LEGISLATION
Cabinet Decision 106 of 2025 Explained: The UAE E-Invoicing Penalty Framework in Full
Cabinet Decision No. 106 of 2025 is the legal document that makes e-invoicing non-compliance financially painful. It specifies every violation, every penalty amount, and every condition. This article explains each article in plain language — with the original legal basis alongside — so finance teams understand exactly what triggers a fine, how much it is, and what the law says about reducing or avoiding it.
reading time: 13 min
SOURCES: MOF OFFICIAL PUBLICATIONS
may 2026
aiverix research
Cabinet Decision No. 106 of 2025 on the Violations and Administrative Penalties Resulting from Violation of the Legislation Regulating the Electronic Invoicing System is the final piece of the UAE e-invoicing legal framework. MD 243 defined what e-invoicing requires. MD 244 defined when it must be implemented. CD 106 defines what happens if you do not comply. It is already published, already signed, and already binding — it applies from the mandatory date of each business in scope. This article covers every key article of CD 106 in plain language, explains how the penalties interact with existing VAT law, and addresses the one mechanism the law provides for reducing penalties: the voluntary disclosure.
“
OFFICIAL SOURCES:
Cabinet Decision No. 106 of 2025 on Violations and Administrative Penalties — Electronic Invoicing System
Cabinet Decision No. 40 of 2017 and amendments — VAT and Tax Procedures Administrative Penalties
UAE Electronic Invoicing Guidelines V1.0, Section 11 — Ministry of Finance, 23 February 2026
Federal Decree-Law No. 28 of 2022 on Tax Procedures (Tax Procedures Law)
Cabinet Decision No. 106 of 2025 on Violations and Administrative Penalties — Electronic Invoicing System
Cabinet Decision No. 40 of 2017 and amendments — VAT and Tax Procedures Administrative Penalties
UAE Electronic Invoicing Guidelines V1.0, Section 11 — Ministry of Finance, 23 February 2026
Federal Decree-Law No. 28 of 2022 on Tax Procedures (Tax Procedures Law)
Where CD 106 Sits in the Legal Framework
CD 106 is a Cabinet Decision — issued at the level of the UAE Cabinet, which is the highest executive authority in the country. Cabinet Decisions carry the weight of federal law and do not require parliamentary ratification. CD 106 specifically establishes the penalty schedule for violations of the legislation regulating the Electronic Invoicing System — meaning violations of MD 243 and MD 244.
It is important to understand that CD 106 is not the only penalty framework that applies to e-invoicing non-compliance. It runs alongside an existing penalty framework — Cabinet Decision No. 40 of 2017 — which applies to violations of the UAE VAT law and Tax Procedures Law. Both can apply simultaneously to the same non-compliant business, because from each business’s mandatory date, a non-EIS invoice is both an EIS violation (CD 106) and a VAT Tax Invoice violation (CD 40/2017).
It is important to understand that CD 106 is not the only penalty framework that applies to e-invoicing non-compliance. It runs alongside an existing penalty framework — Cabinet Decision No. 40 of 2017 — which applies to violations of the UAE VAT law and Tax Procedures Law. Both can apply simultaneously to the same non-compliant business, because from each business’s mandatory date, a non-EIS invoice is both an EIS violation (CD 106) and a VAT Tax Invoice violation (CD 40/2017).
CD 106 of 2025 — EIS Penalties
Source: Cabinet Decision No. 106 of 2025
Covers: Failure to appoint ASP, failure to transmit through EIS, invoice-level data violations
Applies to: All persons in scope for e-invoicing — including non-VAT-registered businesses
When: From each business’s mandatory date only — not during voluntary period
Covers: Failure to appoint ASP, failure to transmit through EIS, invoice-level data violations
Applies to: All persons in scope for e-invoicing — including non-VAT-registered businesses
When: From each business’s mandatory date only — not during voluntary period
CD 40 of 2017 — VAT Penalties (Existing)
Source: Cabinet Decision No. 40 of 2017 and amendments
Covers: Failure to issue or maintain valid Tax Invoices under UAE VAT and Tax Procedures Law
Applies to: VAT-registered Taxable Persons only
When: From mandatory date — a non-EIS invoice is also a non-compliant Tax Invoice for VAT-registered businesses
Covers: Failure to issue or maintain valid Tax Invoices under UAE VAT and Tax Procedures Law
Applies to: VAT-registered Taxable Persons only
When: From mandatory date — a non-EIS invoice is also a non-compliant Tax Invoice for VAT-registered businesses
AED 5K
Monthly — for failure to appoint ASP or failure to implement by mandatory date
AED 100
Per invoice — for specific invoice-level violations under CD 106
0
Grace period from mandatory date — penalties start immediately
2
Frameworks running simultaneously for VAT-registered non-compliant businesses
The Two EIS Penalties Under CD 106
CD 106 establishes two specific penalty types for e-invoicing violations. They are distinct — one applies at the entity level for systemic non-compliance, and one applies at the invoice level for specific transaction failures.
