What Is the DeCA: Requirements, How to Comply, and the Signature

As of October 5, 2026, paper documents are no longer valid for tracking the transport of goods by road in Spain. The DeCA (Electronic Administrative Control Document) has gone from being a new regulatory requirement to a daily obligation for shippers, carriers, logistics operators, and drivers, and the first few weeks of implementation have shown that improvising comes at a high cost.

In this article, we explain what the DeCA is, the technical requirements set forth in the Resolution of June 5, 2026, who issues it, when it needs to be signed, and what penalties result from non-compliance. Additionally, we’ll show you how to set up an issuance and signing workflow that doesn’t create friction for anyone—not even the driver waiting at the loading dock.

What Is the DeCA: Electronic Administrative Control Document

The DeCA is the digital version of the control document that must accompany every public road freight transport within Spain. It is a PDF generated from structured data, featuring a QR code that allows inspectors to download it instantly. Its legal basis is Order FOM/2861/2012, Law 9/2025 of December 3 on Sustainable Mobility, and the Resolution of June 5, 2026, issued by the General Directorate of Road and Rail Transport.

In practical terms, the Electronic Administrative Control Document is digital proof of who contracts the transport, who performs it, what goods are being moved, and between which points. It affects the entire supply chain:

• Contractual shippers: those who contract the transportation, including logistics operators, freight forwarders, and agencies.
• Actual carriers: the holders of the authorization under which the service is physically performed.
• Drivers: They must carry it on board and present it (or simply show its QR code) during an inspection.

This requirement takes effect on October 5, 2026, for domestic transport and cabotage within Spanish territory. International transport is excluded, as it is governed by the documents of international agreements. According to a study by the Spanish Logistics Center and Fieldeas, presented on October 6, 2026, 61.54% of companies had already begun their document digitization project three months before the deadline.

Technical Requirements for the DeCA: Native PDF, QR Code, and Archiving

The Resolution of June 5, 2026, does not merely require the transition to a digital format; it also defines in detail the document’s format, the software used to issue it, and how it is accessed. The goal is to enable law enforcement officers to immediately verify the document on the road without technical complications, ensuring that the content cannot be tampered with without leaving a trace. To this end, every DeCA must meet the following requirements:

• Native digital PDF. It is generated by converting structured data from a computer application into readable text. Scans of paper documents or photographs are not valid.
• Less than 5 MB and with metadata. The file cannot exceed 5 MB, and the date and time of creation and modification must be included as metadata in the PDF.
• QR code embedded within the PDF itself. The QR code contains the document’s unique URL and may also be provided as a separate file.
• Unique, secure, direct-download URL. It must use HTTPS with TLS 1.2 or higher; it cannot require credentials or include screens with buttons; and it cannot expire before the service ends. Seven calendar days after the end of the transport, the download may be deactivated.
• Generation prior to the service. The file must be created as soon as the data is known and always before the actual start of the trip; the app records the date and time of creation.
• Copy for the driver. It is provided to the driver before departure, either on a mobile device or in print, and must always include the QR code. Handwritten notes on a printed copy are not valid.
• Retention for one year. The contracting shipper and the actual carrier must be able to access the file for at least twelve months, each in their own repository or in a shared one.

In the event of any changes to the data en route, the Resolution offers two solutions. The first is to edit the current file, adding the new information (along with the reason) and striking through the old information; this allows the original PDF, QR code, and URL to be retained. The second alternative is to issue a new electronic document with a different QR code and link, which requires retaining the initial PDF for traceability. Regardless of the option chosen, the driver must always receive the most recent version. Additionally, the regulation authorizes grouping multiple shipments into a single DeCA (Administrative Control Document) if the shipper and the carrier are the same, while always ensuring the individual identification of each item of cargo.

What information must the DeCA contain?

The DeCA can be freely formatted: there is no official template, but there are minimum content requirements. It must include, at a minimum, the essential information specified in Order FOM/2861/2012:

1. Contractual shipper: name or business name, tax ID number (NIF), and address.
2. Actual carrier: name or business name and tax ID number.
3. Origin and destination of the shipment.
4. Nature and weight of the goods transported.
5. Date of service and vehicle license plate numbers.
6. Special operating permit, if the vehicle is operating under one.

