Executive Summary
- The Brazilian vendor can supply customer-side software through the proposed partners. Its contracts and operations must leave the French accredited platform’s statutory functions and the Belgian provider’s certified network functions with those operators. Taking over those functions changes the qualification. (Code général des impôts, ann. II, art. 242 nonies E; Belgian VAT Code, art. 53, § 2bis.)
- French receiving obligations began on 1 September 2026 for businesses within scope. Large and intermediate-sized businesses also began issuing and reporting then; the ordinary SME and microenterprise issuing/reporting date is 1 September 2027. The receiving duty does not share that deferral. (Loi n° 2022-1157, art. 26 III, as amended.)
- Belgian domestic structured invoicing has applied since 1 January 2026. Peppol is the prescribed default; an agreed alternative must satisfy the European standard, while Peppol technical capability remains compulsory. The general first-quarter tolerance has expired. (Belgian VAT Code, art. 53, § 2bis; arrêté royal n° 1, arts. 13ter–13quater.)
- EU adequacy permits covered personal-data transfers to Brazil, including qualifying remote access. French accreditation separately requires EU operation and prevents transfers of the platform’s hosted service data outside the EU. A compliant transfer basis cannot cure an incompatible platform architecture. (Commission Implementing Decision (EU) 2026/179, art. 1; CGI, ann. II, art. 242 nonies B I 5°.)
- A customer’s statutory invoice duties survive outsourcing. The software vendor and transmission partner can owe repair, evidence and compensation duties for their own failures. An indemnity allocates recourse between contracting parties without replacing the taxpayer before the tax administration. (Belgian VAT Code, art. 53, § 2bis; CGI, arts. 1737 and 1788 D.)
- An outage requires identification of the failed stage, preservation of the original invoice and reconciliation before any retry. Belgian recipient incapacity has a specific statutory fallback; a supplier’s mapping defect does not automatically qualify. France has announced no sanctions for any enterprise under the reform in 2026, while the underlying obligations remain in force. (Loi belge du 10 février 2026, art. 4; DGFiP, Guide pratique de démarrage, questions 5, 6 and 13; Ministry of Finance, releases of 1 September and 9 October 2026.)
- Operating an independent platform would add accreditation or network admission, security, testing and continuing service duties. Payment initiation, collection for customers and participation in arranging finance require a separate product assessment before activation. Neither invoicing status nor Brazil adequacy authorises those activities. (CGI, ann. II, art. 242 nonies B; Directive (EU) 2015/2366, arts. 3(j), 4(15) and annex I.)
The software service and the two transmission roles
The initial product should create and process invoice data, connect customers to their selected providers and expose delivery and error information. The Brazilian limited company supplies the application, mapping and technical support. Its engineering team remains in Brazil. Customers remain the businesses making the underlying supplies and issuing the invoices.
A French plateforme agréée, or PA, performs functions assigned by the French tax rules. These include regulated exchange, directory updates, invoice lifecycle messages and transmission of fiscal data. Compatible software can connect to a PA without acquiring that status. The vendor needs PA status if it performs the reserved service in its own capacity. If it operates part of a PA’s infrastructure as a subcontractor, the platform’s accreditation conditions extend to that operation. Describing it as a software provider does not remove those conditions. (CGI, arts. 289 bis I and 290 B; ann. II, arts. 242 nonies B I 5° and E.)
For Belgium, the Peppol provider connects the customer to a network for exchanging structured business documents. An Access Point is the certified service through which documents enter or leave that network. The ERP supplier can integrate with an existing Access Point through its interface. Becoming the network operator requires the applicable provider agreement, conformance testing and production certification. These are network admission requirements; French tax accreditation remains a separate qualification. (OpenPeppol Internal Regulations, Part II, v4.0.0, §§ 5.3–5.5; CGI, ann. II, art. 242 nonies B.)
No general French or Belgian incorporation condition follows merely from this customer-side software role. Local incorporation becomes a commercial or operational choice, while establishment and representative rules must be tested for each activity. The vendor’s own software sale from Brazil also needs separate treatment from its customers’ domestic invoices. A European VAT-registered customer does not turn the Brazilian supplier into a domestic established supplier. (CGI, art. 289 bis I; Belgian VAT Code, art. 53, § 2bis.)
