Before you ask the regulator.

No — and deliberately not. Aurenta is the ASP-agnostic correctness layer. You appoint any accredited service provider; Aurenta makes the invoice correct and defensible before your ASP transmits it.

It is already under way. The voluntary pilot has been live since 1 July 2026. Accredited service providers must be appointed by 30 October 2026 — a deadline extended once, from 31 July 2026. Phase 1 becomes mandatory on 1 January 2027 for businesses with revenue of AED 50 million or more, and the next wave follows in July 2027. The deadline moved once. Go-live didn't.

In your region, on infrastructure you control. Aurenta deploys fully self-hosted, and every model-backed step — OCR, retrieval, telemetry — runs only on in-region models. If no in-region model is available, the system stops rather than silently falling back to a foreign cloud API: sovereignty is fail-closed by design, not a configuration option someone can quietly relax. The full deployment architecture is documented at /sovereignty/.

The document queues for a person — nothing files itself, and nothing pays itself. Approving is one click; rejecting requires a written reason — recorded, sealed, attributable. Every decision becomes part of the evidence record, so months later you can show who looked, what they saw, and why they decided.

You pay a success fee only on what your own approver verifies as recoverable — and the fee is computed from cryptographically sealed amounts, so neither side can move the number afterward. How those verified recoveries are produced is explained at /recover/.

Advisory, never blocking — releasing money is always a human act. The Payment-Run Firewall screens your payment proposal before disbursement and returns a per-line pay/hold recommendation, sealed as evidence — but the system never stops a payment itself, and it never silently releases one either. Every signal is deterministic and explainable — no ML black box. Your treasury team sees the exact rule that fired and the exact figures behind it, then makes the call.

Yes — pixels, arithmetic and conformance can all pass on a fabricated document. That's why Aurenta doesn't stop at the image: when an invoice checks out on its face, it's corroborated against out-of-document truth — public registries, your buyer feeds, and your own payment history. A first-time vendor paid into a first-time bank account raises an advisory REVIEW. Advisory, never blocking — releasing money is always a human act.

Here is the precise answer, because on this topic precision is the product. Evidence roots are Ed25519-signed today — hash-chained and Merkle-committed, verifiable offline. The signer is HSM-ready via PKCS#11: the interface is built and binds to the hardware security module in your deployment. Timestamping is RFC 3161-capable — timestamps bind to your deployment's TSA. That is the exact state of the code, and we will never claim more than it does.

The seller-side fine is AED 100 per non-issued e-invoice, with penalties of up to AED 5,000 per month (Cabinet Decision No. 106 of 2025) — in addition to existing VAT penalties. But the capped fine is the smaller number. The larger, uncapped exposure sits on the buyer side: a defective supplier invoice can put the input VAT you reclaimed against it at risk, and that figure scales with the invoice, not with a monthly cap. That buyer-side exposure is what /recover/ is built for.

PINT-AE 1.0.4 is the UAE's national e-invoice profile — the country's specialisation of the international Peppol / UBL 2.1 standard, established under Ministerial Decisions 243 and 244 of 2025. Every e-invoice in scope of the mandate must conform to it, structurally and arithmetically, to be accepted for transmission.