The Reliable Audit Trail in Electronic Invoicing: A Complete Guide

The electronic invoicing reform of 2026-2027 is fundamentally transforming the accounting and tax practices of French businesses. Among the key concepts in this reform is the reliable audit trail (RAT), often overlooked yet mandatory since 2013. With the progressive rollout of the electronic invoicing obligation between 2026 and 2027, the RAT has regained a central place in VAT compliance strategies for finance departments and accounting firms. This article explains in detail what a reliable audit trail is, why it is inseparable from electronic invoicing, what controls and documents it requires, and how to integrate it effectively into your organization.

What Is a Reliable Audit Trail (RAT)?

Definition and Regulatory Context

A reliable audit trail refers to the set of controls, procedures, and internal documentation that makes it possible to establish a reliable link between an invoice and the underlying economic transaction (delivery of goods or provision of services). It constitutes one of three legally recognized pathways to guarantee the authenticity of origin, integrity of content, and readability of an invoice, in accordance with Article 289 of the French General Tax Code (CGI) and EU VAT Directive 2010/45/UE.

The three admitted pathways are:

• Advanced or qualified electronic signature (eIDAS)

• Tax EDI (electronic data interchange compliant with tax standards)

• Reliable audit trail, applicable to all paper or electronic invoices not secured by the first two pathways

Contrary to popular belief, the RAT is not an option reserved for small structures: it applies to any business subject to VAT that issues or receives invoices without using qualified signature or tax EDI. In practice, it now affects the vast majority of French micro-enterprises, SMEs, and mid-market companies.

Why Is the RAT at the Heart of the 2026-2027 Reform?

With the French electronic invoicing reform, domestic B2B invoices must obligatorily transit through a certified service provider platform (CSP) or the Public Invoicing Portal. This obligation does not eliminate the RAT: it complements it. While an electronic invoice transmitted via a CSP does guarantee technical authenticity of the file, the business must still be able to reconstruct the complete documentary trail from purchase order, goods receipt note, invoice, through to payment.

The tax authority may audit this documentary chain during a tax examination. The absence of a documented RAT exposes the business to VAT adjustments that can go as far as denying the deductibility of the invoices in question.

The Three Pillars of the Reliable Audit Trail

Pillar 1: Authenticity of Origin

Authenticity of origin means that the identity of the invoice issuer must be certain and verifiable. Within the RAT framework, this translates into establishing internal validation processes: who is authorized to issue an invoice on behalf of the business? How do you ensure that the supplier from whom you receive an invoice is the one you actually contracted with?

These controls involve verifying the VAT identification number (via the VIES service of the European Commission), cross-referencing with supplier master data, and matching against prior purchase orders.

Pillar 2: Content Integrity

Content integrity means that the invoice data—amounts, VAT rates, description of services, party identifiers—have not been modified after issuance. In a RAT approach, integrity is not guaranteed by a cryptographic mechanism (which is the preserve of electronic signature), but by a documented system of manual or automated controls: three-way matching (purchase order / goods receipt / invoice), accounting reconciliation, and hierarchical validation.

Structured formats such as Factur-X significantly facilitate this step: the XML file embedded in the PDF/A-3 contains machine-readable data, enabling automated validation of amounts and references.

Pillar 3: Readability

The invoice must remain human-readable throughout the entire legal retention period (10 years under French commercial law, 6 years under tax law). This imposes precise technical choices: durable file format (PDF/A recommended), absence of DRM blocking readability, archiving in a system guaranteeing access over time. This readability requirement is often overlooked in archival policies, particularly when companies switch accounting software without migrating their archives.

Controls and Documentation to Put in Place

Mapping Invoicing Processes

The first step in RAT compliance is to map the entire invoicing workflow: issuance, receipt, validation, accounting entry, payment. This mapping must identify each control point, the persons or systems responsible, and the evidence generated at each stage.

The tax authority expects formalized documentation, typically in the form of:

• Written procedures describing the process steps

• Control matrices listing controls performed and their frequency

• Audit logs (IT logs, validation workflows)

• Control evidence archived: validation emails, signed purchase orders, delivery acknowledgments

For businesses that have already conducted their electronic invoice diagnostic, this mapping naturally forms the first building block of the RAT approach.

Three-Way Matching: The Operational Heart of the RAT

Three-way matching is the most common technique for meeting reliable audit trail requirements. It consists of systematically reconciling:

• The purchase order — what was ordered

• The goods receipt note — what was delivered or provided

• The invoice — what is being billed

Any discrepancy between these three documents triggers an enhanced validation process before payment. This mechanism, when properly documented, constitutes solid evidence of the integrity of the procurement process in the eyes of the tax authority.

In modern ERP environments (SAP, Oracle, Sage, Cegid, etc.), this control is often automated. For smaller structures, a structured spreadsheet with timestamped modification tracking may suffice, provided it is preserved with the corresponding supporting documents.

