Compliance

At a glance

NextPDF Pro reports on PDF/UA-2 language-tag events, validates and embeds Factur-X / ZUGFeRD e-invoice XML, and embeds or reads C2PA manifest stores. These features produce reports and structured results.

Availability & licensing

This capability ships in NextPDF Pro (nextpdf/pro) and activates with a Pro-tier license envelope. A deployment without that entitlement does not load the capability’s classes. Compliance is part of the Pro edition; there is no separate per-feature license flag. Compare editions and get a license.

Install

composer require nextpdf/pro:^3

Conceptual overview

The Compliance module has three independent surfaces.

Language-tag reporting. LangComplianceReporter emits a structured JSON record for each PDF/UA-2 language-tag event. Each record carries the offending tag, a machine-readable reason, the parsed tag components, an ISO 14289-2 §8.4.4 clause reference, and a timestamp. ConformancePolicy is a Premium facade that defaults to strict UA-2 language handling: it fails closed when a malformed or unregistered BCP-47 tag reaches the /Lang entry. A lax opt-out (ConformancePolicy::withStrictUa2(false)) reverts to the legacy permissive behavior and logs a notice. NextPDF marks that opt-out deprecated; use the strict default instead. The opt-out exists since v5.0 and goes away in the next major release. To migrate, audit your corpus for malformed /Lang values, correct them, then drop the opt-out call so the strict default applies.

E-invoice handling. EInvoiceValidator checks a hybrid PDF against the EN 16931 semantic data model and the Factur-X 1.08 / ZUGFeRD 2.4 container specification. It detects the profile, runs the EN 16931 business-rule engine, and runs a Schematron pass. Before validating, it extracts the embedded invoice XML from the PDF — including from object-stream PDFs, which are the default output of common producers such as Ghostscript, Gotenberg, and Antenna House and which earlier extraction could not read. The extractor accepts RFC 7303 parameterized MIME subtypes (for example text/xml; charset=UTF-8) and ISO 32000-2 literal-string embedded-file names, including escapes. FacturXEmbedder produces a hybrid PDF/A-3 document with the Factur-X XML attached. EInvoiceValidationResult reports profile, syntax, rule violations, and wrapper checks.

Provenance. C2paManifestEmbedder embeds a caller-supplied C2PA manifest store into a PDF byte string, or extracts one back out. ManifestStore is the immutable value object that crosses the boundary. The seam does not synthesize claims or resolve hash bindings.

What “compliance” means here

This module reports what it checks.

• The e-invoice validator checks the EN 16931 semantic model and the Factur-X / ZUGFeRD container specification only. National extensions — for example Italian SDI, French Chorus Pro, German XRechnung — are out of scope. As EN 16931-1 itself notes, the invoice issuer is responsible for meeting the rules of relevant legislation.
• The language-tag reporter produces a report of tag events.
• C2PA embedding writes a caller-supplied manifest. It does not produce or sign the claims inside it.

Why it works this way

The load-bearing decision is a hard line between checking and certifying. Each surface returns evidence — a report, a validation result, an embedded manifest. ConformancePolicy fails closed on a malformed /Lang tag, and C2paManifestEmbedder never signs the claims it carries. EInvoiceValidator::validate() returns an EInvoiceValidationResult; a green isValid() is one input to your decision. The evidence composes with your own controls rather than replacing them.

Design background: Compliance you can hand to an auditor.

API surface

Class	Responsibility
LangComplianceReporter	Emit structured language-tag event records.
ConformancePolicy	Premium strict UA-2 language policy facade.
EInvoiceValidator	Check EN 16931 / Factur-X / ZUGFeRD; return a result.
EInvoiceValidationResult	Profile, syntax, rule violations, wrapper checks.
FacturXEmbedder	Produce a hybrid PDF/A-3 + Factur-X XML document.
C2paManifestEmbedder	Embed or extract a C2PA manifest store.
ManifestStore	Immutable C2PA manifest-store value object.

