Online Invoicing: How It Works, What It Costs, and Where It's Now Mandatory

"Online invoicing" means two quite different things depending on who is saying it, and conflating them is how businesses end up surprised by a compliance deadline.

To most freelancers and small businesses, it means: I make the invoice on a computer and email it. That is the everyday sense, and for the majority of trade in the US and UK it is entirely sufficient.

To a tax authority, it means something much narrower: a structured, machine-readable invoice exchanged in a defined format, often through a government-operated or government-approved channel, sometimes cleared in real time before it is considered valid. That is e-invoicing, and in a growing list of countries it is not optional.

This guide covers both — how ordinary online invoicing works, what it genuinely costs, where the security risks actually are, and which mandates exist so you know whether any of them apply to you.

The everyday sense: sending invoices electronically#

The PDF-by-email model#

Still the default across most of the English-speaking world, and there is nothing wrong with it.

You create the invoice, export a PDF, and email it. The PDF matters: it renders identically everywhere, cannot be casually altered after it leaves you, and is what accounts-payable systems expect. An editable Word or Excel file signals that the numbers remain negotiable, and some finance teams reject one outright.

Is it legal? Yes, for ordinary trade in the US and UK. Neither requires paper. One caveat worth knowing in the EU and UK: an invoice sent electronically must be accepted by the recipient, and you must be able to guarantee the authenticity of its origin and the integrity of its content for the retention period. In practice, for a small business, keeping your own copies in a folder you control satisfies that.

The hosted-invoice model#

Instead of attaching a document, you send a link. The client opens a page showing the invoice and a Pay button.

The advantage is real: it removes steps between reading the invoice and paying it. For consumer-facing work — a tradesperson billing a homeowner, a photographer billing a couple — that friction reduction is worth more than anything else on this list.

The costs are also real: the payment is processed by the platform, which takes a percentage. And the invoice now lives on someone else's server, which matters if that account ever lapses. Always keep your own PDF copy regardless of how you sent it.

The accounts-payable-portal model#

Larger organisations often refuse both. They require you to register as a vendor in their procurement system and submit invoices through a portal.

This is tedious and non-negotiable. Two things make it survivable: get your vendor record created before you do the work rather than after, and find out at the same time whether a purchase order number is required. An invoice submitted without a matching PO does not get rejected — it fails to match, and nobody tells you.

What e-invoicing actually means#

Now the regulatory sense, which is where the confusion causes real problems.

A PDF is an image of an invoice. It is laid out for a human eye. Extracting the numbers requires either a person or optical character recognition, and OCR guesses.

An e-invoice is structured data. The fields are labelled — supplier VAT number here, net amount there, tax rate on each line — so a machine reads it without interpretation. It might be XML or a hybrid file that carries both a human-readable PDF and embedded structured data.

The formats you will encounter:

• EN 16931 — the European standard defining the semantic model. Not a file format itself; the thing national formats conform to.
• UBL and UN/CEFACT CII — the two syntaxes EN 16931 is expressed in.
• Factur-X / ZUGFeRD — a hybrid: a normal PDF with XML embedded inside it. A person sees an invoice; a machine reads the data. Popular precisely because it does not force the recipient to change how they work.
• XRechnung — the German public-sector implementation of EN 16931.
• Peppol BIS — the specification used across the Peppol network, which is the delivery infrastructure much of Europe and a growing number of other countries use.

Why governments want this: VAT and GST fraud. When invoices are structured and reported to a tax authority, mismatches between what a seller declared and what a buyer claimed become visible immediately rather than years later during an audit. The EU's estimated VAT gap has been the driving argument for a decade.

Where e-invoicing is mandatory#

This area changes constantly — deadlines have been postponed in several countries, more than once. Treat the following as a map of what exists, and verify the current schedule with the relevant tax authority before acting.

Italy was first in Europe with a broad mandate: all domestic B2B and B2C invoicing runs through the Sistema di Interscambio, and has since 2019.

Germany requires all domestic businesses to be able to receive structured e-invoices for B2B transactions from the start of 2025, with the obligation to issue them phasing in over the following years by company size.

France has a phased mandate covering both receiving and issuing, which has been rescheduled more than once. Check the current timetable rather than any date you read in an article.

Poland operates the KSeF national system, with mandatory use phased in by taxpayer size.

