VAT Compliance for SaaS Products Selling Into the EU

EU VAT compliance for SaaS products selling into Europe is not a regulatory footnote to revisit once you hit scale. It is a foundational operational requirement that begins with your first paying EU customer. The rules governing where VAT is owed, how it is calculated, and how it is reported are specific, non-negotiable, and already being enforced through infrastructure that makes non-compliance visible at relatively modest revenue levels. The founders who get this right early treat it as a billing architecture question, not a tax question. The ones who get it wrong treat it as the latter, usually after the problem has already compounded — and by then, catching up feels less like filing paperwork and more like trying to bail out a boat with a teaspoon.

Most SaaS products qualify as electronically supplied services under EU VAT law: automated delivery, minimal human intervention, dependent on IT infrastructure to function. That classification carries real weight. It means the customer location rule applies, which means VAT is owed across as many as 27 separate jurisdictions, each with its own rate. Rates across the EU span from 17% in Luxembourg to 27% in Hungary. When you account for product-type variations within countries, there are over 75 distinct VAT rates in play. Estonia alone raised its standard rate from 20% to 22% in 2024 and then to 24% in 2025. Rate monitoring is not a setup task; it is an ongoing operational function.

The threshold that catches non-EU founders off guard

There is a specific misreading of EU VAT guidance that costs founders real money, and it comes from a single phrase taken out of context: the €10,000 cross-border threshold.

Here is what that threshold actually governs. EU-established businesses selling B2C digital services to consumers in other EU member states charge their home country's VAT rate until their cross-border sales exceed €10,000 in a calendar year. Once they exceed that threshold, they must switch to destination-country rates and use the One Stop Shop filing system. The threshold is a compliance simplification for small businesses operating entirely within the EU.

It does not apply to you if your business is established outside the EU. Full stop. Think of it as a door marked "EU residents only" — it does not matter how politely you knock.

A US-based SaaS company, a UK company post-Brexit, a Canadian company with no EU entity: each of these faces a VAT obligation in the EU that begins at zero euros in revenue. A single subscription sale to a French consumer triggers French VAT obligations. There is no grace period, no revenue ramp-up window, no minimum. There is also a 2025 SME cross-border exemption scheme that allows qualifying businesses to make VAT-free sales across other EU member states. That scheme, too, is unavailable to businesses established outside the EU.

This distinction between EU-established and non-EU-established businesses is the single most frequently omitted detail in general guidance on EU VAT thresholds, and the omission is the source of some of the most expensive misunderstandings in this space. If your SaaS has a freemium model, the moment a single EU free user converts to a paid plan, your VAT obligation begins.

How B2B and B2C sales are taxed differently, and why getting the distinction wrong is costly

The B2B and B2C distinction determines not just your tax treatment, but your entire operational workflow for any given transaction.

For B2C sales, the SaaS company collects VAT from the consumer at the applicable local rate and remits it to the relevant authority. The full obligation sits with you. For B2B sales, the reverse charge mechanism applies: the VAT accounting obligation shifts to the buying business, and the seller invoices without charging VAT. This is genuinely useful; it means you are not collecting and remitting VAT on behalf of every business customer across 27 countries.

But the reverse charge only works if you do it correctly. That means collecting the customer's VAT ID at checkout, verifying it against the VIES database before applying the reverse charge treatment, and including an explicit notation on the invoice: "Reverse charge, VAT to be accounted for by the recipient." Skipping any of these steps, and in particular accepting an unverified or invalid VAT ID, leaves you liable for the uncollected VAT. The tax authority pursues the seller, not the customer.

SaaS products frequently serve mixed customer bases: individual developers on one plan, company accounts on another, sometimes both through the same checkout flow. The system must handle both transaction paths cleanly, and it must make the B2B or B2C determination correctly at the point of sale. Getting that determination wrong is not a paperwork error. It is a taxable event with a specific dollar amount attached.

