The security element: what it is, how to get it, what happens when it expires

People usually assume the register is the longest step towards a first fiscal receipt. It is not. A register can be configured in an afternoon. The security element is issued by the Tax Administration and requested separately: the rulebook gives the Tax Administration up to seven days from the application to generate it, and by its own account a card can usually be collected the next day. Whoever does not request it in time gets stuck exactly there.

What a security element is

Article 2 of the Law on Fiscalization defines it as "a hardware or software element containing the electronic certificate of the taxpayer", used by the fiscal receipt processor to sign receipts.

Three things in that description matter:

• It contains the taxpayer's certificate. The certificate is in your name and against your TIN, not the register manufacturer's and not your service company's.
• The processor uses it to sign. With an L-PFR the register never touches the card: the L-PFR stands between them. With a V-PFR the certificate file is installed on the device running the ESIR, and the ESIR uses it, together with the PAC, to prove to the processor that it is you; the receipt itself is signed by the processor.
• It exists to sign. The signature is what makes a receipt fiscal. Without it you have an ordinary piece of paper with prices on it.

Two forms in practice, and as a rule not interchangeable

The rulebook on the security element (article 4) lists four forms: a smart card, a smart SD card, a USB token and a protected file (for example .pfx). In its answers to frequently asked questions the Tax Administration describes two: the card and the file. Which one you need is, as a rule, decided by your choice of processor, not the other way round.

In other words: first decide whether you need only an L-PFR or also a V-PFR, then request the matching forms of the security element. If you sell from business premises, the card for an L-PFR is, as we understand article 6 paragraph 4 of the Law, needed in any case, and the file only if you also use a V-PFR alongside the L-PFR. Doing it the other way round ends in waiting for the wrong thing.

How it is requested

The request goes to the Tax Administration through the e-fiscalization portal, which you sign into with a qualified electronic certificate. The request states which sales point the security element is for, and in which form.

Before that you need two things, in this order:

1. A registered sales point. Business premises are registered with the Tax Administration before the fiscal device is first used (article 9 paragraph 1 of the Law), and only once the Tax Administration has generated the premises identifier (article 9 paragraph 4) does a place exist for the security element to be issued against.
2. A decision on the form. A card for an L-PFR, a file for a V-PFR.

One element per sales point

A security element is tied to a specific sales point, not to the company as a whole, and the Tax Administration issues one for each sales point and, within it, for each fiscal device. Three shops means at least three of them, each with its own data.

That has one practical consequence worth knowing in advance: the taxpayer name, the sales point name and the address in the fiscal part of the receipt are not typed by the register; the processor takes them from the security element, and an approved ESIR must not omit or change them (Technical guide, ESIR, item 9, П3). The premises name is written into the security element and, as the Tax Administration puts it, cannot be changed without changing the security element. If the name or the address has to change, the premises registration is changed and a new element is requested.

What happens when it expires

The certificate inside the security element has a validity period. When it expires, signing stops, and with it the issuing of fiscal receipts. There is no grace period and no way around it in the register.

So it is worth:

• writing the expiry date into a calendar the moment the element arrives, with a reminder a month before,
• checking whether your ESIR shows the expiry date and warns ahead of time,
• starting the renewal before expiry, not after.

Otkucaj, for example, shows the fingerprint and the validity date of the installed certificate in settings and warns as expiry approaches. That is not a legal obligation of an ESIR, but it is the difference between a planned renewal and a closed counter.

Test and production have different elements

The Tax Administration also runs a test environment, in which register manufacturers develop and check their products. The test environment has its own security element, and it is not for production use, nor the other way round.

The reason is obvious once said out loud: a receipt signed with a test element is, as we understand it, not a fiscal receipt, while a receipt signed with a production element is recorded by the Tax Administration in its fiscalization management system (article 8 paragraph 3 of the Law). Mixing them means either that you have been trading without fiscalization, or that you have put test receipts into real turnover.

Software that takes that split seriously keeps the two environments apart and refuses to accept the same certificate in both. That is a check worth asking any supplier for.

Who issues it and what it costs

The Tax Administration issues it, and free of charge: the Tax Administration announced this on 17 October 2022, and the rulebook on the security element sets no fee either. Using the V-PFR is also free, according to the Tax Administration. What you pay for is what you buy yourself: the card reader, the L-PFR device and the register. If any of this changes, what the Tax Administration portal says at the time is what counts.

What we can say with certainty: the security element is not part of the price of a register. If somebody offers you an "all included" package, ask explicitly whether the security element is in it, and who files for it in your name.