A very common mistake when issuing the document is failing to clearly distinguish between the parties involved. The regulations require that the contractual shipper and the actual carrier be explicitly and separately identified. Special care must be taken with subcontracting chains, since the subcontracting company becomes, for legal purposes, the contractual shipper for the next link in the chain. Finally, before designing your final templates, we recommend that you always verify these requirements in the Official State Gazette (BOE) (by reviewing the relevant Resolution and the consolidated text of Order FOM/2861/2012), as they constitute the definitive official reference in the event of any updates.

Processes and Tools for Signing the DeCA

Compliance with the DeCA does not simply involve generating a single PDF file, but rather orchestrating a complete process involving several companies and a driver on the road. That process begins in the shipper’s management system, passes through the carrier, and ends at an agent’s checkpoint, and each step requires reliable technology. When the document also includes signatures, a layer of trust is needed to guarantee who signs, what is signed, and when—without requiring anyone to print, scan, or install anything. The complete process, from issuance to delivery, is as follows:

1. Data capture. The TMS or ERP gathers data on the shipment, the shipper, and the carrier.
2. Generation of the native PDF. The application creates the file with its QR code, unique URL, and metadata before the vehicle departs.
3. Identity and signature validation, if applicable. If the document also serves as a contract, the parties sign it using an advanced or qualified electronic signature.
4. Delivery to the driver. The driver receives the DeCA on their cell phone, with the QR code readily available for any inspection.
5. Storage and traceability. The file and its supporting evidence are securely stored, with a record of any modifications.

The key is that this workflow must be seamless for those carrying it out. If each participant needs a separate account, app, or registration, the system grinds to a halt at the loading dock.

The Electronic Signature on the Electronic Administrative Control Document

A signature is not required for the DeCA to be valid as a control document, but an advanced or qualified electronic signature is required when the document is used for contractual purposes—for example, when it is combined with a bill of lading or other transport documents. This is the answer provided by the Resolution of June 5, 2026, itself, because neither Order FOM/2861/2012 nor the associated regulations require a signature for the control document itself. This is also confirmed in the Ministry of Transportation’s FAQ section.

The confusion arises from the fact that three documents with different functions are being conflated:

• DeCA: administrative control document. Its function is inspection, not the contract.
• Waybill: a contractual document for domestic transport. It serves as proof of the contract and is usually signed.
• eCMR: electronic version of the international consignment note under the CMR Convention. It is signed electronically and does not replace the DeCA for domestic transport.
• eFTI: Regulation (EU) 2020/1056. If data is managed under this framework, it is not necessary to submit the DeCA in the format specified by the Resolution.

To simplify bureaucracy, the Resolution allows other transport documents to legally serve as a DeCA. Thus, documents such as a waybill, ADR documentation, the waste transport document (DI), or the SANDACH document can fulfill this function. The only condition for a single document to serve multiple purposes simultaneously is that it must include all the mandatory data required by the DeCA and comply with its non-negotiable technical requirements.

What type of electronic signature is required for the bill of lading?

When the DeCA includes signatures for contractual purposes, the Resolution requires, at a minimum, the advanced electronic signature under Regulation (EU) No. 910/2014, known as eIDAS, and also accepts the qualified electronic signature.

The Regulation distinguishes three levels of signatures with varying evidentiary value. A simple signature is any electronic data that the signer uses to sign: a check mark, a written name, or a stroke on a screen. It is easy to use, but also easy to challenge, because it does not, on its own, guarantee who signed or that the document has not been altered. An advanced signature, on the other hand, must be uniquely linked to the signer, allow for the signer’s identification, be created using data under the signer’s exclusive control, and detect any subsequent changes to the document. A qualified signature adds a qualified certificate issued by a trusted service provider and a qualified signature creation device, and has legal effect equivalent to that of a handwritten signature throughout the European Union. In the transportation sector, where signers are on the move and evidence matters, the advanced signature is often the ideal balance.