Retention Period and Probative Archiving

The RAT requires a rigorous archival policy. Documents constituting the audit trail—purchase orders, goods receipts, invoices, control evidence, validation logs—must be retained in such a way that they can be produced within a reasonable timeframe during a tax examination.

Article L. 102 B of the French Tax Procedure Code imposes a 6-year retention period for tax documents. The Commercial Code (Article L. 123-22) extends this to 10 years for accounting records. The RAT must therefore be designed as an archiving system with a dual time horizon.

Qualified electronic timestamping is a valuable tool here: by affixing certified timestamping to RAT documents at the moment of creation, the business has evidence of prior date that is enforceable against the tax authority.

Reliable Audit Trail and E-Reporting: Coordination with New Obligations

E-Reporting Complements but Does Not Replace the RAT

The 2026-2027 reform also introduces the e-reporting obligation for B2C and international B2B transactions not covered by mandatory electronic invoicing. E-reporting involves transmitting transaction data (amounts, VAT, identifiers) to the tax authority periodically.

However, e-reporting covers only summary data. It does not reconstruct the complete documentary chain required by the RAT. In other words, even if your CSP correctly transmits your transaction data to the French tax authority (DGFiP), you must still maintain a documented reliable audit trail to justify the underlying transactions.

Alignment with the Reform Timeline

The reform timeline provides for a phased implementation based on business size. Regardless of the deadline applicable to your organization, RAT compliance must be anticipated and documented before the start of the electronic invoicing obligation. A tax examination of invoices issued before the reform can certainly rely on the absence of a RAT as grounds for adjustment.

Companies already using advanced or qualified electronic signatures to validate purchase orders and supplier contracts have a competitive advantage: their approval chain is already traceable and timestamped, which is a natural component of the RAT. The legal value of electronic signature thus directly strengthens the robustness of your audit trail.

Legal Framework Applicable to the Reliable Audit Trail

Foundational Texts in French and EU Law

The reliable audit trail has its first source in EU VAT Directive 2010/45/UE of 13 July 2010, transposed into French law by Article 289 VII of the French General Tax Code (CGI). This text defines the three compliance pathways (RAT, electronic signature, tax EDI) and establishes the principle of equivalence between paper and electronic invoices, provided that the conditions of authenticity, integrity, and readability are met.

The BOI-TVA-DECLA-30-20-30-20 (Official Bulletin of French Tax Authorities) clarifies the practical modalities expected by the French tax authority for RAT implementation: nature of controls, required documentation, retention periods. This administrative guidance is the operational reference for businesses.

Article L. 102 B of the French Tax Procedure Code sets a 6-year retention period for tax documents, while Article L. 123-22 of the Commercial Code imposes 10 years for accounting records. These two texts directly govern the archival policy of the RAT.

Signature and Integrity Obligations: The eIDAS Regulation

When a business chooses to secure its RAT with electronic signatures (on purchase orders, goods receipt validations, payment orders), eIDAS Regulation No. 910/2014 of the European Parliament and Council applies. It distinguishes three signature levels (simple, advanced, qualified) and defines the legal value of each. An advanced or qualified signature affixed to a document forming part of the audit trail significantly strengthens the non-repudiation evidence in case of litigation.

The French Civil Code, Articles 1366 and 1367, recognize the probative value of electronic writing and electronic signature under conditions of reliable identification of the signatory and document integrity. These provisions can be directly invoked in a tax dispute concerning invoice validity.

Legal Risks from Insufficient RAT

The absence or insufficiency of a reliable audit trail exposes the business to several cumulative risks:

• VAT deductibility rejection: the tax authority can refuse to allow VAT deduction on invoices whose transaction reality cannot be proven, resulting in a VAT adjustment with late-payment interest (0.20% per month, Article 1727 CGI).

• Fines for non-compliant invoicing: Article 1737 CGI provides for a 50% penalty on the transaction amount for any invoice not complying with mandatory particulars or formal requirements, with a minimum of €75 per invoice.

• Criminal liability: in case of proven fraud, penalties can include criminal prosecution for tax fraud (Article 1741 CGI), with sentences of up to 5 years' imprisonment and €500,000 fine.

• GDPR liability: personal data contained in invoices (customer name, contact details) are subject to GDPR Regulation No. 2016/679. The RAT archival policy must be compatible with the principles of data minimization and limitation of personal data retention.

Use Cases: The Reliable Audit Trail in Practice

Scenario 1 — A Manufacturing SME with 3,000 Supplier Invoices per Year

A manufacturing SME with around 100 employees, managing approximately 3,000 supplier invoices annually for raw materials and subcontracting purchases, faces a tax examination covering 2024 and 2025. The inspector requests reconstruction of the documentary chain for 150 randomly selected invoices.

Before implementing a structured RAT, the company stored purchase orders on a shared server without version control, goods receipts as scanned paper documents without indexing, and invoices in its accounting software without explicit links to supporting documents. Reconstructing the documentary chain for the 150 invoices required 3 weeks of manual work, and 12 invoices could not be justified, resulting in a VAT adjustment of €28,000 plus late-payment interest.

