The Reliable Audit Trail in Electronic Invoicing: A Complete Guide

The electronic invoicing reform of 2026–2027 is fundamentally transforming accounting and tax practices for French businesses. Among the key concepts in this reform is the reliable audit trail (RAT), often overlooked yet mandatory since 2013. With the progressive rollout of the electronic invoicing obligation between 2026 and 2027, the RAT has reassumed a central place in VAT compliance strategies for finance departments and accounting firms. This article explains in detail what the reliable audit trail is, why it is inseparable from electronic invoicing, what controls and documents it requires, and how to integrate it effectively into your organisation.

What is the Reliable Audit Trail (RAT)?

Definition and Regulatory Context

The reliable audit trail refers to the set of controls, procedures and internal documentation that makes it possible to establish a reliable link between an invoice and the underlying economic transaction (delivery of goods or provision of services). It constitutes one of three legally recognised pathways to guarantee the authenticity of origin, integrity of content and readability of an invoice, in accordance with article 289 of the French General Tax Code (CGI) and EU VAT Directive 2010/45/EU.

The three recognised pathways are:

• Advanced or qualified electronic signature (eIDAS)

• Electronic Data Interchange (EDI) for tax purposes (meeting fiscal data standards)

• Reliable audit trail, applicable to all paper or non-secured electronic invoices not covered by the first two pathways

Contrary to popular belief, the RAT is not an option reserved for small businesses: it applies to every business subject to VAT that issues or receives invoices without using qualified signatures or fiscal EDI. In practice, it currently affects the vast majority of French micro-enterprises, SMEs and mid-sized companies.

Why is the RAT at the Heart of the 2026–2027 Reform?

With the French electronic invoicing reform, domestic B2B invoices must be transmitted obligatorily through either a certified digital service provider (CDSP) or the Public Invoicing Portal. This obligation does not eliminate the RAT: it comes to overlay it. Although an electronic invoice transmitted via a CDSP certainly guarantees the technical authenticity of the file, the business must still be able to reconstitute the complete documentary chain between the order, the delivery note, the invoice and payment.

The tax authority may audit this documentary chain during an inspection. The absence of a documented RAT exposes the business to VAT adjustments that may result in the disallowance of input VAT on the invoices in question.

The Three Pillars of the Reliable Audit Trail

Pillar 1: Authenticity of Origin

Authenticity of origin means that the identity of the invoice issuer must be certain and verifiable. Within the framework of the RAT, this translates into the implementation of internal validation processes: who is authorised to issue an invoice on behalf of the business? How is it ensured that the supplier from whom you receive an invoice is truly the one with whom you have contracted?

These controls include verification of the VAT identification number (via the VIES service of the European Commission), cross-reference with supplier master data, and reconciliation with advance purchase orders.

Pillar 2: Integrity of Content

Content integrity means that the invoice data — amounts, VAT rates, service description, party identifiers — have not been modified after issue. In a RAT approach, integrity is not guaranteed by a cryptographic mechanism (which is the essence of electronic signature) but by a system of documented manual or automated controls: three-way matching (purchase order / goods receipt / invoice), accounting reconciliation, hierarchical validation.

Structured formats such as Factur-X considerably facilitate this step: the XML file embedded in the PDF/A-3 contains machine-readable data, allowing automated control of amounts and references.

Pillar 3: Readability

The invoice must remain readable by humans throughout the entire legal retention period (10 years under French commercial law, 6 years under tax law). This requires specific technical choices: a durable file format (PDF/A is recommended), no DRM preventing reading, archiving in a system guaranteeing access over time. This readability requirement is often neglected in archiving policies, particularly when businesses change accounting software without migrating their archives.

Controls and Documentation to Implement

Mapping Invoicing Processes

The first step towards RAT compliance involves mapping the entire invoicing flow: issuance, receipt, validation, accounting entry, payment. This mapping must identify each control point, the persons or systems responsible, and the evidence generated at each stage.

The tax authority expects formalised documentation, typically in the form of:

• Written procedures describing the process steps

• Control matrices listing the controls performed and their frequency

• Audit logs (IT logs, validation workflows)

• Archived evidence of control: validation emails, signed purchase orders, delivery confirmations

For businesses that have already undertaken their electronic invoicing assessment, this mapping naturally forms the first component of the RAT approach.

Three-Way Matching: The Operational Core of the RAT

Three-way matching is the most widely used technique to meet the requirements of the reliable audit trail. It involves systematically reconciling:

• The purchase order — what was ordered

• The goods receipt note — what was delivered or performed

• The invoice — what is being billed

Any discrepancy between these three documents triggers a strengthened validation process before payment. This mechanism, properly documented, constitutes solid evidence of the integrity of the procurement process in the eyes of the tax authority.

In modern ERP environments (SAP, Oracle, Sage, Cegid, etc.), this control is often automated. For smaller structures, a structured spreadsheet with time-stamped modification tracking can suffice, provided it is retained alongside the corresponding supporting documents.

