The Reliable Audit Trail in Electronic Invoicing: Complete Guide

The electronic invoicing reform 2026-2027 is fundamentally transforming accounting and tax practices for French businesses. Among the key concepts of this reform is the reliable audit trail (RAT), often overlooked but nonetheless compulsory since 2013. With the progressive rollout of the electronic invoicing mandate between 2026 and 2027, the RAT is once again taking centre stage in VAT compliance strategies across finance departments and accounting firms. This article explains in detail what a reliable audit trail is, why it is inseparable from electronic invoicing, what controls and documents it requires, and how to integrate it effectively into your organisation.

What is a Reliable Audit Trail (RAT)?

Definition and Regulatory Context

A reliable audit trail refers to the set of controls, procedures and internal documentation that makes it possible to establish a reliable link between an invoice and the underlying economic transaction (delivery of goods or supply of services). It constitutes one of three legally recognised ways to guarantee the authenticity of origin, the integrity of content and the readability of an invoice, in accordance with article 289 of the French Tax Code (CGI) and EU VAT Directive 2010/45/EU.

The three recognised methods are:

• Advanced or qualified electronic signature (eIDAS)

• Tax EDI (electronic data interchange compliant with tax standards)

• Reliable audit trail, applicable to all paper or electronic invoices not secured by the first two methods

Contrary to popular misconception, the RAT is not an option reserved for small businesses: it applies to every business subject to VAT that issues or receives invoices without using qualified signatures or tax EDI. In practice, it now affects the vast majority of small, medium and large French businesses.

Why is the RAT at the Heart of the 2026-2027 Reform?

With the French electronic invoicing reform, domestic B2B invoices will be required to pass through an electronic invoice service provider (ESP) or the Public Invoice Portal. This obligation does not eliminate the RAT: it sits alongside it. Whilst an electronic invoice transmitted via an ESP certainly guarantees the technical authenticity of the file, the business must still be able to reconstitute the complete documentary trail linking the purchase order, goods receipt note, invoice and payment.

The tax authorities can verify this documentary chain during an audit. The absence of documented RAT exposes the business to VAT adjustments that can result in the rejection of invoice deductibility.

The Three Pillars of the Reliable Audit Trail

Pillar 1: Authenticity of Origin

Authenticity of origin means that the identity of the invoice issuer must be certain and verifiable. Within the RAT framework, this translates into the implementation of internal validation processes: who is authorised to issue an invoice on behalf of the company? How can you ensure that the supplier from whom you receive an invoice is indeed the one you contracted with?

These controls include verification of the VAT identification number (via the VIES service of the European Commission), cross-checking against supplier database records, and matching against advance purchase orders.

Pillar 2: Content Integrity

Content integrity means that invoice data — amounts, VAT rates, description of services, party identifiers — have not been modified after issuance. In a RAT approach, integrity is not guaranteed by a cryptographic mechanism (as it is with electronic signatures), but by a system of documented manual or automated controls: three-way matching (purchase order / goods receipt / invoice), accounting reconciliation, hierarchical validation.

Structured formats such as Factur-X considerably facilitate this step: the XML file embedded in the PDF/A-3 contains machine-readable data, enabling automated control of amounts and references.

Pillar 3: Readability

The invoice must remain readable by humans for the entire legal retention period (10 years under French commercial law, 6 years under tax law). This requires specific technical choices: durable file format (PDF/A recommended), absence of DRM blocking access, archiving in a system guaranteeing access over time. This readability requirement is often overlooked in archiving policies, particularly when businesses switch accounting software without migrating their archives.

Controls and Documentation to Put in Place

Mapping Invoicing Processes

The first step in RAT compliance involves mapping the entire flow of invoicing: issuance, receipt, validation, posting to accounts, payment. This mapping must identify each control point, the persons or systems responsible, and the evidence generated at each stage.

The tax authorities expect formalised documentation, typically in the form of:

• Written procedures describing the steps in the process

• Control matrices listing controls performed and their frequency

• Audit logs (IT logs, validation workflows)

• Control evidence archived: validation emails, signed purchase orders, proof of receipt

For businesses that have already undertaken their electronic invoice assessment, this mapping naturally forms the first building block of the RAT approach.

Three-Way Matching: The Operational Heart of the RAT

Three-way matching is the most common technique for meeting the requirements of a reliable audit trail. It involves systematically cross-checking:

• The purchase order — what was ordered

• The goods receipt note — what was delivered or completed

• The invoice — what is being invoiced

Any discrepancy between these three documents triggers an enhanced validation process before payment. This mechanism, when properly documented, constitutes strong evidence of the integrity of the procurement process in the eyes of the tax authorities.

In modern ERP environments (SAP, Oracle, Sage, Cegid…), this control is often automated. For smaller structures, a structured spreadsheet with timestamped change history may suffice, provided it is retained along with the corresponding supporting documents.

Retention Period and Archival with Probative Value

The RAT implies a rigorous archiving policy. The documents that make up the audit trail — purchase orders, goods receipt notes, invoices, control evidence, validation logs — must be retained in such a way that they can be produced within a reasonable timeframe during a tax inspection.

