If you run cabotage in Spain, your paper control document expires on 5 October
From 5 October 2026 the administrative control document carried in the cab for road haulage inside Spain must be digital. It is called the DECA, and it applies to cabotage as well as to domestic Spanish work — which means it catches hauliers from the rest of Europe who have no reason to be reading the Spanish transport press. Your international CMR is unaffected.
What changes, and what does not
The eighth transitional provision of Ley 9/2025 (the Spanish Sustainable Mobility Act) requires the control document for public goods transport to be «necessarily digital» ten months after the act came into force. That date is 5 October 2026. The technical requirements are set out in a Resolution of 5 June 2026 published in the Spanish official gazette (BOE-A-2026-12784).
The Ministry has stated in its own FAQ that there is no grace period beyond 5 October.
The DECA is not the consignment note. The consignment note is the contract; the DECA is an administrative document you show at a roadside check. In Spain the same sheet of paper has been doing both jobs. Only the second one goes digital.
Does it catch you?
| Movement | DECA? |
|---|---|
| Domestic Spanish haulage for hire and reward | Yes |
| Cabotage inside Spain, whoever the carrier is | Yes |
| International carriage to or from Spain | No — the CMR is unchanged |
| Own-account transport | No |
| Parcels and delivery rounds, removals, recovery vehicles | No — exempt |
The cabotage line is the one worth reading twice. If your truck picks up and drops within Spain after an international leg, that leg is cabotage, and from 5 October it needs a digital control document. The CMR you carried on the way in does not cover it.
Note also who is on the hook: article 4 of Orden FOM/2861/2012 places the obligation on both the effective carrier and the contractual shipper. It is not only the haulier's problem.
What the file has to be
The Resolution is short and specific. The document must be:
- PDF, no larger than 5 MB, legible.
- Natively generated from the data in your system. A scan does not qualify — if it started life on paper and you photographed it, it fails.
- Carrying an embedded QR code with the web address of the file.
- Kept for at least one year by carrier and shipper.
And the URL behind that QR must:
- use HTTPS with TLS 1.2 or above;
- be reachable by an inspector during the job, and may be switched off seven days after it ends;
- require no credentials — nobody signs in to see it;
- have no interactive buttons;
- allow direct download of the PDF file.
Why a Google Drive link will not do
The obvious shortcut is to drop the PDF in Drive, OneDrive or SharePoint and point the QR at the share link. Open one of those links and watch what actually happens: you do not get the PDF. You get a viewer page — toolbar, download button, print button, and sometimes a prompt to sign in.
That is precisely what the Resolution rules out in two consecutive requirements: no interactive buttons, and direct download of the file. A viewer is not a direct download; it is a web page with buttons.
Picture the check itself. Hard shoulder, officer scans the QR on his own phone, and instead of your document he gets a Google sign-in screen. Google is not the one standing there without a control document.
A folder on your own web space, with the file at a fixed path —
yourdomain.com/deca/2026-000123.pdf — with no application viewer, no login and no
intermediate screen.
But uploading it is not enough on its own. A normal server sends a PDF inline, and a
phone then opens it in its own viewer, toolbar and all. For it to be a genuine direct download the
server has to send it with a Content-Disposition: attachment header. One line of
configuration, and it is the difference between the file downloading and the file opening inside
an interface.
Check it yourself: open the URL in a private window, on mobile data, not the office wi-fi. If it asks you for anything, or shows you a page instead of downloading the file, it does not comply.
No more pen marks on the dock
Section seven of the Resolution states that handwritten annotations will not be taken into account. The classic reservation written on the sheet at unloading — "2 of 12 cartons crushed at the corner" — stops counting. That is the note that decides who pays a claim.
To change anything en route there are two routes and only two: modify the PDF keeping the same URL (adding the new data and the reason, keeping the old data clearly marked as no longer valid), or issue a new PDF with a new URL and QR, keeping the original. Either way the driver has to be given the updated document.
Two things you may be sold
"Only a qualified trust service provider can issue a valid DECA." Not true. Section four says that if signatures are included for contractual reasons they must be advanced (AdES) or qualified (QES). An electronic signature is not a requirement of the DECA at all.
"You have to register your domain." Also not true. The Resolution says the repository domain may be any domain and needs no prior notification. There is no approved-provider list.
You can reuse the document you already have
Section eight allows the DECA to take the form of a consignment note, an ADR document, a waste identification document or another format, provided it carries all the data listed in article 6 of Orden FOM/2861/2012 and distinguishes the contractual shipper from the effective carrier. You do not need to invent a new form — the one you use can be the container, as long as it is digital and complete.
Those data are: contractual shipper (name, tax number, address); effective carrier (name, tax number); origin and destination; nature and weight of the goods; special circulation authorisation where relevant; date of carriage; vehicle registration (and trailer); and any observations or reservations the parties ask for.
Before 5 October
- Work out which of your Spanish movements are cabotage. Those are the ones affected.
- Ask your transport software first. Many vendors shipped this over the summer.
- Agree in writing who issues it. The rule makes both parties responsible and does not say who generates it.
- Test the URL in a private window, on mobile data.
- Tell the drivers that pen marks no longer count.
There is no free government application: the Ministry's FAQ says each company must have its own or contract a provider.
The size of the fine. It is widely reported as a serious infringement of €401–600, and it may well be, but the consolidated text of the Spanish transport act in the official gazette is truncated before the penalty regime and we have not been able to read it at source. We would rather tell you we do not know than give you a number we have not checked. This is an explanation of the rule, not legal advice.
Sources
- Resolution of 5 June 2026 — BOE-A-2026-12784. The technical requirements.
- Orden FOM/2861/2012 — what the control document is, who must complete it (art. 4), what it contains (art. 6), who is exempt (art. 2).
- Ley 9/2025 — the eighth transitional provision and the date.
- Official DECA page and its FAQ — Spanish Ministry of Transport.
If you prepare consignment notes, the consignment note template here tells you which required particular you have left blank and which article asks for it.