Retention Period and Probative Archiving

The RAT requires a rigorous archiving policy. The documents making up the audit trail — purchase orders, delivery notes, invoices, evidence of control, validation logs — must be preserved in such a way that they can be produced within a reasonable timeframe during a tax audit.

Article L. 102 B of the French Tax Procedures Code requires a retention period of 6 years for tax documents. The French Commercial Code (article L. 123-22) extends this to 10 years for accounting documents. The RAT must therefore be designed as an archiving system with a dual time horizon.

Qualified electronic time-stamping is a valuable tool here: by applying a certified time-stamp to the RAT documents at the time of their creation, the business has evidence of prior existence that can be relied upon against the tax authority.

Reliable Audit Trail and E-Reporting: Interaction with New Obligations

E-Reporting Complements but Does Not Replace the RAT

The 2026–2027 reform also introduces the obligation for e-reporting for B2C and international B2B transactions not covered by the mandatory electronic invoicing requirement. E-reporting consists of transmitting transaction data (amounts, VAT, identifiers) to the tax authority on a periodic basis.

However, e-reporting provides only summary data. It does not reconstitute the complete documentary chain required by the RAT. In other words, even if your CDSP correctly transmits your transaction data to the French tax authority, you must still maintain a documented reliable audit trail to justify the reality of the underlying transactions.

Interaction with the Reform Timetable

The reform timetable provides for a phased implementation according to business size. Regardless of the deadline applicable to your organisation, RAT compliance must be anticipated and documented before the start of your electronic invoicing obligation. A tax audit relating to invoices issued before the reform may quite properly use the absence of a RAT as a basis for adjustment.

Businesses already using advanced or qualified electronic signatures to validate their purchase orders and supplier contracts have a competitive advantage: their approval chain is already traceable and time-stamped, which constitutes a natural component of the RAT. The legal value of electronic signature thus directly strengthens the robustness of your audit trail.

Legal Framework Applicable to the Reliable Audit Trail

Foundational Texts in French and EU Law

The reliable audit trail derives its primary source from EU VAT Directive 2010/45/EU of the Council of 13 July 2010, transposed into French law by article 289 VII of the French General Tax Code (CGI). This text defines the three compliance pathways (RAT, electronic signature, fiscal EDI) and establishes the principle of equivalence between paper and electronic invoicing, provided that conditions of authenticity, integrity and readability are met.

The BOI-TVA-DECLA-30-20-30-20 (French Tax Authority Official Bulletin) clarifies the practical arrangements expected by the French tax authority for RAT implementation: nature of controls, required documentation, retention periods. This administrative guidance constitutes the operational reference for businesses.

Article L. 102 B of the French Tax Procedures Code sets a retention period of 6 years for tax documents, whilst article L. 123-22 of the French Commercial Code requires 10 years for accounting documents. These two texts directly govern the RAT archiving policy.

Signature and Integrity Obligations: The eIDAS Regulation

When the business chooses to secure its RAT through electronic signatures (on purchase orders, receipt validations, payment orders), eIDAS Regulation no. 910/2014 of the European Parliament and Council applies. It distinguishes three signature levels (simple, advanced, qualified) and defines the legal value of each. An advanced or qualified signature applied to a document forming part of the audit trail significantly strengthens the evidence of non-repudiation in case of dispute.

The French Civil Code, articles 1366 and 1367, recognises the probative value of electronic writing and electronic signature subject to reliable identification of the signatory and document integrity. These provisions are directly applicable in a tax dispute concerning invoice validity.

Legal Risks from Inadequate RAT

The absence or inadequacy of a reliable audit trail exposes the business to several cumulative risks:

• Denial of VAT input credit: the tax authority may refuse to allow input VAT on invoices whose transaction reality cannot be proven, resulting in a VAT claim plus default interest (0.20% per month, art. 1727 CGI).

• Penalties for non-compliant invoicing: article 1737 CGI provides for a 50% penalty on the transaction amount for any invoice failing to meet mandatory requirements or formal conditions, with a minimum of €75 per invoice.

• Criminal risk: in case of deliberate fraud, sanctions may include prosecution for tax fraud (art. 1741 CGI), with penalties reaching up to 5 years' imprisonment and €500,000 fine.

• GDPR liability: personal data contained in invoices (customer name, contact details) are subject to GDPR Regulation no. 2016/679. The RAT archiving policy must be compatible with the principles of data minimisation and retention limitation.

Use Cases: The Reliable Audit Trail in Practice

Scenario 1 — An Industrial SME with 3,000 Supplier Invoices Per Year

An industrial SME with around 100 employees, managing approximately 3,000 supplier invoices annually for raw materials and subcontracting purchases, faces a tax audit covering 2024 and 2025. The inspector requests reconstitution of the documentary chain for 150 randomly selected invoices.

Before implementing a structured RAT, the business stored purchase orders on a shared server without version control, delivery notes as scanned paper without indexing, and invoices in its accounting software without explicit links to supporting documents. Reconstituting the documentary chain for 150 invoices required 3 weeks of manual work, and 12 invoices could not be justified, resulting in a VAT claim of €28,000 plus default interest.