The Brazilian company should document its right to license and maintain the code before committing to customer remedies. Brazilian software protection does not depend on registration. The default ownership rule for employee and commissioned development depends on the employment or service conditions and the development’s connection to the work. Contractor access to the repository alone establishes no chain of title. (Lei nº 9.609/1998, arts. 2, § 3º, and 4.)
French receiving, issuing and reporting have different triggers
The French product must support receiving now for customers within the domestic receiving scope. The reform principally concerns qualifying transactions between VAT-taxable persons established, domiciled or habitually resident in France. Taxable status includes businesses using the small-business VAT exemption; absence of VAT charged on their invoices does not alone exclude them. Exempt operations under CGI articles 261–261 E, non-established suppliers and the express classified and cross-border exclusions require separate classification. A French VAT number is insufficient to settle the question. (CGI, art. 289 bis I and IV–V; DGFiP, receiving FAQ, 16 January 2026; BOI-TVA-DECLA-20-30-50-10, 30 September 2026, §§ 1–60.)
The statutory calendar began on 1 September 2026 for receiving and for large and intermediate-sized businesses’ issuing and reporting. SMEs and microenterprises ordinarily begin issuing and reporting on 1 September 2027. The latter deferral excludes members of a single VAT-taxable group under CGI article 256 C. The law fixes the size assessment at 1 January 2025 using the relevant financial year. Product onboarding therefore needs the legal entity, cohort and group status, rather than a customer’s informal description of itself as small. (Loi n° 2022-1157, art. 26 III, as amended by loi n° 2026-103, art. 123.)
Domestic invoice exchange and reporting of other transactions are separate functions. Relevant consumer and cross-border transactions enter the reporting rules instead of the domestic invoice route. The reporting provisions also cover specified French recipients’ purchases from non-established suppliers. The Brazilian vendor’s own SaaS invoice can therefore create reporting work for its French customer once that customer’s reporting cohort starts. The actual supply, establishment and VAT treatment determine the answer. (CGI, arts. 289 E and 290 I–III; BOI-TVA-DECLA-20-30-50-10, 30 September 2026, §§ 1–60.)
Collection reporting concerns transactions for which VAT becomes chargeable on receipt of payment. Its scope can include services and advances; reverse-charge transactions are excluded. The software needs the relevant tax treatment and actual collection event before instructing a report. An invoice’s issue date, technical delivery and payment are different events. Reporting frequency and transmission periods also depend on the relevant tax regime. (CGI, art. 290 A; BOI-TVA-DECLA-20-30-60, 30 September 2026, §§ 1–40 and 150–210.)
The French invoice path needs evidence at each handover
The proposed French integration should follow a defined sequence. The PA retains the statutory exchange and reporting responsibilities throughout it. (CGI, ann. II, arts. 242 nonies E, F and H.)
1. The customer supplies the parties’ identifiers, supply details, tax treatment and invoice particulars. The ERP validates the agreed fields and records the version submitted. The customer authorises the chosen receiving PA and the relevant directory changes.
2. The software submits the invoice through the PA’s authenticated interface in a supported format that meets the applicable legal specifications. Conversion responsibility, accepted profiles and validation failures belong in the integration specification.
3. The PA performs its required checks, resolves the receiving address through the directory and transmits the invoice to the recipient’s PA. The receiving operator makes it available to the recipient.
4. The relevant PA extracts and transmits invoice fiscal data and handles applicable transaction or collection reports. The ERP must provide the data and events needed for those functions under the agreed division of work.
5. The customer and software receive distinct acknowledgements and lifecycle information. They reconcile accepted, rejected, refused, corrected and paid states with the accounting records and preserve the evidence.
French PAs must support the prescribed structured CII and UBL profiles and the specified hybrid structured-XML/PDF format. They must be capable of receiving all the listed formats and transmitting at least one; customer-facing conversion can be offered. Where conversion cannot guarantee strict data integrity, the recipient’s PA must provide a readable representation containing all pre-conversion information. The integration contract should reflect that duty. The prescribed checks include required data, party identifiers, VAT arithmetic and invoice-number uniqueness. (CGI, ann. IV, arts. 41 septies C I and F.)
Authentication and statuses also need explicit integration rules. The PA must meet the substantial electronic-identification assurance requirement. Until 31 December 2029, the permitted alternative combines reliable identity and authority verification with two-factor authentication, including a dynamic factor. The required lifecycle categories distinguish Dépôt, Rejet, Refus and Encaissée. The PA updates the first two; the recipient controls refusal and the issuer supplies the relevant collection status. (CGI, ann. II, art. 242 nonies F; ann. IV, art. 41 septies G.)
