified by the AT. Every invoice must carry a unique document code (ATCUD) and a QR code that the tax authority can scan and validate. These requirements form an interconnected system where the SAF-T files, the software that generates them, and the individual documents they describe are all subject to regulatory oversight.

The Four SAF-T File Types

Portugal's SAF-T implementation is structurally distinct from every other country that adopted the OECD standard. Where most jurisdictions use a single SAF-T file format, Portugal splits its requirements across four separate file types, each with its own data scope, submission schedule, and applicability rules. Understanding which types apply to your organization is the first step toward compliance.

The four types are designated by single-letter codes: I (Integrated), C (Contabilidade/Accounting), F (Faturação/Billing), and S (Self-Invoicing). The distinction between SAF-T Contabilidade and SAF-T Faturação is particularly critical — these two files serve entirely different purposes, contain different data sets, follow different submission calendars, and apply to different entities.

Type Code	File Name	Contents	Submission Frequency	Deadline	Who Must Submit
I	SAF-T Integrated	All accounting and billing data combined in a single file	On request by AT (tax authority)	As specified in the request	Any taxable entity when formally requested
C	SAF-T Contabilidade (Accounting)	Chart of accounts, general ledger entries, journal entries, customer and vendor master records	Annually (currently postponed)	TBD — obligation has been repeatedly deferred	Entities required to maintain organized accounting under SNC
F	SAF-T Faturação (Billing)	Invoices, credit notes, debit notes, movement of goods documents (guias de transporte), working documents, receipts	Monthly	By the 5th business day of the following month	All entities issuing invoices or equivalent commercial documents
S	SAF-T Self-Invoicing	Self-billing commercial documents only	Monthly (when applicable)	Same deadline as Type F	Buyers who issue invoices on behalf of their suppliers under a self-billing arrangement

SAF-T Integrated (Type I) combines the full scope of both accounting and billing data into one file. In practice, this type is not part of a regular submission schedule. The Portuguese tax authority (Autoridade Tributária e Aduaneira) requests it during audits or inspections, and entities must be capable of generating it from their certified software at any time.

SAF-T Contabilidade (Type C) covers the accounting side: your chart of accounts mapped to the SNC taxonomy codes (Sistema de Normalização Contabilística), all general ledger transactions, and complete journal entries alongside customer and supplier master data. Portugal designed this file to give the tax authority a standardized window into corporate bookkeeping. Although the annual submission obligation has been legislated, its enforcement date has been postponed multiple times.

SAF-T Faturação (Type F) is the file most organizations deal with on a recurring basis. It captures every commercial document your business issues: sales invoices, simplified invoices, credit notes, debit notes, transport documents, and payment receipts. This file must be submitted monthly through the e-Fatura system on the Portal das Finanças, Portugal's tax authority web platform. For most businesses, this is the SAF-T obligation that demands the most operational attention due to its monthly cadence and tight five-business-day deadline.

SAF-T Self-Invoicing (Type S) applies in a narrower scenario — when the buyer issues the invoice on behalf of the supplier under a formal self-billing agreement. The file contains only those self-issued commercial documents and follows the same monthly submission timeline as Type F. If your organization does not operate under any self-billing arrangements, Type S does not apply.

The practical takeaway: nearly every business operating in Portugal will interact with Type F monthly. Type C will become an annual obligation once its enforcement date is finalized. Type I requires readiness but not scheduled submission. And Type S applies only to entities engaged in self-billing.

Monthly Billing SAF-T Submission

Every VAT-registered business operating in Portugal must submit a SAF-T Billing file (Type F) to the Autoridade Tributária e Aduaneira (AT) by the 5th of the month following the reporting period. This is the most frequent SAF-T obligation Portuguese businesses face, and missing the deadline carries real consequences.

The submission is made through the e-Fatura system on the Portal das Finanças. Businesses export a SAF-T XML file from their certified billing software and upload it directly to the portal. The file must conform to the AT's current SAF-T schema and contain all invoices, credit notes, and debit notes issued during the reporting month.

Months with zero invoices are not exempt. If a business issues no billing documents during a given month, it must still submit a nil declaration through e-Fatura by the same 5th-day deadline. The AT treats a missing submission and a late submission identically, so the absence of commercial activity does not excuse the absence of a filing.