After deploying a formalized RAT process—three-way matching automated in the ERP, indexed electronic archiving, written procedures validated by finance management—the same type of examination two years later allowed complete restituton of supporting documents within 48 hours, with zero tax adjustment. The cost of compliance (approximately €15,000 in ERP configuration and training) was recovered at the first avoided examination. Businesses that have formalized their RAT reduce their exposure to VAT adjustment risk by an average of 60 to 80% according to feedback published by professional accounting associations.

Scenario 2 — A Distribution Group with Mixed B2C and B2B Flows

A regional distribution group with about fifty retail outlets must simultaneously manage e-invoicing obligations (for B2B purchases from national suppliers) and e-reporting (for B2C sales). The complexity stems from coexisting heterogeneous flows: EDI invoices from major suppliers, unsecured PDF invoices from local suppliers, dematerialized receipts for sales.

Implementing a unified RAT led the group to deploy a centralized document management platform, integrated with its chosen CSP for e-invoicing. Each received invoice is automatically matched against its purchase order and goods receipt via parameterized matching rules. Exceptions (discrepancies exceeding 2%) trigger an electronic validation workflow, with the trace preserved with the invoice in the archiving system.

Results observed after 12 months: 45% reduction in supplier invoice processing time (from 11 days to 6 days on average), 70% decrease in supplier follow-ups due to matching errors, and automatic constitution of a complete audit trail for 100% of processed invoices. These figures align with ranges published in sectoral studies by Eurogroup Consulting and the DFCG.

Scenario 3 — A Professional Services Firm Preparing for Electronic Invoicing

An engineering consulting firm with about 40 consultants, issuing approximately 800 B2B invoices annually, anticipates the electronic invoicing obligation. The managing partner wants to ensure that the transition to the chosen CSP will not weaken existing RAT compliance.

The prior audit reveals that the audit trail currently relies on validation emails archived manually in client folders, without certified timestamping or formalized procedure. This system, while functionally sound in practice, is legally fragile: emails can be retroactively modified, and their retention depends on individual management by each engagement manager.

The deployed solution combines: invoice issuance in Factur-X format via the CSP, advanced electronic signature on engagement letters and client validation orders (which constitutes proof of the order in the RAT), and probative archiving with qualified timestamping for all supporting documents. The firm now has a fully dematerialized RAT, consistent with its new e-invoicing obligations, and each component is enforceable against the tax authority.

Frequently Asked Questions

Is a reliable audit trail mandatory even if the company is already using a qualified electronic signature?

No. A reliable audit trail is one of three alternative methods recognized by Article 289 of the French General Tax Code (CGI) to guarantee the authenticity and integrity of invoices. If a company uses a qualified electronic signature compliant with eIDAS, it is not required to additionally implement a reliable audit trail (RAT). The two mechanisms are substitutable, not cumulative.

What risks does a company face if it fails to maintain a documented reliable audit trail?

During a tax audit, the tax administration may challenge the deductibility of VAT shown on invoices for which no coherent documentary chain can be reconstructed. This may result in a VAT adjustment accompanied by penalties and late payment interest. The risk applies to all invoices in question throughout the audited period, which may extend back up to six years.

How long must documents constituting the reliable audit trail be retained?

The invoices themselves must be retained for six years for tax purposes and ten years under French commercial law. The supporting documents that form the reliable audit trail — purchase orders, delivery notes, validation evidence — must remain accessible for the same period to enable complete reconstruction of the documentary chain in the event of an audit.

Does transmission of an invoice through a partner dematerialization platform eliminate the need to implement a reliable audit trail?

No. A partner dematerialization platform ensures the technical authenticity of the transmitted file, but it does not cover the entire internal documentary cycle: ordering, receipt, validation, accounting entry. The company remains responsible for consistency between these steps. The reliable audit trail and dematerialization via a partner platform address complementary and non-redundant requirements.

Does the reliable audit trail apply to invoices received from foreign suppliers?

Yes. Any invoice received by a French VAT-taxable person falls within the scope of the reliable audit trail, regardless of the supplier's location. The company must be able to verify the identity of the issuer, for example through the VIES service for suppliers in the European Union, and reconstruct the link between the invoice and the corresponding service or delivery.

Conclusion

The reliable audit trail is not a second-tier administrative formality: it is the documentary foundation guaranteeing the tax validity of all your invoices, whether paper or electronic. With the rise of the 2026-2027 electronic invoicing reform, the RAT becomes inseparable from a robust VAT compliance strategy. Three pillars structure it—authenticity of origin, content integrity, readability over time—and three levers operationalize it: formalized controls, traceable documentation, and probative archiving with dual time horizons.

Neglecting the RAT exposes you to costly tax adjustments, risks of VAT deductibility rejection, and paralyzing examination timelines. Anticipating it transforms a regulatory constraint into an operational advantage.

Certyneo supports you in achieving compliance for your documentary flows with qualified electronic signature tools, certified timestamping, and probative archiving. Start your free trial on Certyneo and build an unassailable reliable audit trail today.