Compliance

At a glance

NextPDF Enterprise routes a finished PDF to an external validation tool — veraPDF, EU DSS, or Mustang/KoSIT — and returns a unified, structured result. The result records what the external tool checked.

Availability & licensing

This capability ships in NextPDF Enterprise (nextpdf/enterprise) and activates with an Enterprise-tier license envelope. A deployment without that entitlement does not load the capability’s classes. Compare editions and get a license.

Install

composer require nextpdf/enterprise:^3

Conceptual overview

This module is a gateway, not a validator. The conformance verdict comes from an external tool. The gateway selects the right tool, delegates to it, and normalizes the answer.

ComplianceGateway accepts a ComplianceProfile and the PDF bytes. It resolves which registered ExternalValidator handles that profile, checks that the sidecar is reachable, delegates the check, and returns an ExternalValidationResult. ComplianceProfile enumerates the supported targets: PDF/A-1b/2b/3b/4/4f, PDF/UA-1/2, the PDF 2.0 Arlington structural model, PAdES B-B/B-T/B-LT/B-LTA, ZUGFeRD 2.4 / Factur-X 1.08, and EN 16931. Each case maps to a normative reference and to one external tool.

ExternalValidator is the contract every sidecar bridge implements: VeraPdfValidator (veraPDF REST), DssValidator (EU DSS REST), and ZugferdExternalValidator (Mustang/KoSIT). Each one talks to its sidecar over a PSR-18 HTTP client and translates the tool-specific response into one ExternalValidationResult.

A fail-closed policy governs sidecar absence. By default, an unavailable sidecar raises ComplianceSidecarUnavailableException: a missing validator is an inability to check, not a pass. An explicit optional mode degrades that condition to a logged warning and a null result, so callers can detect “not checked” and decide for themselves. AiReadyCertifier is a separate seam: it evaluates three readiness criteria and stamps a nextpdf: XMP provenance block. Its “certified” level is a NextPDF-internal readiness label.

What “compliance” means here

This module delegates a check and reports the result.

• Conformance is a property of the final file plus a validator, not a property of this library. ISO 19005-4:2020 §5.2 places the obligation on a conforming processor and determines conformance against the standard’s normative requirements — by a checking tool, not by the producing software.
• A result with zero non-conformances is a checked result against the clauses the external tool implements.
• An unavailable sidecar means not checked. It never means passed.

Tier boundary

Read the editions precisely. They do different things.

• NextPDF Core Conformance / Compliance runs in-process byte-stream and grammar checks and carries the conformance-mode discriminator. Core emits the structures a standard defines. It does not certify the result.
• NextPDF Pro Compliance (EInvoiceValidator) validates EN 16931 / Factur-X / ZUGFeRD in process, with no external sidecar.
• NextPDF Enterprise Compliance (this page) delegates to external validator sidecars (veraPDF, EU DSS, Mustang/KoSIT) and normalizes the result with a fail-closed policy.

The Pro in-process e-invoice validator and the Enterprise external ZUGFeRD sidecar are distinct surfaces. Do not conflate them.

Why it works this way

Conformance is a property of the finished file measured by a checking tool, not of the producing library. So the gateway delegates the verdict to authoritative external tools and only resolves, delegates, and normalizes. Self-asserting conformance in process would conflate “built against the standard” with “independently confirmed,” which the standards forbid. The fail-closed default follows: an unreachable sidecar is an inability to check, so it raises rather than passing. That keeps a missing check from masquerading as conformance.

Design background: Compliance you can hand to an auditor.

API surface

Class	Responsibility
ComplianceGateway	Resolve the tool for a profile; delegate; apply the fail-closed policy.
ComplianceProfile	Enum of supported profiles, each with a standard reference and tool.
ExternalValidator	Contract for an external sidecar bridge.
ExternalValidationResult	Unified result: profile, tool, conformance flag, non-conformances.
NonConformance	One non-conformance finding from the external tool.
VeraPdfValidator	veraPDF REST bridge (PDF/A, PDF/UA, Arlington).
DssValidator	EU DSS REST bridge (PAdES levels).
ZugferdExternalValidator	Mustang/KoSIT bridge (ZUGFeRD / Factur-X / EN 16931).
AiReadyCertifier	Readiness evaluation plus a nextpdf: XMP provenance stamp.

Code sample — Quick start

use NextPDF\Enterprise\Compliance\ComplianceProfile;

$result = $gateway->validate($pdfBytes, ComplianceProfile::PdfA4);
$passed = $result?->passes(); // null = sidecar unavailable (not checked)

Code sample — Production

$result = $gateway->validate($pdfBytes, ComplianceProfile::PdfA4);

if ($result === null) {
    $logger->error('compliance.not_checked', ['profile' => 'pdfa-4']);
    // Treat "not checked" as a blocker, never as a pass.
    return;
}

foreach ($result->nonConformances as $nc) {
    $logger->warning('compliance.nonconformance', ['profile' => $result->profile->value]);
}
// A conformant=true result is one input to your decision, not a verdict you own.

