PDF/A-4 conformance: what NextPDF emits for ISO 19005-4

At a glance

Boundary statement. NextPDF produces output intended to conform to PDF/A-4. The library does not assert conformance; a validator, such as veraPDF, does.

PDF/A-4 is ISO 19005-4:2020, the PDF 2.0-based archival profile. NextPDF Core carries the ConformanceMode discriminator (PdfA4, PdfA4e, PdfA4f). The Premium nextpdf/pro engine emits the OutputIntent, the embedded ICC profile, and the Extensible Metadata Platform (XMP) pdfaid identification schema during save(). The library produces the artifacts. veraPDF decides conformance. ISO 19005-4 §6.7.3 is explicit: the pdfaid:part/pdfaid:rev properties “do not by themselves determine conformance”.

Install

composer require nextpdf/core:^3
composer require nextpdf/pro   # OutputIntent + ICC + XMP authoring

Core registers the security.pdfa capability, but reports it as unavailable without nextpdf/pro. In that case, enablePdfA() throws InvalidConfigException with an upgrade path instead of emitting a non-conforming file.

Conceptual overview

Document::enablePdfA(?object $version = null) maps a PdfAVersion enum input to a ConformanceMode case. It defaults to ConformanceMode::PdfA4 for unrecognised input ('4e' → PdfA4e, '4f' → PdfA4f). The mode drives three emission obligations for a conforming file:

OutputIntent + ICC — §6.2.3 allows a conforming file to specify its colour characteristics with a PDF/A-4 OutputIntent that references a DestOutputProfile International Color Consortium (ICC) stream. Per §6.2.4.1 this is one of two permitted routes to device-independent colour (the other is specifying device-independent colour spaces directly). The OutputIntent is the route NextPDF takes, not an unconditional requirement of the standard.
pdfaid identification — §6.7.3 requires the PDF/A identification schema in document-level XMP (the AIIM pdfaid namespace) with pdfaid:part/pdfaid:rev. PDF/A-4e and PDF/A-4f also set pdfa:conformance (E / F). §6.7.3 states that a file conforming to neither shall not provide a pdfa:conformance value.
Font embedding — §6.2.10 requires all fonts used for rendering to be embedded.

NextPDF emits these artifacts. It does not run the §5 conformance determination. That is veraPDF’s job, and §6.7.3 reserves the determination for that process.

API surface

Method	Effect
`enablePdfA(?object $version = null): static`	Routes to `ConformanceMode::PdfA4`/`PdfA4e`/`PdfA4f`; schedules OutputIntent + ICC + XMP at `save()`. Throws `InvalidConfigException\|PageLayoutException\|CompressionException` if `nextpdf/pro` is absent.
`ConformanceMode::pdfaPart(): ?int`	Returns the ISO 19005 part for the active mode (4 for PdfA4*).
`ConformanceMode::pdfaConformanceLetter(): string`	Returns the `pdfa:conformance` letter (E / F) or empty.

Code sample — Quick start

<?php

declare(strict_types=1);

require_once __DIR__ . '/vendor/autoload.php';

use NextPDF\Core\Document;
use NextPDF\Exception\InvalidConfigException;
use NextPDF\Support\CapabilityRegistry;

$out = getenv('NEXTPDF_COOKBOOK_OUTPUT') ?: __DIR__ . '/archival.pdf';

$registry = CapabilityRegistry::getInstance();
if (!$registry->get('security.pdfa')->isAvailable()) {
    fwrite(STDERR, "PDF/A-4 requires nextpdf/pro.\n");
    exit(1);
}

try {
    $doc = Document::createStandalone();
    $doc->enablePdfA();              // ConformanceMode::PdfA4
    $doc->setTitle('Archival Record 2026-0042');
    $doc->setLanguage('en');
    $doc->writeHtml('<h1>Archival record</h1><p>Body.</p>');
    $doc->save($out);               // OutputIntent + ICC + XMP scheduled here
} catch (InvalidConfigException $e) {
    fwrite(STDERR, $e->getMessage() . "\n");
    exit(1);
}

echo "Wrote {$out} — validate: verapdf --flavour 4 {$out}\n";

Code sample — Production

Use the validator verdict as a build gate. Run verapdf --flavour 4 on the output, and fail the build on a non-zero exit. The validator verdict is the gate; the library’s emission is the input to it, never the verdict itself. See /cookbook/php/pdfa4-conformance-gate/ for the full gated pipeline.

Edge cases & gotchas

Enable before content. Call enablePdfA() before you add content. Retroactive enabling does not re-process already-written objects.
No encryption. PDF/A prohibits the Encrypt key. Do not call setEncryption() on a PDF/A document. Encryption is confidentiality, not archival integrity, and the two are mutually exclusive here.
pdfa:conformance is conditional. Only PDF/A-4e and PDF/A-4f set it. Emitting it on a plain PDF/A-4 file is itself a conformance violation (§6.7.3) — the ConformanceMode case prevents that by construction.
PDF/A-4f attachments. Embedded files in a PDF/A-4f file must carry the F and UF keys (Desc recommended) per §6.7.5. This supports the ZUGFeRD/Factur-X hybrid path.

Performance

OutputIntent + ICC embedding adds a fixed-size ICC stream (the working-space profile) and the XMP packet at save(). The budget is wall ≤ 1500 ms and peak ≤ 128 MB for a typical document.

Security notes

PDF/A-4 forbids encryption. The profile is an archival and longevity constraint, not a security control. Key custody and verifier policy are out of scope for this profile; see the trust center.

Data Residency & PII Mitigations

PDF/A-4 emission runs in-process and writes only the document, the embedded ICC profile, and the XMP packet. No content leaves the process. Personally identifiable information (PII) in the source content is the integrator’s responsibility. The profile does not redact.

Safe Telemetry & Log Scrubbing

The example writes only the output path and the validator command to STDERR. It logs no document bytes. The recipe honours NEXTPDF_COOKBOOK_OUTPUT and never echoes the PDF to STDOUT.

Threat model

A PDF/A-4 file is not access-controlled. Anyone with the file can read it. The profile supports rendering longevity, not confidentiality. Treat the OutputIntent ICC stream as public.

FIPS-mode behavior

PDF/A-4 emission performs no cryptography. A digital signature on a PDF/A-4 file (PDF/A-4 §6.5 permits PAdES profiles) is a separate signature-recipe concern and inherits that recipe’s FIPS posture. This page makes no signing claim.

Conformance

Claim	Spec	Clause
A PDF/A-4 file may specify its colour characteristics with a PDF/A OutputIntent referencing a DestOutputProfile ICC profile.	ISO 19005-4	§6.2.3
Device-independent colour may be specified directly or indirectly via the OutputIntent DestOutputProfile (one of two permitted routes).	ISO 19005-4	§6.2.4.1
The PDF/A version is identified via the PDF/A identification (pdfaid) schema in document XMP.	ISO 19005-4	§6.7.3
pdfaid:part / pdfaid:rev do not by themselves determine conformance; determination is performed per Clause 5.	ISO 19005-4	§6.7.3
A file conforming to neither PDF/A-4e nor PDF/A-4f shall not provide a pdfa:conformance value.	ISO 19005-4	§6.7.3
PDF/A-4f embedded files require the F and UF keys (Desc recommended).	ISO 19005-4	§6.7.5
All fonts used for rendering must be embedded.	ISO 19005-4	§6.2.10
Transparency / colour usage depends on a declared OutputIntent.	ISO 19005-4	§6.2.9

Citations are clause-id plus reference_id pointers into the verification corpus. No standards text is reproduced; NextPDF summarizes clauses in its own words.