Why the technical requirements matter
The DeCA (Documento electrónico de Control Administrativo, Spain's electronic administrative control document) is not just any PDF. The Resolución de 5 de junio de 2026 of the Dirección General de Transporte por Carretera y Ferrocarril (Directorate-General for Road and Rail Transport; BOE-A-2026-12784, published in the BOE, Spain's Official State Gazette, on 12 June 2026) defines very specific requirements for format, size, QR code, metadata and retention. If your document does not meet them, it will not be valid at a roadside check.
The data content is still that of the control document under Orden FOM/2861/2012 (Ministerial Order FOM/2861/2012, Article 6): what changes is the technical wrapper. The obligation, remember, has applied since 5 October 2026 under the eighth transitional provision (disposición transitoria octava) of Ley 9/2025 (Spain's Sustainable Mobility Act). That is why it is worth checking today, requirement by requirement, whether the tool you use — or are considering — complies.
The DeCA applies to domestic transport (origin and destination in Spain). International transport using documents under international conventions is excluded.
The DeCA technical checklist
This table sums up what the rules require and a practical way to check it in any software before you sign up for it or accept it:
| Requirement | What the rules require | How to check it in your software |
|---|---|---|
| Native PDF format | Natively digital PDF. A document obtained by scanning paper is not valid. | Generate a test DeCA and check that the text can be selected (not a scanned image) and that it was created directly by the system. |
| Size ≤ 5 MB | The file cannot exceed 5 MB. | Check the size of the downloaded PDF; confirm it stays under 5 MB even with several lines or attachments. |
| QR code with a unique URL | Mandatory QR code inside the PDF, pointing to a unique address (URL). | Scan the document's QR code and check that it opens a unique URL linked to that consignment. |
| https URL (TLS 1.2+) without credentials | The URL uses the https protocol over TLS 1.2 or higher and allows direct download of the document, without credentials or authentication, with no intermediate buttons or manual interaction. | Open the QR code's URL in a fresh browser (not logged in): it must download the PDF directly, start with https:// and not ask you to log in or click anything. |
| Date/time metadata | Date and time of creation and modification recorded as PDF metadata. | Check the PDF properties (document metadata) and confirm that the creation and modification date and time are recorded. |
| Retention ≥ 1 year | Minimum retention of one year in your own or an external repository, with access for inspectors during the transport operation. | Ask the supplier where and for how long each DeCA is stored, and how inspectors access it during the transport operation. |
| Signature (optional, AdES) | A signature is not mandatory. If included, it must be an advanced electronic signature (AdES) under the eIDAS Regulation. | If your operations require a signature, confirm that the software applies an advanced electronic signature under eIDAS; if it doesn't use one, that's fine. |
The QR code, point by point
The QR code is the heart of the DeCA: it is what lets inspectors download the document instantly. The Resolution is very strict about how it must behave:
- It goes inside the PDF and points to a unique URL for that document.
- The URL uses the https protocol over TLS 1.2 or higher.
- The URL allows direct download of the document, without requiring credentials or authentication.
- There can be no intermediate buttons or manual interaction: when the URL is opened, the PDF must download by itself.
The quickest test: scan the QR code or paste its URL into a browser where you have no session open. If the document downloads directly, the requirement is met. If a login screen, a "download" button or a portal appears, it does not comply. At a roadside check, the driver shows the DeCA with its QR code or just the QR code, so this point is critical.
Retention and access for inspectors
The rules don't stop once the document is issued: it must be kept for at least one year, in your own or an external repository. During the transport operation, inspectors must be able to access the DeCA. Seven calendar days after the end of the transport operation, the download from the URL may be deactivated.
In practice, this means your software (or your supplier) must guarantee storage for that year and inspector access while the transport is under way. It is a direct question worth asking before you sign up: where each DeCA is stored, for how long and how it is accessed.
How to use this checklist to choose software
- Ask for a test issue: generate a real DeCA and check the native PDF format and size ≤ 5 MB.
- Test the QR code without a session: scan it from a device that is not logged in and confirm direct download over https (TLS 1.2+), with no buttons or credentials.
- Inspect the metadata: check the creation and modification date and time in the PDF properties.
- Ask about retention: where and for how long it is stored, and how inspectors access it during the transport operation.
- Clarify the signature: only if you need one, check that it is an advanced electronic signature (AdES) under eIDAS.
- Confirm the integration: ideally the DeCA is generated automatically from the transport order itself, without re-keying data.
Official sources
- Resolución de 5 de junio de 2026, de la Dirección General de Transporte por Carretera y Ferrocarril (BOE-A-2026-12784). boe.es
- Orden FOM/2861/2012, de 13 de diciembre, del documento de control administrativo (BOE-A-2013-154). boe.es
- Ley 9/2025, de 3 de diciembre, de Movilidad Sostenible (BOE-A-2025-24545). boe.es