Code sample — Quick start

use NextPDF\Pro\Compliance\EInvoice\EInvoiceValidator;

$result = $validator->validate('/path/to/invoice.pdf');
$ok = $result->isValid(); // true only if wrapper, attachment, profile, and no fatal BR

Code sample — Production

$result = $validator->validate($pdfPath);

foreach ($result->businessRuleViolations as $violation) {
    $logger->warning('einvoice.br_violation', [
        'rule'     => $violation->ruleId,
        'severity' => $violation->severity->value,
    ]);
}
// A green result is one input to your decision, not a compliance verdict.

Edge cases & gotchas

• A well-formed, non-Factur-X PDF returns a “not an e-invoice” result rather than throwing.
• The XML extractor reads object-stream PDFs (the default output of Ghostscript, Gotenberg, and Antenna House) and accepts RFC 7303 parameterized MIME subtypes and ISO 32000-2 literal-string filenames. This is compatibility extraction for conformant producer output, not authoritative attachment validation against hostile input — full xref activation for adversarial public endpoints is a documented deferred boundary. Treat extraction from untrusted sources accordingly.
• An empty business-rule violation list does not by itself mean the document is valid; wrapper and attachment checks also apply.
• NextPDF deprecates the strict UA-2 lax opt-out; migrate to the strict default (see Conceptual overview). It goes away in the next major release.

Performance

Validation cost scales with embedded XML size and rule count. Language-tag reporting is constant per event.

Security notes

All XML parsing disables external-entity resolution (XXE-safe) and bounds decompression. Treat e-invoice XML and C2PA bytes from untrusted sources as hostile.

Data residency & PII mitigations

E-invoice XML may contain personal and financial data. Processing is in-process and local; the module performs no outbound network calls for validation. Apply your own retention and minimization controls to extracted XML and reports.

Safe telemetry & log scrubbing

Reporter records and validation logs may include tag values and rule identifiers. They do not include full invoice payloads. Scrub or redact tag values before forwarding logs to shared sinks if those values are sensitive.

Conformance

Behavior	Reference	Status
Natural-language declaration (/Lang)	ISO 14289-2:2024 §8.4.4	Checked / reported
Core invoice semantic model	EN 16931-1:2026	Checked (issuer remains responsible)
C2PA manifest store / JUMBF	C2PA 2.1 §11.1	Embed / extract supported

This table records the specifications NextPDF Pro is built against and what it checks.

FIPS-mode behavior

This module does not perform cryptographic signing. C2PA claim signing and key custody are outside its scope; see the Security module for FIPS-mode signing behavior.

Threat model

Untrusted e-invoice XML and C2PA bytes are the primary inputs. Mitigations: XXE-safe parsing, bounded decompression, no claim synthesis across the C2PA seam, and no network I/O during validation.

Behavior contract

• LangComplianceReporter emits a structured JSON record per PDF/UA-2 language-tag event with the offending tag, a machine-readable reason, parsed tag components, an ISO 14289-2 §8.4.4 reference, and a timestamp.
• ConformancePolicy defaults to strict UA-2 language handling and fails closed when a malformed or unregistered BCP-47 tag reaches /Lang. The lax opt-out is deprecated and is removed in the next major release.
• EInvoiceValidator detects the profile, runs the EN 16931 business-rule engine and a Schematron pass, and returns an EInvoiceValidationResult. National extensions are out of scope and the issuer remains responsible per EN 16931-1.
• FacturXEmbedder produces a hybrid PDF/A-3 document with the Factur-X XML attached. C2paManifestEmbedder embeds or extracts a caller-supplied ManifestStore; it does not synthesize or sign claims.
• This module reports what it checks.

Enterprise boundary note

Compliance in Pro covers language-tag reporting, EN 16931 / Factur-X / ZUGFeRD checking, and C2PA manifest embed/extract. Extended archival and signature profiles, and C2PA claim signing with key custody, are Enterprise-tier concerns documented separately and are not provided by this module.

Core fallback / alternative

There is no Core equivalent for language-tag reporting, e-invoice handling, or C2PA manifest embedding. These are Pro additions.

Publication boundary

This page documents externally observable behavior and the supported public API surface only. Internal namespace paths, helper classes, mechanism tables, runbook filenames, and ticket prefixes are out of scope.

See also

• Security — signing and redaction.
• Enterprise editions — extended archival and signature profiles.
• Specifications — referenced standards index.
• Compliance — Deep Reference — full class and method surface.