The directory contains business identifiers and routing information. A PA’s consultation rights serve invoice addressing, and receiving-address changes require the customer’s formal agreement. An ERP connection does not grant a general right to reuse the directory for marketing. Failed lookups require investigation of the identifier and receiving address before a transmission is treated as complete. (CGI, ann. II, arts. 242 nonies E bis and H.)
Interoperability between French PAs may use bilateral agreements or a network exchange protocol. French law does not prescribe Peppol as the sole route. Where Peppol is used for French reform traffic, DGFiP’s authority requirements also require the provider to be a PA. A certified Belgian Access Point therefore cannot replace the accredited French partner merely because it can transport the same file. (CGI, ann. II, art. 242 nonies I; DGFiP, Rejoindre le réseau Peppol, 23 December 2025.)
Belgian scope and the Peppol route
The Belgian product must already support qualifying domestic structured invoices. Article 53, § 2bis of the VAT Code applies to the specified Belgian-established taxable issuer, covered supply and qualifying recipient identification. It permits third-party issuance in the supplier’s name and on its behalf. The recipient can also receive through a third party. Small-business VAT exemption does not itself remove these duties. (Loi du 6 février 2024, arts. 2–3 and 6; loi du 10 février 2026, arts. 4 and 22.)
The exclusions matter to onboarding. Article 44-exempt transactions fall outside the structured-invoice mandate. Persons conducting exclusively those exempt activities, and non-established businesses without a Belgian fixed establishment, have corresponding scope exclusions. Issuing exceptions also cover the specified flat-rate taxpayers and bankrupt activities. Businesses selling only to consumers can still need structured reception for their covered purchases. The February 2026 amendment removed the recipient category that had included certain non-established VAT-identified businesses. (Belgian VAT Code, art. 53, § 2bis; FPS Finance, Pour qui la facturation électronique deviendra-t-elle obligatoire ?; loi du 10 février 2026, art. 4.)
The prescribed default combines Peppol BIS, UBL syntax and the Peppol network. Parties may agree another electronic format and transmission method that meets EN 16931 and the permitted syntaxes. Article 13quater still requires the technical means to send and receive through the prescribed Peppol route. A bilateral alternative is legally available, but a PDF-only product cannot rely on that alternative to serve the general covered market. (Arrêté royal n° 1, arts. 13ter–13quater, inserted by arrêté royal du 8 juillet 2025, art. 3.)
The Belgian workflow has four principal handovers. These reflect the statutory invoice duty and the provider’s network obligations. The current published agreement is a model; the selected provider’s executed terms and incorporated release obligations must be checked. (Belgian VAT Code, art. 53, § 2bis; OpenPeppol Service Provider Agreement, model v4.0.2, cls. 9.1–9.5 and 15; Belgium Peppol Authority Specific Requirements, v2023-11-29, category 1; MLS Operational Guideline, v1.0.0, §§ 6.1–6.2.)
1. The customer approves the underlying invoice data. The ERP maps it to the agreed Peppol profile and runs the agreed validation checks.
2. The certified provider verifies the participant’s identity and routing information, applies required network checks and sends through its production Access Point. Belgian participant onboarding must address the required enterprise identifier.
3. The recipient’s Access Point accepts transport responsibility and performs the applicable processing before delivery to its customer. The ERP records the acknowledgements that the selected providers actually supply.
4. The issuer reconciles delivery, rejection and any buyer response. A transport receipt proves a transport event; commercial acceptance and correct tax treatment require their own evidence.
Peppol’s Message Level Status rollout remains phased. Receiving becomes mandatory on 28 February 2027, with sending and related service requirements following on 31 March 2027. Contracts made in October 2026 should specify present capabilities and the upgrade obligation. The software must not infer buyer acceptance or send a duplicate simply because a later status is absent. (OpenPeppol, MLS Phase-In Plan, v1.0.0, 2 July 2026, pp. 7–9; MLS Operational Guideline, § 6.2.)
The Belgian mandate does not currently send invoice data to the tax administration through this exchange. FPS Finance describes 2026 as the invoicing phase and states that the proposed reporting phase still needs Belgian legislation. Ordinary VAT returns and other tax duties continue. The product must keep this Belgian route distinct from the French PA’s fiscal-data transmissions. (FPS Finance, Questions générales sur le e-reporting, questions 1–3.)