How the Deadline Tightened Over Time

The current 5th-day deadline is the result of a deliberate, progressive compression by the AT over more than a decade:

Original deadline: 25th of the following month
First reduction: Moved to the 20th
Second reduction: Moved to the 15th
Third reduction: Moved to the 12th
Since 2023: Moved to the 5th of the following month

Each reduction reflected the AT's strategic push toward near-real-time visibility into economic activity. By requiring billing data within five days of month-end, Portugal has built one of Europe's tightest continuous transaction reporting regimes. From 2024 onward, the AT fully enforces the 5th-day deadline with no informal grace period. Businesses that previously relied on a few extra days of administrative tolerance can no longer do so.

This continuous monthly model contrasts sharply with Norway's on-demand SAF-T compliance model, where businesses generate SAF-T files only when the tax authority requests them during an audit. Portugal's approach places a recurring compliance burden on every business, but it gives the AT uninterrupted visibility into the country's invoicing activity — allowing cross-referencing of buyer and seller declarations in near-real time and reducing the VAT gap without waiting for periodic audits. SAF-T billing compliance is not an occasional event triggered by an audit notice. It is a standing monthly obligation that requires reliable processes, tested exports, and calendar discipline around the 5th of every month.

Annual Accounting SAF-T (Contabilidade)

The annual accounting SAF-T — formally known as SAF-T Type C (Contabilidade) — has been the most discussed and most delayed element of Portugal's digital tax reporting framework. After years of postponement, the timeline is now set: the accounting SAF-T applies starting fiscal year 2027, with the first submission due in 2028. The Assembly of the Republic pushed back the original fiscal year 2025 start date, giving businesses and software providers additional time to prepare.

This file carries significantly more data than the monthly billing SAF-T. Where the billing file covers sales documents, the accounting SAF-T contains full general ledger data: the complete chart of accounts, journal entries, purchase invoices, and payment records. Every account must be mapped to taxonomy codes aligned with Portugal's SNC (Sistema de Normalização Contabilística), the national accounting standards framework. This mapping requirement is precisely what makes the accounting SAF-T more complex to implement than its billing counterpart.

The strategic purpose behind the accounting SAF-T is administrative efficiency on both sides. Once the Autoridade Tributária receives standardized general ledger data in XML format, it can pre-fill the annual IES (Informação Empresarial Simplificada) — the simplified business information filing that Portuguese companies submit each year. Rather than companies manually transcribing accounting data into the IES, the tax authority extracts what it needs directly from the SAF-T file. This reduces reporting burden for businesses while giving the AT higher data accuracy and stronger audit capabilities.

To generate a compliant accounting SAF-T, businesses must use SVAT-certified accounting software capable of exporting the file in the prescribed XML schema. SVAT (Sistema de Validação de Assinaturas e Taxonomias) certification confirms that the software correctly maps account structures to SNC taxonomy codes and produces valid output. The repeated postponements reflect, in part, the complexity of achieving this alignment across Portugal's diverse accounting software market — many vendors needed additional development cycles to reach full SVAT certification.

One important scope limitation applies: the annual accounting SAF-T is required only for companies established in Portugal. Non-resident companies that hold a Portuguese VAT registration number are exempt from this obligation. Those non-resident entities must still comply with the monthly billing SAF-T for their Portuguese sales transactions, but the full general ledger submission does not extend to them. The immediate priority is confirming that accounting software holds current SVAT certification and that the chart of accounts maps correctly to SNC taxonomy codes before the fiscal year 2027 deadline takes effect.

Certified Invoicing Software Requirements

All invoicing software used in Portugal must be pre-approved by the Autoridade Tributária e Aduaneira (AT) before it can legally issue invoices, credit notes, or debit notes. This requirement applies to every VAT-registered business operating in the country, including non-resident entities with a Portuguese tax registration — a scope that expanded significantly in 2021. The legal basis for this mandate is Administrative Decree no. 363/2010, which established the certification framework and the technical standards that all billing software must satisfy.

The AT maintains a public registry of certified software programs on the Portal das Finanças. Any business can verify whether a specific software product holds valid certification by searching this registry. Certification is not permanent — the AT can revoke approval if a software provider fails to maintain compliance with evolving technical requirements or if audits reveal that the software permits data manipulation. Businesses bear responsibility for confirming that the software they use holds active certification status.