The B2B or B2C classification also determines whether a transaction flows through the One Stop Shop system. That conceptual link matters when designing how your billing architecture handles compliance across customer types.

What OSS is, how registration works, and what it actually requires operationally

Before the One Stop Shop existed, a SaaS product with B2C customers in multiple EU countries had to register for VAT separately in each of those countries. For smaller products, that was a practical barrier significant enough to make EU expansion prohibitively complex — like being asked to get a fishing license in every lake before you could cast a single line.

OSS replaced its predecessor system in July 2021 and covers cross-border B2C digital services across all 27 member states through a single quarterly return. There are two schemes relevant to SaaS sellers. The Union OSS is for EU-established businesses; you register in your country of establishment and file quarterly returns there covering all EU B2C sales. The Non-Union OSS is for businesses with no EU establishment; you register in any EU member state of your choosing, and that country handles the distribution of VAT to other member states on your behalf. For English-speaking, US-based sellers, Ireland is a common registration choice.

The mechanics are worth understanding in detail. One quarterly return lists all EU B2C sales, broken out by member state and applicable rate. You make a single payment to your registration country; that authority distributes the VAT owed to other member states. The return deadline is the end of the month following the quarter. Records must be kept for up to ten years for audit purposes.

One critical operational constraint: once you elect OSS, it applies to all qualifying supplies in all member states. You cannot decide to use OSS for German and French sales while registering separately in Spain. It is all-or-nothing by design.

The adoption scale tells you something about how central this system has become. Over 130,000 companies have registered, and in 2024 alone, €33 billion in VAT was declared via the three OSS schemes. The Non-Union scheme, most relevant to non-EU SaaS sellers, accounted for €2.8 billion of that total in 2024, per European Commission data. This is not a niche mechanism. It is the primary infrastructure through which non-EU digital sellers comply with EU VAT obligations.

The customer location evidence requirement that most billing systems are not built to satisfy

The customer location rule is not satisfied by capturing a billing address at checkout. EU rules require at least two pieces of non-contradictory evidence confirming a B2C customer's location before the applicable VAT rate can be determined. Common evidence types include billing address, IP address at registration, bank country, payment instrument country, and phone number prefix.

When two pieces of evidence agree, you apply that country's VAT rate. When they conflict, billing address typically takes priority, but the resolution logic must be documented and defensible. More importantly, the evidence itself must be captured, stored, and auditable. Tax authorities can and do audit the evidence trail for historical sales.

Practitioners in this space consistently flag the same recurring errors. Using only a single evidence source is the most common. Defaulting to the seller's country when evidence is ambiguous is another. Not recording the VAT rate, customer country, or OSS registration number on issued invoices is a third. Each of these errors looks minor in isolation and compounds significantly at scale.

For a SaaS product with thousands of EU subscribers renewing monthly, this is not a process that can be managed manually. It requires the billing system to collect, store, and reconcile location signals at the point of each transaction. The invoice accompanying each transaction must include the VAT rate applied, the VAT amount, the buyer's VAT ID if the transaction is B2B, your OSS registration number, and an EU OSS scheme notation. These are not optional fields.

Why non-compliant sellers are no longer invisible to EU tax authorities

The enforcement calculus around EU VAT compliance changed materially on January 1, 2024, when CESOP came into force.

CESOP, the Central Electronic System of Payment Information, requires payment service providers to report to EU member state tax authorities when a payee receives more than 25 cross-border payments per quarter. That threshold is low. For any SaaS product with genuine EU traction, 25 EU payments per quarter is not a milestone; it is a rounding error. Beginning in April 2024, a US-based SaaS company processing payments at that level is being logged in CESOP by its own payment processor, with that data accessible to Eurofisc, the EU's cross-border anti-fraud network.

This closes the enforcement gap that previously made non-compliance a relatively low-risk posture below a certain revenue level. The deterrent effect of enforcement is only meaningful when enforcement is actually probable. CESOP makes it probable.