Following deployment of a formalised RAT process — automated three-way matching in the ERP, indexed electronic archiving, written procedures validated by the finance director — a similar audit two years later allowed the business to produce all supporting documents within 48 hours with zero tax adjustment. The implementation cost (approximately €15,000 for ERP configuration and training) was recovered with the first avoided audit. Businesses having formalised their RAT reduce their VAT adjustment risk by an average of 60–80% according to feedback published by professional accounting associations.

Scenario 2 — A Distribution Group with Mixed B2C and B2B Flows

A regional distribution group with around fifty retail outlets must simultaneously manage e-invoicing obligations (for its B2B purchases from national suppliers) and e-reporting obligations (for its B2C sales). The complexity arises from the coexistence of heterogeneous flows: EDI invoices with major suppliers, unsecured PDF invoices with local suppliers, dematerialised receipts on the sales side.

Implementing a unified RAT led the group to deploy a centralised document management platform, interfaced with the CDSP chosen for e-invoicing. Each received invoice is automatically matched with its purchase order and receipt through parameterised matching rules. Exceptions (variances exceeding 2%) trigger an electronic validation workflow, whose trace is retained with the invoice in the archiving system.

Results observed after 12 months: 45% reduction in supplier invoice processing time (from 11 days to 6 days on average), 70% reduction in supplier follow-ups due to reconciliation errors, and automatic creation of a complete audit trail for 100% of invoices processed. These figures are consistent with the ranges published in sector studies by Eurogroup Consulting and the DFCG.

Scenario 3 — A Professional Services Firm Preparing for Electronic Invoicing

An engineering consulting firm with around 40 staff, issuing approximately 800 B2B invoices per year, anticipates the electronic invoicing obligation. The managing partner wishes to ensure that the transition to the chosen CDSP will not weaken its existing RAT compliance.

A preliminary audit reveals that the audit trail currently relies on validation emails archived manually in client folders, without certified time-stamping or formalised procedure. This system, whilst functional in practice, is legally fragile: emails can be retroactively modified, and their retention depends on individual management by each engagement manager.

The implemented solution combines: issuing invoices in Factur-X format via the CDSP, advanced electronic signature on engagement letters and client validation orders (constituting proof of order in the RAT), and probative archiving with qualified time-stamping for all supporting documents. The firm now has a fully dematerialised RAT, consistent with its new e-invoicing obligations, and each component is enforceable against the tax authority.

Frequently Asked Questions

Is a reliable audit trail mandatory even if the company already uses a qualified electronic signature?

No. A reliable audit trail is one of three alternative routes recognised by Article 289 of the French General Tax Code (CGI) to guarantee the authenticity and integrity of invoices. If a company uses a qualified electronic signature compliant with eIDAS, it is not required to additionally implement a reliable audit trail (PAF) process. The two mechanisms are interchangeable, not cumulative.

What risks does a company face if it fails to maintain a documented reliable audit trail?

During a tax audit, the tax authority may challenge the VAT deductibility shown on invoices for which no coherent documentary chain can be reconstructed. This may result in a VAT adjustment accompanied by penalties and late payment interest. The risk applies to all invoices concerned throughout the entire period under review, which can extend back up to six years.

How long must documents constituting the reliable audit trail be retained?

The invoices themselves must be retained for six years for tax purposes and ten years under French commercial law. The supporting documents that form the audit trail — purchase orders, delivery notes, proof of validation — must be accessible for the same period to allow full reconstruction of the documentary chain in the event of an audit.

Does transmission of an invoice via a partner dematerialisation platform exempt a company from implementing a reliable audit trail?

No. A partner dematerialisation platform guarantees the technical authenticity of the file transmitted, but it does not cover the entire internal documentary cycle: order, receipt, validation, accounting entry. The company remains responsible for ensuring consistency between these stages. The reliable audit trail and dematerialisation via an approved platform address complementary and non-redundant requirements.

Does the reliable audit trail apply to invoices received from foreign suppliers?

Yes. Any invoice received by a VAT-registered company in France falls within the scope of the reliable audit trail, regardless of the supplier's location. The company must be able to verify the identity of the issuer, for example via the VIES service for suppliers in the European Union, and to establish the link between the invoice and the corresponding service or delivery.

Conclusion

The reliable audit trail is not a second-tier administrative formality: it is the documentary foundation that guarantees the tax validity of all your invoices, whether paper or electronic. With the intensification of the 2026–2027 electronic invoicing reform, the RAT becomes inseparable from a robust VAT compliance strategy. Three pillars structure it — authenticity of origin, content integrity, readability over time — and three levers operationalise it: formalised controls, traceable documentation, and probative archiving with dual time horizons.

Neglecting the RAT exposes you to costly tax adjustments, risks of VAT input credit denial and paralysing audit periods. Anticipating it transforms a regulatory constraint into an operational advantage.

Certyneo assists you in bringing your documentary flows into compliance with qualified electronic signature, certified time-stamping and probative archiving tools. Start your free trial on Certyneo and build an unassailable reliable audit trail today.