The Reliable Audit Trail in Electronic Invoicing: A Complete Guide

The 2026-2027 electronic invoicing reform is fundamentally transforming accounting and tax practices for French businesses. Among the key concepts of this reform is the reliable audit trail (PAF), often overlooked yet mandatory since 2013. With the gradual rollout of mandatory electronic invoicing between 2026 and 2027, the PAF reclaims a central position in VAT compliance strategies for finance directors and accounting firms. This article explains in detail what a reliable audit trail is, why it is inseparable from electronic invoicing, what controls and documentation it requires, and how to integrate it effectively into your organization.

What is a Reliable Audit Trail (PAF)?

Definition and Regulatory Context

The reliable audit trail designates the entirety of controls, procedures, and internal documentation that make it possible to establish a reliable link between an invoice and the underlying economic transaction (delivery of goods or provision of services). It constitutes one of three legally recognized pathways to guarantee the authenticity of the origin, the integrity of the content, and the readability of an invoice, in accordance with article 289 of the General Tax Code (CGI) and the VAT directive 2010/45/EU.

The three accepted pathways are:

• Advanced or qualified electronic signature (eIDAS)

• Tax EDI (electronic data interchange compliant with tax standards)

• Reliable audit trail, applicable to all paper or electronic invoices not secured by the first two pathways

Contrary to a common misconception, the PAF is not an option reserved for small organizations: it applies to every business subject to VAT that issues or receives invoices without resorting to qualified signature or tax EDI. In practice, it concerns the vast majority of French micro-enterprises, SMEs, and mid-market companies today.

Why is the PAF at the Heart of the 2026-2027 Reform?

With the French electronic invoicing reform, domestic B2B invoices must mandatorily be transmitted through a digital platform partner (PDP) or through the Public Invoicing Portal. This obligation does not eliminate the PAF: it comes to overlay it. An electronic invoice transmitted via a PDP certainly guarantees the technical authenticity of the file, but the business must still be in a position to reconstruct the complete documentary trail between the purchase order, the goods receipt, the invoice, and payment.

The tax authorities may scrutinize this documentary chain during an audit. The absence of documented PAF exposes the company to VAT adjustments that can extend to rejection of the deductibility of the invoices in question.

The Three Pillars of the Reliable Audit Trail

Pillar 1: Authenticity of Origin

Authenticity of origin means that the identity of the invoice issuer must be certain and verifiable. Within the PAF framework, this translates into the establishment of internal validation processes: who is authorized to issue an invoice on behalf of the company? How does one ensure that the supplier from whom you receive an invoice is indeed the one with whom you contracted?

These controls include notably verification of the VAT identification number (via the VIES service of the European Commission), cross-checking with supplier reference data, and matching against prior purchase orders.

Pillar 2: Integrity of Content

The integrity of content implies that the invoice data—amounts, VAT rates, description of the service, identifiers of the parties—have not been altered after issuance. In a PAF approach, integrity is not guaranteed by a cryptographic mechanism (which is the essence of electronic signature), but by a system of documented manual or automated controls: three-way matching (purchase order / goods receipt / invoice), accounting reconciliation, hierarchical validation.

Structured formats such as Factur-X greatly facilitate this step: the XML file embedded in the PDF/A-3 contains machine-readable data, enabling automated validation of amounts and references.

Pillar 3: Readability

The invoice must remain legible to humans throughout the entire legal retention period (10 years under French commercial law, 6 years under tax law). This imposes specific technical choices: long-lasting file format (PDF/A recommended), absence of DRM blocking reading, archiving in a system guaranteeing access over time. This readability requirement is often neglected in archiving policies, particularly when companies change accounting software without migrating their archives.

Controls and Documentation to Implement

Mapping of Invoicing Processes

The first step toward PAF compliance consists of mapping the entirety of invoicing flows: issuance, receipt, validation, accounting entry, payment. This mapping must identify each control point, the persons or systems responsible, and the evidence generated at each stage.

The tax authorities expect formalized documentation, typically in the form of:

• Written procedures describing the process steps

• Control matrices listing the controls performed and their frequency

• Audit logs (IT logs, validation workflows)

• Control evidence archived: validation emails, signed purchase orders, delivery confirmations

For companies that have already commenced their electronic invoicing assessment, this mapping naturally constitutes the first building block of the PAF approach.

Three-Way Matching: The Operational Heart of the PAF

Three-way matching is the most widespread technique for satisfying the requirements of the reliable audit trail. It consists of systematically reconciling:

• The purchase order—what was ordered

• The goods receipt note—what was delivered or completed

• The invoice—what is being invoiced

Any discrepancy between these three documents triggers a process of reinforced validation before payment. This mechanism, when well documented, constitutes solid evidence of the integrity of the procurement process in the eyes of the tax authorities.

In modern ERP environments (SAP, Oracle, Sage, Cegid, etc.), this control is often automated. For smaller organizations, a structured spreadsheet with timestamped change tracking can suffice, provided it is retained with the corresponding supporting documents.