Independent accreditation would change the operating business
Using existing operators is the supported initial choice because it preserves the vendor’s proposed software activity. Direct operation offers control over transport, onboarding and service changes, but transfers the associated admission and continuing duties to the vendor. That alternative becomes credible only when the company intends to operate those functions and can support their infrastructure and controls.
A French PA applicant can be established outside France. The registration regulation expressly accepts foreign commercial-registration and tax-compliance documents. It also requires security evidence, ISO/IEC 27001 coverage, the applicable SecNumCloud qualification for cloud hosting, interoperability testing and independent audits. The authority’s two-month decision period starts with a complete application; it is no promise of an end-to-end implementation date. Registration and later audit obligations must be read together. (CGI, ann. II, art. 242 nonies B I–IV.)
The decisive constraint for this Brazilian company is operational. The PA must undertake to operate its information system from the EU and make transfers of hosted service data outside the EU impossible. The condition reaches third parties on which the PA relies and which are technically able to obtain that data. A French subsidiary leaves the problem unresolved if Brazilian administrators, support staff or subcontractors can retrieve the protected data. (CGI, ann. II, art. 242 nonies B I 5°.)
For an independent Belgian-facing Access Point, OpenPeppol requires the appropriate agreement, membership, testing and certification. Foreign providers can serve Belgian users; Belgian incorporation is not a universal admission condition. A Brazilian applicant without a relevant home Authority normally applies to the Coordinating Authority. The rules also permit a specially authorised foreign Authority route, with Belgian requirements still applying to Belgian participants. A Belgian subsidiary would change the authority relationship and contracting entity, without removing certification duties. (OpenPeppol Internal Regulations, Part II, v4.0.0, §§ 5.4.1(2), 7.3.1(7) and 7.3.2; Belgium Authority Specific Requirements, categories 1 and 7.)
The chosen partner’s actual status must be a contracting condition. DGFiP’s list distinguishes operators that have completed required interoperability tests from applicants awaiting definitive registration. OpenPeppol distinguishes Access Point and metadata-publisher certification. Belgium’s software list is a discovery aid without a government quality endorsement. The contract should identify the exact legal entity, authorised service, current status and consequences of suspension or withdrawal. (DGFiP, Liste des plateformes agréées, 13 October 2026; OpenPeppol, Certified Service Providers, 19 October 2026; FPS Finance, software-solutions notice, 26 June 2026.)
Brazilian access requires separate data and platform decisions
Remote Brazilian support access can be a personal-data transfer even where the server remains in the EU. The customer or EU processor makes data available to a separate company in a third country. The EDPB’s transfer test turns on that disclosure and recipient relationship, rather than on whether someone downloads a file. Invoice data can contain sole-trader details, employee names, addresses and payment information. (GDPR, arts. 4(1) and 44–45; EDPB Guidelines 05/2021, v2.0, section 2.)
Commission Implementing Decision (EU) 2026/179, adopted on 26 January 2026, recognises adequate protection for transfers to Brazilian controllers and processors subject to the LGPD. Covered EU-to-Brazil access can therefore rely on GDPR article 45 without an article 46 transfer safeguard solely for that transfer. The decision leaves processing instructions, lawful purposes, security and subcontracting duties intact. It also leaves the French PA’s separate restriction intact. (Decision (EU) 2026/179, art. 1; GDPR, arts. 28, 32 and 45.)
The proposed French design should keep the PA environment and its hosted service data under EU operation and support. Brazilian engineering should use synthetic or genuinely anonymised reproductions. Access controls must cover production databases, backups, support tickets, downloadable payloads and diagnostic logs. Removing direct database access is insufficient if another interface still exposes the same protected data. (CGI, ann. II, art. 242 nonies B I 5°; GDPR, art. 32.)
A genuinely independent customer-side ERP dataset can require a different assessment. That distinction must follow the service boundaries and technical access rights. Calling an API copy “ERP data” cannot itself remove the PA condition. The strongest objection to the partner route is that the Brazilian vendor actually operates part of the PA service or can retrieve its hosted data. The recommendation depends on eliminating that access or redesigning the relevant operations in the EU.
For permitted processing, the customer normally controls the purposes of its business invoice data. The vendor acts as processor when it follows that customer’s instructions. Its own billing or independent analytics can involve separate controller purposes. The PA and Peppol provider need classification for each activity and legal duty; their accreditation does not decide every data role. (GDPR, art. 4(7)–(8).)