Technical Anti-Tampering Controls

Certified invoicing software must implement a specific set of technical controls designed to prevent tax fraud and ensure data integrity:

Strict sequential invoice numbering. Each invoice series must follow an unbroken numerical sequence. Gaps in numbering are prohibited, and the software must not allow users to skip, reset, or manually assign invoice numbers.
No retroactive invoicing. The software must block the issuance of invoices with a date earlier than the most recent invoice in the same series. This prevents backdating.
No manual modification of issued invoices. Once an invoice is finalized, its data fields cannot be edited, overwritten, or deleted. Corrections require issuing a separate credit note or debit note referencing the original document.
SAF-T XML export capability. The software must generate data exports in the SAF-T (PT) XML schema, enabling the monthly billing and annual accounting file submissions required by Portuguese tax law.
AT web service API integration. The software must connect to the AT's web service to obtain ATCUD validation codes — unique document identifiers that must appear on every invoice before issuance.
QR code generation. Each invoice must include a compliant QR code with a minimum size of 30mm × 30mm, encoding structured tax data that the AT can scan and verify.

The Invoice Hash Chain Mechanism

Beyond these controls, certified software must implement a cryptographic hash chain across all issued invoices. This mechanism works as follows: each invoice receives a digital signature, and the computation of that signature incorporates the hash value of the previous invoice's signature. The result is a sequential chain where every invoice is cryptographically linked to the one before it.

This design means that any attempt to alter, delete, or insert an invoice retroactively would break the hash chain from that point forward. Every subsequent invoice's signature would become invalid, creating an immediately detectable inconsistency. The principle is analogous to a blockchain integrity model, but applied at the individual business level within the certified software. It makes post-facto manipulation of invoicing records technically infeasible without leaving a clear trail of broken signatures.

The AT can audit the hash chain at any time by requesting the SAF-T billing file and verifying the signature sequence. A broken chain constitutes strong evidence of data tampering.

Penalties for Using Non-Certified Software

Businesses that issue invoices through software lacking AT certification face fines ranging from EUR 3,000 to EUR 18,750. The financial penalty is not the only consequence — the Autoridade Tributária may disregard invoices issued from uncertified software entirely for tax purposes. This means the underlying transactions could be treated as undocumented for VAT deduction and corporate tax purposes, creating exposure that extends well beyond the fine itself.

ATCUD and QR Code Requirements

Two machine-readable identifiers appear on every Portuguese invoice: the ATCUD (Código Único do Documento) and a QR code. Phased in between 2022 and 2023, these identifiers give the Autoridade Tributária e Aduaneira (AT) the ability to validate any document instantly, whether during a routine audit or a consumer spot-check.

ATCUD: The Unique Document Code

The ATCUD became mandatory on all invoices from January 2023. It is a unique, non-repeatable identifier that ties every commercial document to a specific registered invoice series and sequential position within that series.

The format follows a fixed structure:

ATCUD:ValidationCode-SequentialNumber

The validation code is an alphanumeric string of eight or more characters, issued by the AT when a taxpayer registers an invoice series. The sequential number is the document's position within that series, starting from 1 and incrementing without gaps.

For example, ATCUD:A1B2C3D4-00047 identifies the 47th document issued under the series whose validation code is A1B2C3D4.

The ATCUD must appear on every page of every invoice, credit note, debit note, receipt, and transport document. It is not optional metadata buried in the file header. It must be visible to the reader on the printed or displayed document.

Invoice Series Registration

Before issuing any invoices under a new series, the taxpayer must pre-register that series with the AT. Registration is performed through the AT's online portal or via API integration from certified software.

Each document type requires its own series. A company that issues invoices, credit notes, and receipts needs at minimum three separate registered series, each with its own validation code. Businesses operating across multiple locations, branches, or point-of-sale terminals typically maintain additional series to segregate document flows.

The AT returns the validation code upon successful registration. No invoices can be legally issued under a series until this code is received and embedded in the certified invoicing software.

QR Code Specifications

The QR code requirement took effect in January 2022, one year before the ATCUD mandate. Every invoice and equivalent commercial document must include a QR code that encodes structured invoice data readable by the AT's verification tools.

Minimum physical size: 30mm x 30mm. This applies to both printed documents and PDF renderings.