That’s why a scribble on a mobile screen, without associated evidence, isn’t enough. Without identification of the signer, without document integrity, and without a timestamp, that signature remains a simple one and does not meet the requirements of the Resolution.

The good news is that upgrading doesn’t have to complicate the process. With the right technology, the driver can sign from their phone in seconds, and the platform generates the supporting evidence behind the scenes.

Who Issues and Who Signs the DeCA

Issuing the DeCA is a shared responsibility. Order FOM/2861/2012 establishes that both the contractual shipper and the actual carrier are responsible for formalizing the document, and that each is accountable for specific data. The regulation does not specify which of the two must physically generate it, so in practice, this is a matter best agreed upon. If one party generates it, it is sufficient for the other to be able to download it for one year, but both remain liable if it does not exist.

The driver, for his part, does not issue the DeCA: he receives it. He must carry it on board—either on his cell phone or in printed form—always with the QR code visible, and present it during an inspection. If the officer requests it, it is sufficient to present the document with its QR code or, failing that, just the QR code. This point is crucial, because some platforms have shifted tasks such as registering, photographing the delivery receipt, or validating data onto the driver—a burden that the industry has denounced and that the regulation does not assign to the driver.

For the system to work, it is recommended to specify in the contract who generates the document, who retains it, and how changes are communicated. A clear division of responsibilities prevents duplication, clarifies each party’s obligations, and allows for verification—in case of doubt—that the DeCA existed before the vehicle departed.

Penalties and Risks

Failure to have a valid Electronic Administrative Control Document (DeCA) has legal, financial, and commercial consequences. The absence of the control document or the lack of essential data in it constitutes a serious violation of Article 141.17 of the Land Transportation Regulation Act (LOTT), punishable by fines ranging from 401 to 600 euros. And since the shipper and carrier share the obligation to issue the document, both may be penalized independently. The most common risks are:

1. Scanned document. A PDF obtained from a paper document or a photo is not a native digital DeCA and is equivalent to not having one.
2. A link that does not download directly. A URL containing a login, buttons, or intermediate screens violates the Resolution, even if the document exists.
3. Missing essential data. A DeCA without a tax ID number, weight, or license plate number is considered incomplete.
4. Incorrect modifications. Hand-crossing out a printed copy is not sufficient: you must update the file or generate a new one.
5. Falsification. Altering the data in a control document is classified as a very serious violation under Article 140.9 of the LOTT.

Beyond the fine, the real risk is operational: a vehicle immobilized on the road, a customer who does not receive their goods on time, and reputational damage. That is why it is advisable to treat the DeCA as part of service quality: accurate data from the source, tested links, and a clear protocol for the driver in the event of a checkpoint.

Software and Better Tools for Issuing and Signing the DeCA

To comply with the DeCA, two layers are required: a system that generates the native PDF with a QR code and URL (typically your TMS, your ERP, or specialized software) and a digital trust layer that guarantees the identity of the signer, the integrity of the document, and its safekeeping. Tecalis provides that second layer, which is what gives the signatures legal validity without adding friction to the workflow:

• Advanced and qualified electronic signatures with time stamping and audit trails, in compliance with the eIDAS Regulation. Tecalis is a qualified trust service provider recognized by the European Union.
• Identity verification (KYC) of the signer, including ID document verification and facial recognition.
• Digital onboarding of carriers, subcontractors, and drivers, allowing for one-time registration and reuse of their verified identity.
• API integration with TMS and ERP systems, so that the DeCA can be signed and stored without leaving your usual system.
• Recording of evidence and traceability for each signature, useful for inspections, claims, and audits.

Here’s how these elements work together to issue, sign, and store the DeCA: your TMS generates the PDF with its QR code and sends it to Tecalis via API; the signer receives a link on their cell phone, verifies their identity if necessary, and signs in seconds—without installing any apps; the platform stamps the document with the date and time, adds the evidence, and returns the signed file to your repository, where the URL and the signed document remain available for the required period. The driver doesn’t have to create accounts or learn new tools, and the company retains a complete record of evidence.