The policy driver is quantifiable. Per the European Commission's December 2025 VAT gap report, the EU's VAT compliance gap grew from €101 billion in 2022 to €128 billion in 2023. That is not a rounding error; it is a structural problem of sufficient scale to justify significant investment in detection infrastructure. CESOP is that investment made operational.

By 2025 and 2026, CESOP had moved past initial rollout into full implementation, with member states focused on data quality, validation accuracy, and reporting efficiency. The system is maturing. The question for a founder who is non-compliant is no longer whether it will surface. It is how quickly it will surface and what remediation will cost by then.

The ViDA reforms scheduled through 2030 and what SaaS billing systems need to anticipate now

On March 11, 2025, the EU Council passed the VAT in the Digital Age reforms, known as ViDA. This is enacted legislation. The timeline is set.

There are three pillars that directly affect SaaS sellers. The first is OSS expansion, effective July 1, 2028, which extends single-registration coverage to more transaction types and expands the reverse charge mechanism. The second is platform deemed-supplier rules, voluntary from July 2028 and mandatory from January 1, 2030, which require platforms facilitating transactions to collect and remit VAT on those transactions. For pure direct-sale SaaS products this is less immediately relevant; for SaaS marketplaces and app stores it is central.

The third pillar is the one that most directly affects billing system architecture: digital reporting requirements and structured e-invoicing, effective July 1, 2030. Invoices must conform to structured specifications, specifically the PEPPOL network and EN 16931, the European standard for electronic invoicing. Member states that had already established domestic e-reporting obligations as of January 1, 2024 retain their own requirements, which means some variation in e-invoicing formats will persist even after 2030 harmonization. But the direction of travel is clear and the legislative authority is in place.

ViDA's explicit purpose is closing the VAT gap through real-time automated reporting and cross-border data matching. It is the legislative complement to CESOP's enforcement infrastructure; together they form a coherent system for identifying and recovering non-compliant VAT at scale.

The European Commission released its ViDA implementation plan in September 2025. This is not a future-state exercise. The design implication for billing systems being built today is direct: invoice data structures and export formats should be designed with EN 16931 and PEPPOL compatibility in mind. Retrofitting in 2029 is more expensive than building toward it in 2026.

What a compliant VAT setup for a SaaS product actually looks like end to end

Compliance is not a registration event. It is a set of data and process requirements embedded in the billing system itself, operating at every transaction.

At checkout, you collect at least two location signals for B2C customers and present a VAT ID field for business customers. B2B VAT IDs are verified against VIES before reverse charge treatment is applied. The applicable VAT rate and VAT amount are displayed before payment is confirmed; many EU countries treat the final invoice amount as the amount agreed.

At invoice generation, the invoice includes: customer country, VAT rate applied, VAT amount, your OSS registration number, an EU OSS scheme notation for OSS-covered sales, and a reverse charge notation for qualifying B2B transactions. Invoices are stored for up to ten years, matching the OSS audit window.

For OSS registration: non-EU sellers choose a member state, register for Non-Union OSS, and file quarterly returns by the end of the month following each quarter. EU sellers register in their country of establishment for Union OSS. The election applies to all qualifying supplies in all member states; selective adoption is not permitted.

Ongoing compliance requires monitoring rate changes across member states. Estonia's 2024 and 2025 increases are a recent illustration of how quickly rate tables become stale. It also requires maintaining location evidence records tied to individual transactions, not only aggregate reports. And it requires designing invoice formats with the 2030 ViDA structured e-invoicing requirements in mind.

The underlying principle is worth stating plainly. Teams that treat VAT compliance as a backend architecture question from the outset, rather than a tax question to defer, avoid the remediation cost of retrofitting a non-compliant system after EU growth has already begun. The compliance structure and the billing system are the same system. Building them separately, or sequentially, is what creates the problem.