Retention Period and Probative Archiving

The PAF implies a rigorous archiving policy. The documents constituting the audit trail—purchase orders, goods receipts, invoices, control evidence, validation logs—must be retained in such a way as to be producible within a reasonable timeframe during a tax audit.

Article L. 102 B of the Fiscal Procedures Code imposes retention of 6 years for tax documents. The Commercial Code (article L. 123-22) extends this period to 10 years for accounting records. The PAF must therefore be designed as an archiving system with a dual temporal horizon.

Qualified electronic timestamping constitutes a valuable tool here: by affixing a certified timestamp to the audit trail documents at the time of their creation, the company possesses proof of antecedence that can be opposed to the tax authorities.

Reliable Audit Trail and E-Reporting: Articulation with New Obligations

E-Reporting Supplements but Does Not Replace the PAF

The 2026-2027 reform also introduces the obligation of e-reporting for B2C and international B2B transactions not covered by mandatory electronic invoicing. E-reporting consists of transmitting to the tax authorities transaction data (amounts, VAT, identifiers) on a periodic basis.

However, e-reporting covers only summary data. It does not reconstruct the complete documentary chain required by the PAF. In other words, even if your PDP correctly transmits your transaction data to the tax authorities, you must still maintain a documented reliable audit trail to justify the reality of the underlying transactions.

Articulation with the Deployment Timeline

The reform timeline provides for a phased entry into force depending on company size. Regardless of the deadline applicable to your organization, PAF compliance must be anticipated and documented before the commencement of electronic invoicing obligations. A tax audit concerning invoices issued prior to the reform may well rely on the absence of a PAF as grounds for adjustment.

Companies already using advanced or qualified electronic signatures to validate their purchase orders and supplier contracts enjoy a competitive advantage: their approval chain is already traceable and timestamped, which constitutes a natural component of the PAF. The legal value of electronic signature thus directly strengthens the robustness of your audit trail.

Legal Framework Applicable to the Reliable Audit Trail

Foundational Texts in French and European Law

The reliable audit trail finds its primary source in the VAT directive 2010/45/EU of the Council of July 13, 2010, transposed into French law by article 289 VII of the General Tax Code (CGI). This text defines the three compliance pathways (PAF, electronic signature, tax EDI) and establishes the principle of equivalence between paper and electronic invoicing, provided that the conditions of authenticity, integrity, and readability are respected.

The BOI-TVA-DECLA-30-20-30-20 (Official Bulletin of Tax Finances) clarifies the practical modalities expected by the French tax authorities for the implementation of the PAF: nature of controls, required documentation, retention periods. This administrative doctrine constitutes the operational reference for businesses.

Article L. 102 B of the Fiscal Procedures Code fixes 6 years as the retention period for tax documents, while article L. 123-22 of the Commercial Code imposes 10 years for accounting records. These two texts directly govern the archiving policy of the PAF.

Signature and Integrity Obligations: The eIDAS Regulation

When the company chooses to secure its PAF through electronic signatures (on purchase orders, receipt validations, payment orders), the eIDAS regulation no. 910/2014 of the European Parliament and Council applies. It distinguishes three levels of signature (simple, advanced, qualified) and defines the legal value of each. An advanced or qualified signature affixed to a document constituting part of the audit trail significantly strengthens the evidence of non-repudiation in case of dispute.

The Civil Code, articles 1366 and 1367, recognize the probative value of electronic writing and electronic signature under conditions of reliable identification of the signatory and integrity of the document. These provisions are directly applicable in the event of a tax dispute concerning the validity of an invoice.

Legal Risks in Case of Insufficient PAF

The absence or insufficiency of a reliable audit trail exposes the company to several cumulative risks:

• Denial of VAT deduction: the tax authorities may refuse the deduction of VAT claimed on invoices for which the reality of the transaction cannot be proven, resulting in a VAT reassessment plus interest for late payment (0.20% per month, art. 1727 CGI).

• Penalties for non-compliant invoicing: article 1737 CGI provides for a penalty of 50% of the transaction amount for any invoice failing to comply with mandatory mentions or formal requirements, with a minimum of €75 per invoice.

• Criminal risk: in case of proven fraud, penalties may include prosecution for tax fraud (art. 1741 CGI), with sentences potentially reaching 5 years imprisonment and €500,000 in fines.

• GDPR liability: the personal data contained in invoices (customer name, contact details) are subject to GDPR regulation no. 2016/679. The PAF archiving policy must be compatible with the principles of data minimization and limitation of personal data retention.

Use Cases: The Reliable Audit Trail in Practice

Scenario 1—An Industrial SME with 3,000 Supplier Invoices per Year

An industrial SME with around one hundred employees, managing approximately 3,000 supplier invoices annually for purchases of raw materials and subcontracting, faces a tax audit covering the 2024 and 2025 fiscal years. The inspector requests reconstruction of the documentary chain for 150 randomly selected invoices.

Before implementing a structured PAF, the company stored its purchase orders on a shared server without versioning, its goods receipts as unindexed scanned paper documents, and its invoices in its accounting software without explicit links to supporting documents. Reconstructing the documentary chain for the 150 invoices required 3 weeks of manual work, and 12 invoices could not be justified, resulting in a VAT reassessment of €28,000 plus interest for late payment.