Spain, Belgium, Romania and others are at various stages of their own rollouts.

Across the EU, the VAT in the Digital Age (ViDA) package sets the longer-term direction: digital reporting requirements and e-invoicing for intra-EU business-to-business transactions, with the main obligations landing around the end of the decade. Member states may move earlier domestically, and several have.

Outside Europe: India requires e-invoicing under GST above a turnover threshold that has been progressively lowered. Saudi Arabia's ZATCA system phased in generation and then integration requirements by taxpayer wave. Several Latin American countries — Brazil, Mexico, Chile — have run mandatory clearance models for far longer than Europe has.

United Kingdom: no B2B mandate. Public sector bodies must be able to receive e-invoices under the Public Procurement (Electronic Invoices etc.) Regulations 2019. Separately, Making Tax Digital already requires VAT-registered businesses to keep digital records and file through compatible software — which is a digital reporting obligation rather than an e-invoicing one, but points in the same direction. Government has consulted on going further.

United States: no federal mandate. The Business Payments Coalition, working with the Federal Reserve, has established a voluntary e-invoice exchange framework — infrastructure that exists if you want it, rather than a rule.

Does any of this apply to you?#

For most readers of this site, right now: no. If you are a freelancer or small business invoicing clients in the US or UK, a PDF by email remains entirely correct.

It becomes your problem when:

• You invoice a business established in a country with a domestic mandate, and the transaction falls within its scope
• You sell into the EU and the ViDA reporting requirements reach your transaction type
• You supply a public sector body, in which case e-invoicing capability may already be expected
• Your client simply requires it commercially, mandate or not — large buyers increasingly do

The practical move if you think you are approaching any of these: ask your largest clients what format they will need and by when. They will know, because it lands on their systems first.

How the delivery network actually works#

If you do end up in scope for structured e-invoicing, the piece that confuses people most is not the file format — it is how the file gets from you to your customer. There are two models, and knowing which one a country uses tells you most of what you need.

The four-corner model#

This is what Peppol uses, and it is the dominant approach across most of Europe outside Italy.

1. You send your invoice to your access point — a service provider you have an account with.
2. Your access point converts it to the agreed format and hands it to your customer's access point.
3. Their access point delivers it into their accounting system.
4. Neither of you needs to know what software the other uses.

The analogy that makes it click is email. You do not need an account with your recipient's mail provider; you both connect to a network that agrees on how messages travel. Peppol works the same way, with access points playing the role of mail servers and a central directory handling addressing.

Practically, this means you do not integrate with each customer individually. You connect once to one access point, and you can reach anyone else on the network. Most accounting platforms either operate as an access point or resell one, so for a small business this often amounts to switching a setting on rather than a project.

The clearance model#

Italy, and most of Latin America, work differently. The invoice goes to a government platform first, which validates it, assigns it an identifier, and only then passes it to the customer. An invoice that has not been cleared is not a valid invoice for tax purposes.

This gives the tax authority a complete real-time picture, which is the point. It also means downtime on the government platform is everyone's problem, and that the rules about what makes an invoice valid are considerably less forgiving.

Some countries are moving toward hybrids — a five-corner model where the invoice travels over a Peppol-style network while a report of it goes to the tax authority in parallel. France's design works broadly this way.

What this means if you are small#

Almost certainly nothing yet. But if a large European customer tells you they need e-invoices, the useful questions are: which network, which format, and do they have an access point they would prefer you to use. Their finance team deals with this daily and will usually just tell you.

What online invoicing costs#

Sending is cheap or free. Collecting is where the money goes.

Two things people consistently underestimate.

The FX margin. On international payments, the currency conversion spread is frequently larger than the advertised transfer fee and much less visible. If you invoice across currencies regularly, comparing the effective rate you receive — not the headline fee — is worth an afternoon.

Card fees compound quietly. At 2.9%, £48,000 of card-paid invoices costs about £1,400 a year. That is several times a typical software subscription. Whether that is worth paying depends entirely on whether card payment gets you paid meaningfully faster.

Security: the risk is not where people think#

The invoice document is rarely the attack surface. Invoice fraud is, and it is one of the most effective frauds operating against small businesses.

