Technical requirements of the DeCA: PDF, QR code and download URL

Orden FOM/2861/2012 says what data the document carries. The Resolución de 5 de junio de 2026 of the Directorate-General for Road and Rail Transport says what the file and the application producing it must be like. They're two separate regulations, and meeting one without the other is worth nothing.

The file: PDF, native and under 5 MB

Three requirements, and the second is the one that rules out most home-made solutions:

• PDF format. Not JPG, not PNG, not a link to a spreadsheet.
• No larger than 5 MB. An A4 page of text with a QR code is usually around 20 KB, so the limit only becomes a problem if someone embeds photos.
• Native digital generation, transforming structured data. Scans of paper documents are not accepted.

The QR code

The PDF must include a QR code containing the document's unique web address. The purpose is obvious as soon as you picture it on the road: the inspector scans the code with their phone and gets the document straight from your repository, without depending on the driver knowing how to use an app or having the file already downloaded.

The fact that the QR code points to a unique address per document has a design consequence worth understanding if you're choosing a provider: the address can never change. A QR code already printed or already sent to the driver can't be updated. If your provider changes domain, documents issued before the change stop verifying.

The download URL

The Resolution sets four conditions for that web address:

1. 1HTTPS protocol with TLS version 1.2 or higher.
2. 2Direct access, no authentication. No one should have to log in to see the document.
3. 3Immediate PDF download, with no intermediate steps.
4. 4It may be deactivated seven days after the service ends.

The software application

The Resolution doesn't just regulate the file, it also regulates the tool. The application must collect all the data in article 6 of Orden FOM/2861/2012 for goods — or article 2 of Orden FOM/1230/2013 for passengers — and must log the date and time the electronic file was created, as well as the date and time of any later modification.

That creation log isn't a minor technical detail: it's exactly the proof article 7.1 of Orden FOM/2861/2012 requires from the contracting loader to be exempted from liability when the document isn't carried on board the vehicle.

Retention

A minimum of one year, in the issuer's own repository or the provider's. Two things worth separating here, as they're often confused: what must be kept for a year is the document, available to the Inspectorate, under article 9 of Orden FOM/2861/2012, which also allows any medium as long as the information stays intact and legible. The public URL, on the other hand, the Resolution allows deactivating seven days after the service ends.

What's no longer required

The Resolución de 5 de junio de 2026 replaces the one of 22 de mayo de 2023, and with the change the requirement to pre-register the domain where documents are stored disappeared. You no longer need to notify the Administration in advance of where you'll host them.

Checklist for choosing a provider

• Is the PDF native? Try to select the text with your mouse.
• Does the QR code point to the provider's domain, and is that domain stable?
• Are the document addresses impossible to guess, or are they sequential?
• Can you see the creation date and time on the document itself?
• What happens to your documents if you stop paying?
• Can you download your whole history if you leave?