VAT in the Digital Age

What ViDA actually asks

ViDA reforms the EU VAT Directive. From 1 July 2030, cross-border intra-EU B2B invoices must be issued as structured e-invoices in the EN 16931 format, with the transaction data reported to the national tax authority close to the moment of issuance. Reporting is decentralised by design, and there is no single EU endpoint. Each of the 27 member states operates its own portal or interface, and a business reports to its own authority. Since the directive entered into force, member states may also mandate domestic e-invoicing without first obtaining an EU derogation.

Across the Union that adds up to billions of structured invoices each year, each carrying line-level detail, and each retained for the statutory periods that VAT law already requires, which run to years. The European Commission put the EU VAT gap at €128 billion for 2023. Closing that gap is the stated purpose of the reform, and real-time digital reporting is the instrument.

Those are the facts of the mandate. What they leave open is where the data lives once it has been reported, and who can read it.

Three gaps in centralised reporting

When digital reporting is built as a central collection of invoice data, three gaps tend to appear in the architecture. Each is a design choice rather than a requirement of the law.

Content disclosure as the default. A reporting system that collects full invoice descriptions in order to check VAT does so on a pre-cryptographic assumption. The correctness of a VAT calculation, the right rate on the right amount, can be proven without handing over the description of what was sold.

Identity that is not cryptographically bound. A message on a transport network has a sender at the network level, not a non-repudiable identity at the level of the message itself. Where that binding is missing, patterns such as carousel fraud become visible only in aggregate, after the fact, at the centre. The identity layer ViDA leaves open is being filled elsewhere in EU law: under eIDAS 2 (Regulation (EU) 2024/1183), every member state must offer at least one European Digital Identity Wallet by the end of 2026, which makes attributable, signed transactions possible.

Long retention as an architecture choice. Holding large volumes of invoice records for years, in one place, is a decision about architecture. It widens the window in which the data can be misused, and it does so independently of the compliance goal it is meant to serve.

Comply with the mandate, not an alternative to it

This is a way to meet ViDA, not a way around it. The reporting obligation is satisfied in full. The structured invoice is issued, the data reaches the national authority, and what was reported can be shown at any later date. The difference is only in where the data rests afterwards. It stays at the source, with the business that created it, rather than in a copy held somewhere else for years.

The architecture choices are being made now. What gets built to meet the 2030 deadline becomes the architecture everyone lives with afterwards. Choosing deliberately, while there is time, is the difference between compliance that proves what happened and compliance that quietly accumulates a second copy of everyone's commercial life.

Evidence does not have to mean exposure. From more data after the fact to more certainty up front.