After deploying a formalized PAF process—automated three-way matching in the ERP, indexed electronic archiving, written procedures validated by the finance director—a similar audit two years later made it possible to produce all supporting documents in less than 48 hours, with zero tax adjustments. The cost of compliance (approximately €15,000 in ERP configuration and training) was recovered at the first audit avoided. Companies that have formalized their PAF reduce their exposure to VAT adjustment risk by an average of 60 to 80% according to feedback published by professional accounting associations.

Scenario 2—A Distribution Group with Mixed B2C and B2B Flows

A regional distribution group with about fifty retail locations must simultaneously manage e-invoicing obligations (for B2B purchases from national suppliers) and e-reporting obligations (for B2C sales). The complexity stems from the coexistence of heterogeneous flows: EDI invoices with major suppliers, unsecured PDF invoices with local suppliers, dematerialized receipts on the sales side.

The implementation of a unified PAF led the group to deploy a centralized document management platform, interfaced with the PDP chosen for e-invoicing. Each received invoice is automatically reconciled with its purchase order and goods receipt through parameterized matching rules. Exceptions (variances exceeding 2%) trigger an electronic validation workflow, the trace of which is preserved with the invoice in the archiving system.

Results observed after 12 months: 45% reduction in supplier invoice processing time (from 11 days to 6 days on average), 70% decrease in supplier follow-ups due to reconciliation errors, and automatic constitution of a complete audit trail for 100% of processed invoices. These figures are consistent with the ranges published in sector studies by Eurogroup Consulting and the DFCG.

Scenario 3—A Professional Services Firm Preparing for Electronic Invoicing

An engineering consulting firm with about forty employees, issuing approximately 800 B2B invoices per year, is anticipating the electronic invoicing obligation. The managing partner wishes to ensure that the transition to the chosen PDP will not weaken existing PAF compliance.

The preliminary audit reveals that the audit trail currently relies on manually archived validation emails in client folders, without certified timestamping or formalized procedure. While this system is functionally sound in practice, it is legally fragile: emails can be retroactively altered, and their retention depends on individual management by each project manager.

The solution deployed combines: invoice issuance in Factur-X format via the PDP, advanced electronic signature on engagement letters and customer validation documents (which constitutes proof of the order in the PAF), and archiving with probative value with qualified timestamping for all supporting documents. The firm now has a fully dematerialized PAF, consistent with its new e-invoicing obligations, with each component capable of being opposed to the tax authorities.

Frequently Asked Questions

Is a reliable audit trail mandatory even if the company already uses a qualified electronic signature?

No. The reliable audit trail is one of three alternative methods recognized by article 289 of the French Tax Code (CGI) to guarantee the authenticity and integrity of invoices. If a company uses a qualified electronic signature compliant with eIDAS, it is not required to additionally implement a RAT process. The two mechanisms are substitutable, not cumulative.

What risks does a company face if it fails to maintain a documented reliable audit trail?

During a tax audit, the tax authority may challenge the VAT deductibility claimed on invoices for which no coherent documentary chain can be reconstructed. This may result in a VAT adjustment accompanied by penalties and late payment interest. The risk applies to all affected invoices throughout the audited period, dating back up to six years.

How long must documents constituting the reliable audit trail be retained?

The invoices themselves must be kept for six years for tax purposes and ten years under French commercial law. The supporting documents that form the RAT—purchase orders, delivery notes, validation proof—must remain accessible for the same period to allow complete reconstruction of the documentary trail in case of audit.

Does transmission of an invoice through a partner dematerialization platform exempt a company from implementing a RAT?

No. A partner dematerialization platform guarantees the technical authenticity of the transmitted file, but it does not cover the entire internal documentary cycle: ordering, receipt, validation, and accounting. The company remains responsible for consistency between these stages. The RAT and dematerialization via PDP respond to complementary and non-redundant requirements.

Does the reliable audit trail apply to invoices received from foreign suppliers?

Yes. Every invoice received by a VAT-registered French taxpayer falls within the scope of the RAT, regardless of the supplier's location. The company must be able to verify the identity of the issuer, for example through the VIES service for suppliers in the European Union, and to reconstruct the link between the invoice and the corresponding service or delivery.

Conclusion

The reliable audit trail is not a second-rank administrative formality: it is the documentary foundation that guarantees the tax validity of all your invoices, whether paper or electronic. With the escalation of the 2026-2027 electronic invoicing reform, the PAF becomes inseparable from a robust VAT compliance strategy. Three pillars structure it—authenticity of origin, integrity of content, readability over time—and three levers make it concrete: formalized controls, traceable documentation, and probative archiving with a dual temporal horizon.

Neglecting the PAF exposes you to costly tax adjustments, risks of VAT deduction denial, and paralyzing audit timelines. Anticipating it transforms a regulatory constraint into an operational advantage.

Certyneo accompanies you in achieving compliance for your documentary flows with qualified electronic signature tools, certified timestamping, and probative archiving. Start your free trial on Certyneo and build an unassailable reliable audit trail starting today.