Why Digital Signatures Are Mandatory
A tax invoice is a legal document. Once electronic, it must answer three questions reliably:
- Who issued it? (Authenticity)
- Has it changed since it was issued? (Integrity)
- Can the issuer credibly deny issuing it? (Non-repudiation)
A digital signature answers all three. Under the UAE e-invoicing framework set by Ministerial Decisions 243 and 244 of 2025, every PINT AE invoice exchanged through the Peppol network must be digitally signed. Unsigned electronic invoices are not valid tax invoices.
What a Digital Signature Actually Is
A digital signature is a cryptographic operation that binds a document to a signing certificate. In practice:
- The signer computes a hash of the invoice XML - a short fingerprint that changes if any character of the invoice changes.
- The signer encrypts that hash using their private key. The encrypted result is the signature.
- Anyone who has the signer's public certificate can decrypt the signature, recompute the hash from the invoice, and confirm they match - which proves the invoice has not changed and was signed by the holder of that certificate.
For PINT AE, the signature is embedded inside the XML document itself using XAdES (XML Advanced Electronic Signatures), the European standard for signed XML documents.
Who Applies the Signature?
Under the UAE 4-corner model, the signature is applied by the supplier's Accredited Service Provider (ASP) on behalf of the supplier. Three implications:
- You do not need to manage signing certificates yourself.
- Your ASP must hold a valid certificate issued by an approved certificate authority.
- The chain of custody runs from your ERP -> the ASP -> the Peppol network. The ASP's signature attests that the invoice originated from you, was correctly transformed to PINT AE, and has not been altered since.
What the Customer's ASP Verifies
When the customer's ASP receives the document, it verifies the signature before delivering it into the customer's AP system. The checks include:
- Signature is mathematically valid and the document has not been tampered with
- Signing certificate has not expired
- Signing certificate has not been revoked (typically checked via OCSP or CRL)
- Certificate chain leads to a trusted certificate authority
- Signature timestamp is within the certificate validity window
If any check fails, the invoice is rejected and an error is returned to the supplier's ASP. The customer never sees an unverified document.
Timestamps Matter
A signature without a timestamp leaves a question: was it signed at the time claimed in the invoice? PINT AE signatures use a trusted timestamp to anchor the signing moment, so the invoice can be reliably verified months or years later - including after the signing certificate has expired naturally.
What About PDF Invoices?
A signed PDF is not a valid tax invoice under the UAE mandate. The mandate requires structured XML in PINT AE format, signed using XAdES inside the XML. Even a PDF that is digitally signed using a qualified certificate does not satisfy the requirement, because the underlying document is not machine-readable to PINT AE rules.
A PDF can still be useful as a human-readable companion to the structured invoice - but it cannot replace it.
Audit and Archive
The signed PINT AE XML is the document of record. You must archive it - not the PDF, not a screenshot, not a print. The archive must preserve the signature so that a future audit can re-verify it. Your ASP typically provides this archive, but you should confirm:
- Retention period meets FTA requirements
- Documents are stored in the original signed XML form
- You can export the archive in bulk if you ever switch providers
- Verification of historical signatures is supported even after the original certificate has expired
What You Need to Do
- Confirm your chosen ASP holds an acceptable signing certificate.
- Verify the ASP applies XAdES signatures with a trusted timestamp.
- Confirm the customer-side ASP performs full signature verification, not just receipt.
- Agree on archive scope and retention with your ASP in writing.
- Plan for signature verification during FTA audits - your ASP should be able to produce a verified copy of any invoice on demand.
How InvoiceNet Handles Signatures
InvoiceNet applies XAdES digital signatures with trusted timestamps to every PINT AE invoice we send on your behalf. We verify every inbound invoice the same way. Signed XML documents are archived for the full FTA-required retention period and can be re-verified at any time. Talk to us about audit-ready archive options.