risk-nexus/findings/RISK-F-0012-e-invoice-receipt-and-retention.md

id	type	title	status	owner	reported_by	reported_via	routed_by	date_reported	date_filed	source_policy	system	environment	fix_owner	fix_owner_assigned_by	fix_tracking	closure_condition	severity	severity_at_production	impact	likelihood	fidelity_modifier	production_rescore	disclosure	escalation	last_checked	next_check	cadence	clean_streak	waiting_on	graded_by	ruling	checked_by
RISK-F-0012	finding	The estate cannot show it receives and retains EN 16931 e-invoices	open	risk-nexus	risk-nexus	risk-nexus	risk-nexus	2026-09-22	2026-09-22	RISK-POL-0012	qonto-assistant	production	qonto-assistant	founder, 2026-09-22 — e-invoice capability is provided by Qonto and qonto-assistant is the estate's bridge to it	unset — workplan requested from qonto-assistant 2026-09-22	one real EN 16931 invoice received through the Qonto lane, its structured original (XML or ZUGFeRD PDF/A-3) archived unaltered in estate custody under the RISK-POL-0009 voucher schedule, and retrieved from that archive	medium	medium	I2	L3	false	false	public	none	2026-09-22T08:00:00Z	2026-09-22T08:00:00Z	instant	0	who what since would_change default default_at qonto-assistant a workplan that establishes the e-invoice receiving and retention path through Qonto and names the measures below, with fix_tracking this register can read 2026-09-22 fix_tracking is set and the finding is tracked on the owner's own workplan state the medium grade stands; the absence of a workplan is recorded as a stalled remediation and escalation trigger 5 is assessed 2026-10-06	risk-nexus	RISK-RULING-2026-09-22-B	claude-code/risk-nexus

RISK-F-0012 — the estate cannot show it receives and retains EN 16931 e-invoices

What is true

Since 2025-01-01 a German business must be able to receive a structured electronic invoice for domestic B2B transactions (RISK-POL-0012). The received invoice is an accounting voucher: it must be kept for eight years in the form in which it was received (RISK-POL-0009, §147 AO, §14 UStG). A rendered PDF of an XRechnung is not the invoice.

The policy record has said since 2026-08-20 that this duty is live and has no named owner in the estate. The 2026-09-22 review found that still true. A duty reviewed on a cadence with no owner and no grade can stay open indefinitely, so this finding moves it onto the findings track.

Not established, in either direction:

• whether the Qonto account already accepts structured invoices, and in which formats;
• whether any structured invoice has already been received, and what happened to its XML;
• whether qonto-assistant can retrieve the structured original through the Qonto API rather than only a rendering;
• where the original is kept, by whom, and for how long. Qonto's own document retention is a provider's commitment, not estate custody, until someone decides to rely on it and records that decision.

How it was found

A regulatory review by the register: RISK-POL-0012, reviewed 2026-09-22. No system was probed and no Qonto data was read.

Register ruling — 2026-09-22 (RISK-RULING-2026-09-22-B)

medium (I2 × L3), public, no escalation.

I2: one system's records, recoverable. If a structured invoice is lost or kept only as a rendering, one class of voucher fails its retention duty. That exposes the business to a tax-audit objection and to a challenge to the input-VAT deduction on that invoice. It is confined to the bookkeeping records and can usually be recovered by asking the supplier to re-issue. No data crosses a boundary and no recovery is removed for a system, so this is not I3.

L3: expected in the normal course. Suppliers are now entitled to send structured invoices and increasingly do. Nothing in the estate has to go wrong for this to happen: an ordinary supplier invoice arriving is enough. It is not graded L4 because receipt of a structured invoice is not on record.

Public. Describing a compliance gap in invoice handling does not shorten any attack path. Publication handover is not requested until the finding has an owner workplan, so that the published page can say what is being done.

No escalation. The founder assigned the owner on 2026-09-22, so trigger 4 (unowned) is answered before it fires. Everything else is below the triggers.

Issuing is not graded here. The duty to issue e-invoices phases in on 2027-01-01 (prior-year turnover above EUR 800,000) or 2028-01-01. Those dates are still unconfirmed in RISK-POL-0012. It becomes part of this finding, or a separate one, once qonto-assistant says whether Qonto also covers issuing.

Suggested measures

These are suggestions. qonto-assistant owns the measures and their order.

1. Establish the provider lane. Find out whether Qonto's e-invoice receiving is active for the account, which formats it accepts (XRechnung UBL/CII, ZUGFeRD/Factur-X), and whether the API returns the structured original.
2. Take the original into custody. Fetch the XML (or the PDF/A-3 with its embedded XML) unaltered, record its hash, and archive it under estate control. Alternatively, record an explicit decision to rely on Qonto's retention, with its term and what happens if the account closes.
3. Retention and expiry. Keep it eight years from the end of the calendar year of receipt, retrievable and not rewritable, with deliberate deletion at expiry (RISK-POL-0009, RISK-POL-0002).
4. Demonstrate. Receive one real structured invoice end to end and retrieve it from the archive. This is the closure condition.
5. Say what already happened. If structured invoices have already arrived, say where their originals are now.

Re-evaluation

The register re-grades this finding when:

• the workplan exists (tracking only, grade unchanged);
• measure 1 answers whether invoices have already been received. Receipt with the original lost would make the likelihood L4 and the grade high;
• the closure condition is met, and the finding becomes fixed.

Reviews

• 2026-09-22 — filed and graded from the RISK-POL-0012 review. Owner assigned by the founder; workplan requested from qonto-assistant. Cadence starts at instant.