The processing agreement should specify instructions, confidentiality, security, assistance, audits and return or deletion. A further processor requires prior specific or general written authorisation. General authorisation requires notice of changes and an opportunity to object. The first processor remains responsible to the controller for its subprocessor’s performance. The customer’s direct agreement with a platform must also be reflected in the contract chain. Licentium’s data protection guide for AI and SaaS covers processing agreements and data-flow mapping relevant to that work. (GDPR, art. 28.)
Brazil storage is a further design decision. Adequacy can support a covered recipient there, but storage must also satisfy customer instructions, applicable tax-access rules and the French platform restriction. A subsequent disclosure to another country or subcontractor requires its own assessment. Brazil’s reciprocal adequacy decision supports covered transfers to the EU; it does not authorise every onward destination. Brazilian exporters must apply LGPD article 33 and ANPD’s transfer regulation, alongside GDPR Chapter V where that exporter’s activity is directly subject to it. (Resoluções CD/ANPD nº 19/2024, ann. I, arts. 4–9, and nº 32/2026, arts. 1–2.)
Brazilian support processing remains subject to the LGPD because it occurs in Brazil. The exception for returning foreign-origin data requires conditions that include an express adequacy-decision permission for exceptional non-application. Resolution 32 provides no such permission. The vendor therefore needs the relevant processing basis, records, customer instructions and security measures even for data destined to return to Europe. (Lei nº 13.709/2018, arts. 3, 7, 37, 39 and 46; Resolution 19/2024, ann. I, art. 8.)
An EU GDPR representative is a separate question. Direct territorial application depends on an EU establishment or the article 3(2) targeting or monitoring test. Corporate customers and personal data in their invoices do not alone prove that the vendor offers services to the individuals concerned. Sole-trader services, an EU establishment or relevant behavioural monitoring can change the result. If article 3(2) applies, routine invoicing processing ordinarily cannot use the occasional-processing exception to article 27. EU customers still need article 28 protections when the foreign processor is outside direct territorial application. (GDPR, arts. 3, 27–28; EDPB Guidelines 3/2018, v2.1, sections 1(d), 2(d) and 4.)
A mapping error or outage leaves several obligations in place
Suppose a valid customer invoice is rejected, duplicated or transmitted late because the software maps a field incorrectly or a service fails. The first response should establish whether the failure occurred before submission, at validation, during transport or after recipient delivery. That distinction determines whether the parties must retry the existing invoice, correct an issued tax document or resolve a commercial refusal.
The incident record should preserve the original payload, identifiers, timestamps, validation response and each acknowledgement. The vendor should correct its mapping and revalidate. The transmission partner should establish the last completed stage and any queued delivery. Before resubmission, the parties should reconcile the invoice’s identity against accounting and provider records. A retry must not create a second supply, second payment demand or duplicate VAT entry. (DGFiP, Guide pratique de démarrage, questions 5–6 and 13; FPS Finance, Questions spécifiques sur la facturation électronique, questions 4–5 and 23.)
If the underlying tax or commercial content changes, the issuer needs the appropriate corrective document linked to the original. A buyer’s refusal status does not itself adjudicate the contractual dispute or invariably require cancellation. A document sent to the wrong customer raises a substantive correction issue distinct from a transport failure. The software should preserve those categories in its user interface and accounting records. (CGI, art. 289 I 5; Belgian VAT Code, art. 53, § 2bis; FPS Finance, specific FAQ, questions 28–29; DGFiP, startup guide, question 12.)
Belgium’s enacted fallback applies where the recipient cannot technically receive a structured invoice, itself or through a third party. The supplier must still issue the ordinary invoice required by article 53, § 2. A mapping bug at the supplier, while the recipient remains capable, does not meet that condition. The general January–March 2026 tolerance and the later limited self-billing tolerance have ended. (Loi du 10 février 2026, arts. 4 and 22; FPS Finance, Fin de la période de tolérance, 7 April 2026.)