The mechanism is simple. An attacker gains access to an email account — yours or your client's — or spoofs a convincing lookalike domain. They intercept a genuine invoice, change the bank details, and forward it on. Everything else about the document is correct, because it is your document. The client pays the wrong account, and by the time anyone notices, the money has moved on.

Defences that work, in rough order of value:

• Confirm bank details by voice, on a number you already had. Never a number printed on the invoice or in the email. This single habit defeats most of these attacks.
• Never change bank details by email alone. Tell clients up front that your details will never change by email, and that any such message is fraudulent. Put it on your invoices.
• Turn on multi-factor authentication for the mailbox invoices are sent from. Compromised email is the usual entry point.
• Watch for lookalike domains. talentrasoIutions.com with a capital I instead of an l is invisible in most typefaces.
• Ask clients to confirm receipt of a first invoice. It establishes a channel and surfaces interception early.
• Be sceptical of urgency. "Pay today, our old account has been frozen" is the standard script.

Technical measures help — SPF, DKIM and DMARC on your sending domain make spoofing harder, and are worth setting up if you control your DNS — but the procedural rule about phone-confirming bank details is what actually stops the loss.

What changes for you, by size#

The honest answer to "should I care about any of this" depends almost entirely on how big you are and who you sell to.

Sole trader or freelancer, domestic clients. Nothing changes. PDF by email, keep your copies, keep a register. Revisit only if a client asks.

Small business selling to other businesses domestically. Watch what your largest customers do. Big buyers adopt structured invoicing ahead of any mandate because it saves them processing cost, and they tend to push it down their supply chain. The request will come from a customer long before it comes from a tax authority.

Anyone selling into the EU. This is where to pay attention. Domestic mandates in Italy, Germany, France, Poland and others already bite on transactions within those countries, and the EU-wide reporting requirements are coming for cross-border B2B. If a meaningful share of your revenue is European business customers, ask your accountant this year rather than the year it lands.

Anyone supplying a public sector body. Check now. Public procurement has required e-invoicing capability in the UK and across the EU for years, and it is usually written into the contract rather than announced.

VAT or GST registered anywhere. Digital record-keeping obligations are the near-term reality, separately from e-invoicing. In the UK, Making Tax Digital already requires digital records and compatible filing software.

The pattern across every country that has done this is the same: it starts with the public sector, then large businesses, then everyone. Being at the end of that queue is a perfectly reasonable place to be — you just want to know the queue exists.

Record keeping does not change because it is electronic#

An electronic invoice is still a record with the same retention obligations.

• United States: the IRS ties retention to the period of limitations — generally three years, extending to six where income is under-reported by more than 25%, with no limit for unfiled or fraudulent returns.
• United Kingdom: five years after the 31 January filing deadline for sole traders and partnerships; six years from the end of the accounting period for limited companies; six years for VAT records.

For EU and UK VAT purposes you must also be able to demonstrate the authenticity of origin and integrity of content of stored invoices for that whole period.

The practical version: keep your own PDF of every invoice you issue, in a folder you back up, in a format you can still open in seven years. A copy that exists only inside a platform you stopped paying for is not a record. This is the most common record-keeping failure we see, and it is entirely avoidable.

Getting started sensibly#

If you are moving from paper or from a Word template:

1. Start with PDFs by email. It is correct, universally accepted, and costs nothing.
2. Keep a register — one spreadsheet: number, client, issue date, amount, due date, date paid. This answers "who owes me money" in a glance and is your income summary at year end.
3. Ask each new client two questions: where should invoices be sent, and is a purchase order required. Two minutes, saved repeatedly.
4. Decide how payment arrives. If your clients are businesses, bank transfer and no fees. If they are consumers, a payment link probably earns its percentage.
5. Set the fraud rule now, before it matters: bank details are confirmed by phone, never changed by email.
6. Revisit structured e-invoicing only when a client or a rule requires it. Adopting it speculatively is work with no return.

---

Our free invoice generator produces a clean PDF invoice in your browser — no account, no upload, and the document is yours to send however you like.

Related reading: create an invoice online, free invoice software for small businesses, what should be included in a US invoice, and the best invoice format for UK freelancers.

E-invoicing mandates and their timetables change frequently, and several have been postponed. This guide describes the landscape as at the review date and is general information, not legal or tax advice — confirm the current position with the relevant tax authority or your accountant. See our disclaimer.