Article L. 102 B of the Tax Procedure Code imposes a 6-year retention period for tax documents. The French Commercial Code (article L. 123-22) extends this to 10 years for accounting records. The RAT must therefore be designed as an archiving system with a dual time horizon.

Qualified electronic timestamp is a valuable tool here: by applying a certified timestamp to audit trail documents at the time of their creation, the business has proof of date that can be relied upon against the tax authorities.

Reliable Audit Trail and e-Reporting: Interface with New Obligations

e-Reporting Complements but Does Not Replace the RAT

The 2026-2027 reform also introduces the obligation of e-reporting for B2C and international B2B transactions not covered by mandatory electronic invoicing. e-Reporting involves transmitting transaction data (amounts, VAT, identifiers) to the tax authorities on a regular basis.

However, e-reporting contains only summary data. It does not reconstitute the complete documentary chain required by the RAT. In other words, even if your ESP correctly transmits your transaction data to the tax authorities, you must still maintain a documented reliable audit trail to justify the reality of the underlying transactions.

Interface with the Deployment Timeline

The reform timeline provides for a phased entry into force based on business size. Regardless of the deadline applicable to your organisation, RAT compliance must be anticipated and documented before the beginning of the electronic invoicing obligation. A tax audit relating to invoices issued before the reform can perfectly well rely on the absence of RAT as grounds for adjustment.

Businesses already using advanced or qualified electronic signatures to validate purchase orders and supplier contracts have a competitive advantage: their approval chain is already traceable and timestamped, which constitutes a natural component of the RAT. The legal validity of electronic signature thus directly strengthens the robustness of your audit trail.

Legal Framework Applicable to the Reliable Audit Trail

Key Texts in French and European Law

The reliable audit trail has its primary source in EU VAT Directive 2010/45/EC of 13 July 2010, transposed into French law by article 289 VII of the French Tax Code (CGI). This provision defines the three compliance methods (RAT, electronic signature, tax EDI) and establishes the principle of equivalence between paper and electronic invoices, provided that the conditions of authenticity, integrity and readability are met.

The BOI-TVA-DECLA-30-20-30-20 (French Tax Authority Bulletin) clarifies the practical arrangements expected by the French authorities for implementing the RAT: nature of controls, required documentation, retention periods. This administrative guidance constitutes the operational reference for businesses.

Article L. 102 B of the Tax Procedure Code sets a 6-year retention period for tax documents, whilst article L. 123-22 of the Commercial Code imposes 10 years for accounting records. These two provisions directly govern the RAT archiving policy.

Signature and Integrity Obligations: the eIDAS Regulation

When the business chooses to secure its RAT with electronic signatures (on purchase orders, goods receipt validations, payment instructions), eIDAS Regulation No. 910/2014 of the European Parliament and Council applies. It distinguishes three levels of signature (simple, advanced, qualified) and defines the legal value of each. An advanced or qualified signature affixed to a document forming part of the audit trail significantly strengthens the evidence of non-repudiation in case of dispute.

The French Civil Code, articles 1366 and 1367, recognise the probative value of the electronic record and electronic signature subject to reliable identification of the signatory and integrity of the document. These provisions can be directly relied upon in a tax dispute concerning the validity of an invoice.

Legal Risks from Insufficient RAT

The absence or inadequacy of a reliable audit trail exposes the business to several cumulative risks:

• Rejection of VAT deductibility: the authorities may refuse the deduction of VAT shown on invoices whose reality cannot be proven, resulting in a VAT adjustment plus interest on the adjustment (0.20% per month, art. 1727 CGI).

• Penalties for Non-Compliant Invoicing: article 1737 CGI provides for a penalty of 50% of the amount of the transaction for any invoice not complying with mandatory information or formal requirements, with a minimum of €75 per invoice.

• Criminal Liability: in cases of deliberate fraud, sanctions may include prosecution for tax evasion (art. 1741 CGI), with penalties of up to 5 years imprisonment and €500,000 fine.

• GDPR Liability: the personal data contained in invoices (customer name, contact details) are subject to GDPR Regulation No. 2016/679. The RAT archiving policy must be compatible with the principles of data minimisation and limitation of personal data retention.

Use Cases: The Reliable Audit Trail in Practice

Scenario 1 — A Mid-Sized Industrial Company with 3,000 Supplier Invoices per Year

A mid-sized industrial company with around 100 employees, managing approximately 3,000 supplier invoices annually for raw materials and subcontracting purchases, faces a tax inspection relating to financial years 2024 and 2025. The inspector requests the reconstitution of the documentary chain for 150 randomly selected invoices.

Before implementing a structured RAT, the company stored its purchase orders on a shared server without version control, its goods receipt notes as scanned paper without indexing, and its invoices in its accounting software with no explicit link to supporting documents. Reconstituting the documentary chain for the 150 invoices required 3 weeks of manual work, and 12 invoices could not be justified, resulting in a VAT adjustment of €28,000 plus interest on the adjustment.

