Requirements
What the regulation requires, and how El DeCA meets it
The Resolución de 5 de junio de 2026 of the Directorate-General for Road and Rail Transport sets the characteristics of the electronic file and of the application that generates it. Point by point.
| Regulatory requirement | How El DeCA meets it |
|---|---|
| PDF format no larger than 5 MB | A one-page PDF generated with pdf-lib. It weighs around 20 KB. The generator aborts if it were ever to exceed the limit. |
| Native digital generation from structured data, not a scan | The document is drawn from the database record. The text is text: it can be selected, copied and searched. |
| QR code with the document's unique web address | QR code with level-M error correction embedded in the header, pointing to eldeca.es/d/<code>. |
| URL with HTTPS (TLS 1.2 or higher) | TLS handled at the edge, with forced redirection from HTTP to HTTPS. |
| Direct access with no authentication and immediate download | The document's page and its PDF are served with no session, outside any access control. |
| Log of creation and modification date and time | Both are stored and printed at the foot of the document itself, in Spanish mainland time. |
| All the data in article 6 of Orden FOM/2861/2012 | The form is structured by the article's eight letters and won't let you issue without the required ones. |
| Minimum one-year retention | Each document keeps its own retention date, calculated from the transport date, not the subscription date. |
The detail almost no one checks
The regulation requires the URL to allow direct access with no authentication. That's easy to meet. The hard part is meeting it without exposing every one of your clients' shipment history.
If document addresses carry a sequential number, anyone can walk through them by changing one digit and read the shipments of the provider's entire client base. El DeCA's codes are 14 characters over a 32-character alphabet, around 70 bits: enumerating other people's documents is computationally infeasible.
How long it must be kept
«Los sujetos obligados a documentar los envíos conforme a lo previsto en esta orden, deberán conservar un ejemplar o copia del documento de control, a disposición de la Inspección de Transporte Terrestre, durante al menos un año.»
It's worth not confusing this obligation with the public URL's lifespan. The Resolution allows deactivating the web address seven days after the service ends; what must be kept for a year is the document, and article 9.2 admits any medium as long as the information stays intact and legible.
We keep URLs active for the whole retention period even though the regulation doesn't require it, because a QR code that stops working generates a call from a worried client and barely saves us any cost.