DGFiP’s French startup guide recognises genuine implementation difficulties supported by evidence and a serious compliance trajectory. It states that this treatment does not postpone or suspend the reform. For an outage, it directs regularisation of the same invoice after restoration. The Ministry subsequently announced that no enterprise would face sanctions under the reform in 2026, and reaffirmed that policy on 9 October 2026. This announced enforcement policy does not repeal the statutory penalties or suspend the underlying obligations. That administrative treatment should inform the incident file, without becoming a contractual promise that any failure will escape sanction. (DGFiP, Guide pratique de démarrage, opening explanation and questions 13 and 29; Ministry of Finance, releases of 1 September and 9 October 2026.)
French statutory penalties in force in 2026 distinguish the actors and duties. Failure to issue electronically attracts €50 per invoice, capped at €15,000 per calendar year. A PA’s failure to transmit invoice fiscal data attracts €50 per invoice, capped at €45,000. Failure to choose a receiving PA first attracts a three-month formal notice. Continued failure leads to €500 and another three-month notice, then €1,000 for the prescribed continuing infringements. (CGI, art. 1737 III–IV bis.)
The statutory cure rule concerns a first infringement in the current year and the three preceding years. The specified sanctions are disapplied if the breach is corrected spontaneously or within 30 days of the administration’s first request. Article 1737 V does not include the receiving-PA offence in IV bis. The separate reporting provision has its own corresponding cure rule. (CGI, arts. 1737 V and 1788 D V.)
Under the 2026 French reporting provisions, the taxpayer penalty is €500 per transmission, with the applicable €15,000 annual cap. The PA penalty is €750 per transmission, with the applicable €100,000 cap. These apply separately to transaction and collection reporting. Belgium’s lack-of-capability penalties are €1,500, €3,000 and €5,000 for successive infringements. Repeat findings must follow a prior fined finding by at least three months. Those are not per-rejected-invoice tariffs. Ordinary invoice inaccuracy and delay rules can apply separately. (CGI, art. 1788 D I–V; arrêté royal belge n° 44, annex, section 2, I, C.)
The customer remains responsible for its statutory invoice and tax position. Contractual recourse should follow the proved failure and the service promised. Where Belgian law governs the new contract, non-performance is attributable through fault or an assumed legal or contractual responsibility. Fault by an auxiliary used to perform the obligation is attributable to the supplier. Recoverable damage must normally have been foreseeable in principle at contracting. The customer must take reasonable steps to prevent or limit loss, with reasonable prevention costs recoverable. (Belgian Civil Code, arts. 5.87, 5.225, 5.229 and 5.238.)
An outage alone does not establish the Belgian force-majeure defence. The default requires non-attributable impossibility, taking account of the obstacle’s unforeseeability and unavoidability. Temporary impossibility suspends performance, while permanent impossibility releases the debtor; the debtor must inform the creditor within a reasonable time. The supplier should document the cause and available precautions against the promised recovery arrangements. Claims for remedies must also satisfy the applicable notice and termination conditions. (Belgian Civil Code, arts. 5.83, 5.90, 5.226 and 5.231–5.233.)
Caps and exclusions require a separate validity assessment. Belgian law rejects exclusions for intentional fault, fault causing death or harm to physical or psychological integrity, and clauses depriving the contract of substance. Its business-contract rules also presume unfair specified gross-fault exclusions and inappropriate restrictions of remedies. An unfair clause is void. A broad exclusion for failure of the promised invoicing service can therefore defeat the intended allocation. (Belgian Civil Code, art. 5.89, as amended by loi du 22 juillet 2026, arts. 8 and 50; Code de droit économique, arts. VI.91/3, VI.91/5, 4° and 6°, and VI.91/6.)
The contracts should address prompt cure, evidence reconstruction, correction costs, service credits and termination for persistent failure. Any tax-penalty indemnity should cover only what the governing law permits. Correctly due tax remains distinct from incremental loss caused by breach. Before assuming delivery or tax-calculation responsibility, the vendor should compare its customer promise with the remedy available under the partner agreement.
The governing-law and dispute clauses must work across the customer and partner agreements. Before an EU court applying Rome I, the parties can choose the contract law, while overriding mandatory rules remain relevant. A Brazilian-law clause cannot alone remove the destination invoice duties. Matching escalation and evidence obligations reduces the risk that the vendor owes a customer a remedy it cannot pursue against its partner. (Regulation (EC) No 593/2008, arts. 3 and 9.)
Retention and migration need their own service specification
Transmission service should not be sold as a complete statutory archive unless the contract and system actually provide one. The archive specification should cover invoice content, readable access, integrity evidence, corrections and records explaining transmission and reporting. The service terms should preserve customer access during a partner dispute, suspension and planned exit. Different record classes can require different deletion dates.