The QR code encodes data across fields A through S, which include:

Field A: Issuer tax identification number (NIF)
Field B: Buyer tax identification number, if applicable
Field C: Buyer country code
Field D: Document type
Field E: Document status
Field F: Document date
Field G: Document unique identifier (including the ATCUD)
Fields H through M: Tax base amounts and VAT amounts, broken down by tax region
Field N: Withholding tax amount, if applicable
Field O through Q: Tax-exempt and stamp duty values
Field R: Hash characters (from the document's cryptographic hash)
Field S: Software certificate number

The regional identifiers encoded in the tax breakdown fields reflect the distinct VAT regimes across Portuguese territories: PT for mainland Portugal, PT-MA for Madeira, and PT-AC for the Azores. Because each region applies different VAT rates, the QR code must correctly attribute taxable amounts to the appropriate territory.

Generation and Integrity Rules

The QR code must be generated by the certified invoicing software that produces the document. It cannot be added after the fact by a separate tool, manually composed, or generated by third-party utilities. This requirement exists because the QR code content includes the software certificate number and hash characters that authenticate the document's origin and integrity within the certified system's hash chain.

Any attempt to generate or modify QR codes outside the certified software breaks the chain of trust the AT relies on for automated validation.

Penalties for Missing ATCUD or QR Code

Invoices that lack a valid ATCUD or QR code expose the issuer to fines of EUR 200 to EUR 1,000 per document. Because these penalties apply per invoice rather than per audit finding, a business issuing hundreds of non-compliant documents in a single month faces cumulative exposure that escalates rapidly.

Upcoming: Qualified Electronic Signatures (QES)

Starting January 2027, PDF invoices sent electronically must carry a Qualified Electronic Signature (QES) to be considered legally valid. PDFs without QES will no longer satisfy Portuguese invoicing requirements after the December 2026 transition date. Organizations still distributing invoices as unsigned PDFs should begin evaluating QES providers and updating their document workflows well ahead of this deadline.

Non-Resident Obligations

Since January 2021, non-resident companies holding a Portuguese VAT registration number (NIF) must comply with the billing SAF-T obligation and use AT-certified invoicing software for all Portuguese transactions. This expansion brought foreign entities under the same billing compliance framework that previously applied only to domestic companies, and it applies regardless of whether the non-resident has a physical establishment in Portugal. A VAT registration alone is sufficient to trigger the full set of billing obligations.

What non-residents must do:

Submit the monthly billing SAF-T (Type F) to the Portuguese Tax Authority by the 5th of each following month, covering all invoices and credit/debit notes issued for Portuguese transactions.
Use AT-certified invoicing software to generate those documents, with valid hash chain sequences maintained across all records.
Include the ATCUD code and QR code on every invoice issued for Portuguese transactions, following the same format and validation rules that apply to domestic issuers.

What non-residents are exempt from:

The annual accounting SAF-T (Type C) does not apply to non-resident entities. That obligation is reserved for companies with an established accounting presence in Portugal, typically those maintaining a full set of Portuguese statutory accounts. Non-residents file their accounting records in their country of establishment.

Fiscal Representative Requirements

The rules on fiscal representation differ depending on where the non-resident company is established:

EU/EEA companies are no longer required to appoint a fiscal representative in Portugal. This regulatory change removed a significant administrative burden, allowing EU-based businesses to manage their Portuguese VAT obligations directly.
Non-EU/EEA companies must appoint a fiscal representative based in Portugal. The representative assumes joint liability for VAT obligations and acts as the point of contact with the AT.

Portugal in the Broader EU Context

Portugal's decision to extend SAF-T billing obligations to non-residents reflects a wider trend across EU member states toward continuous transaction controls that apply equally to domestic and foreign operators. Greece's myDATA continuous reporting system, for example, similarly requires both domestic and non-resident businesses to report transactions in real time or near-real time. For multinational companies operating across southern Europe, the pattern is clear: VAT registration in a country increasingly means full digital compliance with that country's transaction reporting regime, not just periodic VAT return filing.

Penalties for SAF-T Non-Compliance

Portugal's tax authority, the Autoridade Tributária e Aduaneira (AT), enforces SAF-T and invoicing obligations through a tiered penalty framework defined in the Regime Geral das Infrações Tributárias (RGIT). Fines are not flat rates. They scale based on the nature of the violation, the offender's legal classification, business turnover, and whether the infraction is a first offense or repeated behavior.