Edge cases & gotchas

• An unavailable sidecar raises ComplianceSidecarUnavailableException by default; optional mode returns null. Either way, the document was not checked.
• A profile with no registered validator raises an argument error rather than silently passing.
• buildComplianceMatrix() records tool versions and a commit SHA for traceability; the matrix reports tool output, it does not certify it.

Performance

Cost is dominated by the external sidecar round trip and the document size sent to it. Gateway resolution and result normalization are constant per call.

Security notes

PDF bytes are sent to a sidecar over a PSR-18 client. VeraPdfValidator parses only JSON responses (no XML, XXE-clean). Treat sidecar endpoints as a trust boundary: pin the sidecar, restrict its network reach, and validate its TLS.

Data residency & PII mitigations

The full PDF byte stream is transmitted to the configured sidecar. If documents carry personal or regulated data, host the sidecar in-region under your own controls. The gateway makes no other outbound calls. Apply retention and minimization controls to results and logs.

Safe telemetry & log scrubbing

Gateway logs include profile names, tool names, assertion counts, and non-conformance counts. They do not include document content. Scrub profile or filename fields before forwarding logs if those values are sensitive.

Conformance

Behavior	Reference	Status
Conformance determined by a checking tool, not the producer	ISO 19005-4:2020 §5.2	Reflected in design (fail-closed gateway)
PDF/A-4 file requirements	ISO 19005-4:2020 §6.6.4	Delegated to veraPDF
PDF/UA-2 conformity (property of the file)	ISO 14289-2:2024 §6	Delegated to veraPDF
PAdES baseline levels	ETSI EN 319 142-1 §5.4.3	Delegated to EU DSS

This table records the specifications NextPDF is built against and what the external tools check.

FIPS-mode behavior

This module performs no cryptographic signing. Signature conformance is delegated to EU DSS; key custody and FIPS-mode signing are outside its scope (see the Signature and Security modules).

Threat model

The primary inputs are untrusted PDF bytes and a sidecar response. Mitigations: JSON-only response parsing in VeraPdfValidator, a pinned sidecar trust boundary, and a fail-closed policy so an unreachable validator never resolves to a pass.

Behavior contract

• This module is a gateway, not a validator: the conformance verdict comes from an external tool (veraPDF, EU DSS, or Mustang/KoSIT) and the gateway selects the tool, delegates, and normalizes the answer.
• A result with zero non-conformances is a checked result against the clauses the external tool implements.
• An unavailable sidecar is fail-closed: it raises an exception by default, or in explicit optional mode returns a null result; either way the document was not checked, never passed.
• A profile with no registered validator raises an argument error rather than silently passing.
• The AiReadyCertifier “certified” level is a NextPDF-internal readiness label.

Publication boundary

This page documents externally observable behavior and the supported public API surface only. Internal namespace paths, helper classes, mechanism tables, runbook filenames, and ticket prefixes are out of scope.

Core fallback

NextPDF Core Conformance / Compliance runs in-process byte-stream and grammar checks and carries the conformance-mode discriminator; it emits the structures a standard defines but does not certify the result and does not delegate to an external sidecar. The external validator gateway has no Core-tier equivalent.

Pro fallback

NextPDF Pro Compliance validates EN 16931 / Factur-X / ZUGFeRD in process with no external sidecar. The Pro in-process e-invoice validator and the Enterprise external ZUGFeRD sidecar are distinct surfaces; the external validator gateway ships in the nextpdf/enterprise package only. Do not conflate them.

Enterprise boundary note

The gateway, the profile-to-tool resolution, and the result normalization are described at the behavior level. The per-sidecar bridge internals, the tool-specific response translation, and any internal orchestration detail are out of scope for the public surface.

Deployment boundary

The full PDF byte stream is transmitted to the configured sidecar. The operator hosts and operates the sidecars, pins them, restricts their network reach, and validates their TLS — sidecar endpoints are a trust boundary. If documents carry personal or regulated data, host the sidecar in-region under your own controls and apply retention and minimization controls to results and logs.

See also

• Validation — in-process structural policies.
• Evidence — sealed, timestamped result packages.
• Pro Compliance — in-process e-invoice handling (distinct surface).
• Core Conformance — the conformance-mode discriminator.
• Compliance — Deep Reference — per-sidecar bridge and response-translation detail.