Following deployment of a formalised RAT process — automated three-way matching in the ERP, indexed electronic archiving, written procedures validated by the finance director — a similar type of inspection two years later made it possible to produce all supporting documents within less than 48 hours, with zero tax adjustment. The cost of achieving compliance (approximately €15,000 in ERP configuration and training) was recovered from the first inspection avoided. Businesses that have formalised their RAT reduce their exposure to the risk of VAT adjustment by an average of 60 to 80% according to feedback published by professional accounting associations.

Scenario 2 — A Distribution Group with Mixed B2C and B2B Flows

A regional distribution group with fifty retail outlets must manage both e-invoicing obligations (for B2B purchases from national suppliers) and e-reporting obligations (for B2C sales). The complexity stems from the coexistence of heterogeneous flows: EDI invoices from major suppliers, unsecured PDF invoices from local suppliers, dematerialised receipts on the sales side.

The implementation of a unified RAT led the group to deploy a centralised document management platform, interfaced with its chosen ESP for e-invoicing. Each received invoice is automatically matched to its purchase order and goods receipt note via parameterised matching rules. Exceptions (discrepancies exceeding 2%) trigger an electronic validation workflow, the trace of which is retained with the invoice in the archiving system.

Results observed after 12 months: 45% reduction in supplier invoice processing time (from 11 days to 6 days on average), 70% reduction in supplier follow-ups linked to matching errors, and automatic constitution of a complete audit trail for 100% of invoices processed. These figures are consistent with the ranges published in sector studies by Eurogroup Consulting and the DFCG.

Scenario 3 — A Professional Services Firm Preparing for Electronic Invoicing Transition

A consulting engineering firm with around 40 staff, issuing approximately 800 B2B invoices per year, is anticipating the electronic invoicing mandate. The managing partner wishes to ensure that the transition to the chosen ESP will not weaken existing RAT compliance.

A pre-transition audit reveals that the audit trail currently relies on validation emails manually archived in client folders without certified timestamping or formalised procedure. Whilst this system works in practice, it is legally fragile: emails can be altered retrospectively, and their retention depends on individual management by each project manager.

The solution deployed combines: issuance of invoices in Factur-X format via the ESP, advanced electronic signature on project orders and client validation notices (which constitutes proof of the order in the RAT), and archiving with probative value with qualified timestamping for all supporting documents. The firm now has a fully dematerialised RAT, consistent with its new e-invoicing obligations, and with each component capable of being relied upon against the tax authorities.

Frequently Asked Questions

Is a reliable audit trail mandatory even if the company already uses a qualified electronic signature?

No. A reliable audit trail is one of three alternative methods recognised by Article 289 of the French General Tax Code (CGI) to guarantee the authenticity and integrity of invoices. If a company uses a qualified electronic signature compliant with eIDAS, it is not required to additionally implement a reliable audit trail (PAF). The two mechanisms are interchangeable, not cumulative.

What risks does a company face if it fails to maintain a documented reliable audit trail?

During a tax audit, the tax authority may challenge the VAT deductibility claimed on invoices for which no coherent documentary chain can be reconstructed. This can result in a VAT assessment together with penalties and late payment interest. The risk applies to all invoices concerned during the entire audit period, extending up to six years in the past.

How long must documents forming the reliable audit trail be retained?

Invoices themselves must be kept for six years for tax purposes and ten years under French commercial law. The supporting documents that constitute the reliable audit trail — purchase orders, delivery notes, validation records — must be accessible for the same period to enable complete reconstruction of the documentary chain in the event of an audit.

Does transmission of an invoice through a partner dematerialisation platform exempt a company from implementing a reliable audit trail?

No. A partner dematerialisation platform guarantees the technical authenticity of the transmitted file, but it does not cover the entire internal documentary cycle: ordering, receipt, validation, and accounting. The company remains responsible for consistency between these stages. The reliable audit trail and dematerialisation via a qualified third party platform meet complementary and non-redundant requirements.

Does the reliable audit trail apply to invoices received from foreign suppliers?

Yes. Any invoice received by a VAT-registered entity in France falls within the scope of the reliable audit trail, regardless of the supplier's location. The company must be able to verify the identity of the issuer, for example through the VIES service for suppliers in the European Union, and to establish the link between the invoice and the corresponding service or delivery.

Conclusion

The reliable audit trail is not a second-rank administrative formality: it is the documentary foundation that guarantees the fiscal validity of all your invoices, whether paper or electronic. With the growing importance of the 2026-2027 electronic invoicing reform, the RAT has become inseparable from a robust VAT compliance strategy. Three pillars structure it — authenticity of origin, integrity of content, readability over time — and three levers bring it to life: formalised controls, traceable documentation, and archival with probative value with a dual time horizon.

Neglecting the RAT exposes you to costly tax adjustments, risks of rejection of VAT deductibility and paralysing audit periods. Anticipating it transforms a regulatory constraint into an operational advantage.

Certyneo supports you in achieving compliance for your documentary flows with qualified electronic signature tools, certified timestamping and archival with probative value. Start your free trial on Certyneo and establish a reliable audit trail beyond reproach today.