FPS Finance’s current guidance states a seven-year ordinary invoice-retention period, counted from 1 January after the invoice year. It identifies 15- or 25-year periods for the relevant property-adjustment cases. Authenticity, integrity and readability must survive throughout storage. Preserving original XML is the recommended design, although the guidance permits another form if those legal qualities remain. Electronic storage abroad also requires the prescribed full online access from Belgium. (FPS Finance, Comment conserver des factures reçues, 8 April 2026; Belgian VAT Code, arts. 60–61; loi du 17 décembre 2012, arts. 36–37.)
French tax-record retention is also changing. The enacted extension replaces the ordinary six-year period with ten years for documents whose preservation period expires after 1 January 2027. Records created for this proposed launch therefore need a ten-year tax-retention design, with the applicable start date and electronic-original requirements. Special records and accounting duties need their own schedule. The PA’s restriction still governs its hosted service data where another country would otherwise be acceptable for a tax archive. (Livre des procédures fiscales, arts. L. 102 B–L. 102 C; loi n° 2026-534, art. 36; CGI, ann. II, art. 242 nonies B I 5°.)
French PA mobility has statutory mechanics. The new receiving operator obtains the formal customer agreement and follows the directory-change procedure. After the change, the former PA must continue the specified lifecycle services for one year. During that year, it must provide information it holds that is needed for continuity within five working days of the customer’s request. Free access to mobility documentation does not resolve every commercial termination charge or export entitlement. (CGI, ann. II, arts. 242 nonies E bis–E quater.)
A hosted ERP can also fall within the Data Act’s rules for data processing services offered to EU customers. The definition requires on-demand network access to shared, configurable, scalable and elastic computing resources. Those resources must be rapidly provided and released with minimal management effort or provider interaction. The provider’s establishment does not remove an EU customer offering from scope. (Regulation (EU) 2023/2854, arts. 1(3)(f) and 2(8).)
For a covered service, the written contract must support switching, continuity and export of the applicable data and digital assets. The default maximum transition is 30 calendar days after a notice period of no more than two months. The regulation permits defined extensions and requires at least 30 calendar days for subsequent retrieval. These periods should appear separately in the exit terms. (Regulation (EU) 2023/2854, arts. 23 and 25(2)(a), (d), (g), (4)–(5).)
For services subject to article 29, switching charges cannot exceed directly linked costs before 12 January 2027 and are prohibited from that date. Article 31 provides limited exceptions for qualifying individually customised services and non-production test versions; ordinary bespoke work does not create a general exemption. Standard service fees and early-termination consequences remain distinct. Software-service obligations include the applicable open interfaces and export requirements, while functional-equivalence duties differ by service category. The contract should distinguish the Data Act export, the French PA continuity package and any broader migration assistance sold. (Regulation (EU) 2023/2854, arts. 29–31 and 50.)
Security and incident duties depend on the service supplied
The software vendor needs security controls for its actual processing: restricted access, tested recovery, protected credentials, change control and records of administrative actions. These controls also make the outage allocation provable. GDPR article 32 applies a risk-based security test; French PA accreditation imposes its further documented security and infrastructure conditions. (GDPR, art. 32; CGI, ann. II, art. 242 nonies B.)
NIS2 classification turns on activity, size and jurisdiction. A cloud service can include SaaS; managed installation, operation or maintenance can constitute a managed service. Merely licensing code or buying cloud hosting does not settle the vendor’s own status. Medium and larger listed businesses ordinarily fall within the size rule, with separate criticality and designation provisions. Group relationships affect the calculation. (Directive (EU) 2022/2555, arts. 2, 6(30), 6(39) and 26, and annex I, headings 8–9.)
Belgium has enacted NIS2 legislation. A covered non-EU cloud or managed-service supplier must address its EU representative and the applicable jurisdiction. Under the Belgian regime, significant incidents trigger staged notification, including a 24-hour early warning, a 72-hour notification and the prescribed final report. These duties concern the covered entity’s service and incident, rather than every rejected invoice. (Loi belge du 26 avril 2024, arts. 3–4, 30–35 and 98.)