The following schedule covers the primary violation categories and their associated EUR penalty ranges.

Penalty Schedule by Violation Type

Violation	Individuals	Legal Persons (Companies)
Non-issuance or late issuance of invoices	EUR 150 – EUR 3,750	EUR 300 – EUR 7,500
Use of non-certified invoicing software	EUR 3,000 – EUR 18,750	EUR 3,000 – EUR 18,750
Missing QR code or ATCUD on invoices	EUR 200 – EUR 1,000 per invoice	EUR 200 – EUR 1,000 per invoice

Several factors determine where a specific fine falls within these ranges:

Turnover of the business. Higher-revenue entities face penalties toward the upper end of each bracket.
Severity and scope. A single missing invoice triggers a different assessment than systematic non-issuance across hundreds of transactions.
Repeat offenses. First-time infractions may result in lower fines or warnings, while repeated non-compliance pushes penalties toward statutory maximums.

Consequences Beyond the Fine Amount

The financial penalties above represent only the direct cost. The practical downstream consequences are often more damaging.

Invoices issued from non-certified software may be disregarded entirely for tax purposes. This means the AT can treat those invoices as if they were never issued, exposing the business to additional assessments for unreported income. For the recipient of such an invoice, VAT deductibility can be denied outright, creating a compliance problem that cascades across the supply chain.

Invoices missing the QR code or ATCUD face similar rejection risk. When the AT flags these documents during an audit, the burden falls on both the issuer and the recipient to rectify the situation. Recipients who accepted non-compliant invoices may lose their right to deduct the corresponding VAT, which creates friction with suppliers and can strain commercial relationships.

Record Retention and Issuance Deadlines

Two additional obligations carry their own enforcement consequences:

10-year retention requirement. All accounting and invoicing records, including SAF-T files, must be retained for 10 years from the end of the fiscal year to which they relate. Failure to produce records during an AT audit can trigger separate penalties and adverse tax assessments.
5-working-day issuance deadline. Invoices must be issued within 5 working days of providing the goods or services. Invoices issued outside this window fall into the "late issuance" category and are subject to the penalties listed above.

Given the per-invoice penalty structure for QR code and ATCUD violations, cumulative exposure from even a single month of non-compliance can significantly exceed the cost of system upgrades and process changes.

Compliance Timeline: 2008 to 2028

Portugal's SAF-T obligations have expanded steadily over two decades. The following timeline captures every major milestone from initial adoption through upcoming requirements, serving as a quick reference for compliance planning and audit preparation.

Year / Date	Requirement
2008–2009	Portugal becomes the world's first country to mandate SAF-T, requiring standardized tax audit files from businesses
January 2020	Certified billing software becomes mandatory for an expanded scope of businesses, broadening the population of entities required to issue structured invoices
January 2021	Non-resident companies holding a Portuguese VAT registration number must use certified invoicing software
January 2022	QR codes mandatory on all invoices, credit notes, and other fiscally relevant documents
January 2023	ATCUD (Código Único de Documento) mandatory on all invoices, linking each document to its validation series registered with AT
January 2025	Monthly SAF-T billing file submission by the 5th business day of the following month strictly enforced
December 2026	PDF invoices remain legally valid without a Qualified Electronic Signature (QES) until this date
January 2027	QES mandatory on all PDF invoices sent electronically; PDFs without a Qualified Electronic Signature are no longer legally valid invoices
2028	First annual accounting SAF-T file (SAF-T Contabilidade) due, covering fiscal year 2027 transactions

Since its 2008 launch, Portugal's SAF-T system has progressively expanded along three axes: scope (covering more categories of businesses, including non-residents), frequency (tighter submission deadlines moving toward near-real-time reporting), and depth (more data elements, cryptographic controls, and document-level identifiers required per filing). The trajectory points toward increasingly automated, real-time tax reporting aligned with broader EU digital reporting trends.

The most immediate change businesses should prepare for is the QES requirement taking effect in January 2027. From that date, any PDF invoice sent electronically must carry a Qualified Electronic Signature to be considered legally valid. Organizations still distributing invoices as unsigned PDFs should begin evaluating QES providers and updating their document workflows well before the December 2026 deadline.