ANSSI describes French NIS2 transposition as pending; its working ReCyF document creates no enacted national duties. The existing French digital-service law covers defined cloud services. Its small-provider exemption requires fewer than 50 employees and annual turnover no greater than €10 million. A covered non-EU supplier serving France must designate a French representative if it has none in another Member State. Providers within French jurisdiction must apply proportionate security measures and report significant incidents to ANSSI without delay after awareness. (Loi n° 2018-133, arts. 10–13; ANSSI, current digital-service-provider FAQ and NIS2 status page.)
A downloadable ERP or connector can also engage the Cyber Resilience Act’s product rules. Integral remote processing can belong to a connected software product; a stand-alone cloud service needs its own classification. Reporting duties for covered manufacturers already apply from 11 September 2026, while the general product requirements apply from 11 December 2027. Product architecture and placement dates should therefore be reviewed before distributing a new client or connector. (Regulation (EU) 2024/2847, arts. 2–3, 14, 69(3) and 71(2).)
The incident procedure must distinguish these triggers from personal-data breaches. Under GDPR, a processor informs its controller without undue delay. The controller must notify the competent authority without undue delay and, where feasible, within 72 hours of awareness. Notification is unnecessary where the breach is unlikely to risk individuals’ rights and freedoms. A breach likely to result in a high risk to individuals’ rights and freedoms also requires the controller to notify the affected individuals without undue delay, subject to article 34(3). Brazil’s incident regulation normally gives the responsible controller three business days for qualifying notifications, subject to its conditions and applicable small-agent rules. A tax rejection alone establishes neither trigger, while an availability or integrity incident can affect personal data. (GDPR, arts. 33–34; Resolução CD/ANPD nº 15/2024, annex, arts. 4–6 and 9–10.)
Finance features require a new product boundary
The initial vendor does not hold funds, advance money or initiate payments. Invoice creation, data transmission and payment-status display can remain technical functions. PSD2 excludes specified technical support services that never possess transferred funds, but expressly keeps payment initiation and account information services outside that exclusion. A product that initiates a payment order from an account at another provider can therefore require a regulated role even without holding money. (Directive (EU) 2015/2366, arts. 3(j), 4(15) and annex I.)
Automated collection needs an exact funds and instruction map. The lender or authorised payment provider should perform the financial service under the selected arrangement. Receiving customer payments into the vendor’s account for onward payment, controlling initiation or assuming a provider’s agency role changes the assessment. Licentium’s payments and e-money licensing guide identifies the service and funds-flow questions relevant to that separate decision.
Invoice-finance referrals also require a distinction between contact introduction and participation in arranging credit. ACPR’s French guidance distinguishes a limited introduction from assisting conclusion through preparatory work or collecting supporting documents. Automated matching, credit recommendations, application handling and contractual authority must therefore be assessed before adding a finance module. The French introduction treatment cannot be assumed to resolve the Belgian arrangement. (ACPR, Je fournis des fonds à des entreprises ou à des particuliers ?, sections 4 and Indicateur d’affaires; Code monétaire et financier, arts. L. 519-1 and R. 519-1–R. 519-2, as explained there.)
Contracting and release conditions for the partner route
The vendor should contract for a defined software service and a verified provider dependency in each country. The customer terms need an exact service description, authority to act, input obligations and responsibility for tax decisions. They should identify who approves tax-code and mapping settings, who can override checks and how changes are recorded. Configuration logs can help establish whether customer input, a promised vendor validation or partner transmission caused a failure. The partner agreements should allocate mapping, validation, authentication, routing, reporting, error handling and evidence. Their incorporated technical versions, change procedures and suspension rights need to match the service sold to customers.
Before production, the parties should approve the data-flow and access design, processing agreements, subcontractor schedule and archive specification. The French stream requires evidence that Brazilian access to the PA’s hosted service data is technically prevented. Acceptance should cover both outbound and inbound invoices, rejection and correction, recovery after an outage, duplicate detection and migration. These are proposed release conditions, with test evidence to establish that the promised service can perform the required functions.
Each contract should name the owner of rule and version changes. The official PA and Peppol registers, tax notices, transfer decisions and technical release pages need monitoring. Horizon’s custom page monitoring offers monitoring of selected URLs; the responsible person must still assess each change and decide the product response.
The initial choice changes if the vendor takes over regulated transmission, obtains production network certificates, opens PA-data access from Brazil, changes storage or adds a subcontractor. A new hosted-service design, group-size change, downloadable product or financial feature can also alter the applicable duties. The release process should require a documented activity and contract decision for those changes before the feature is made available.