What CD 106 Says About the Voluntary Period
"Electronic Invoicing penalties will not apply for violations that relate to Electronic Invoices that are issued voluntarily — e.g. by Persons that are not yet required to implement Electronic Invoicing on a mandatory basis in accordance with the implementation plan."
WHAT THIS MEANS IN PLAIN LANGUAGE
If you go live before your mandatory date — using the voluntary phase that opens July 1, 2026 — and an invoice has an error, you will not receive a CD 106 penalty for it. The penalty clock starts on your mandatory date, not on the date you first transmit an invoice. This protection is explicit and unconditional during the voluntary period. It does not mean technical requirements are relaxed — all 51 mandatory fields still apply. It means that errors during voluntary operation carry no financial penalty.
If you go live before your mandatory date — using the voluntary phase that opens July 1, 2026 — and an invoice has an error, you will not receive a CD 106 penalty for it. The penalty clock starts on your mandatory date, not on the date you first transmit an invoice. This protection is explicit and unconditional during the voluntary period. It does not mean technical requirements are relaxed — all 51 mandatory fields still apply. It means that errors during voluntary operation carry no financial penalty.
This is the legal basis for the strategy of using the voluntary pilot period to test and resolve issues before mandatory dates arrive. Businesses that go live early are not just building confidence — they are legally protected from penalties during that period by the explicit language of the Guidelines interpreting CD 106.
The Relationship Between CD 106 and CD 40 of 2017
Cabinet Decision No. 40 of 2017 established the UAE’s administrative penalty framework for violations of the VAT Decree-Law and Tax Procedures Law. It includes penalties for failure to issue or maintain compliant Tax Invoices. These penalties were in force before e-invoicing was introduced and remain in force after it.
WHAT THIS MEANS IN PLAIN LANGUAGE
From each business’s mandatory date, an invoice that is not transmitted through the EIS is not a valid Tax Invoice under UAE VAT law (as established by the amended Article 65(5) of the VAT Decree-Law — see Article 8 of this series). A business that is VAT-registered and issues non-EIS invoices after its mandatory date is therefore violating both CD 106 (EIS penalty) and the VAT compliance obligations enforced under CD 40 of 2017 (VAT penalty). Both penalties can apply simultaneously. The UAE Guidelines state explicitly: "Please refer to Cabinet Decision No. 40 of 2017 and its amendments for the list of administrative penalties related to the implementation of the VAT Decree-Law and the Tax Procedures Law."
From each business’s mandatory date, an invoice that is not transmitted through the EIS is not a valid Tax Invoice under UAE VAT law (as established by the amended Article 65(5) of the VAT Decree-Law — see Article 8 of this series). A business that is VAT-registered and issues non-EIS invoices after its mandatory date is therefore violating both CD 106 (EIS penalty) and the VAT compliance obligations enforced under CD 40 of 2017 (VAT penalty). Both penalties can apply simultaneously. The UAE Guidelines state explicitly: "Please refer to Cabinet Decision No. 40 of 2017 and its amendments for the list of administrative penalties related to the implementation of the VAT Decree-Law and the Tax Procedures Law."
Non-VAT-registered businesses — those in scope for e-invoicing but not registered for VAT — are only subject to CD 106. They are not subject to CD 40 of 2017 because they do not have VAT obligations. But they are fully subject to the AED 5,000 monthly penalty and AED 100 per-invoice penalty under CD 106 from their mandatory date.
How the Two Penalties Stack: A Worked Example
To illustrate how CD 106 penalties accumulate in combination with the scale of invoice volumes, consider two businesses of different sizes — both of which miss their Wave 1 ASP appointment deadline of July 31, 2026 and their go-live date of January 1, 2027, and both of which come into compliance in March 2027.
Illustrative calculation based on AED 5,000/month compliance penalty and AED 100/invoice violation penalty as described in CD 106. Exact application per specific violation type should be verified against the official CD 106 text.
The divergence between Business A and Business B illustrates an important point: for low-volume businesses, the monthly compliance penalty is the dominant cost. For high-volume businesses, the per-invoice penalty quickly becomes the larger figure. A business issuing 500 invoices per month that misses its go-live date by just one month faces AED 55,000 in invoice-level penalties for that single month — more than ten times the base compliance penalty.
The divergence between Business A and Business B illustrates an important point: for low-volume businesses, the monthly compliance penalty is the dominant cost. For high-volume businesses, the per-invoice penalty quickly becomes the larger figure. A business issuing 500 invoices per month that misses its go-live date by just one month faces AED 55,000 in invoice-level penalties for that single month — more than ten times the base compliance penalty.
The Data Retention Violation — A Separate and Long-Running Risk
Article 11 of MD 243 requires all persons subject to the Electronic Invoicing System to store electronic invoices, credit notes, and associated data for the periods prescribed by the Tax Procedures Law. The Tax Procedures Law itself establishes penalties for failure to maintain records or for failure to produce records when the FTA requests them.
WHAT THIS MEANS IN PLAIN LANGUAGE
Data retention violations are not covered directly in CD 106 — they are enforced under the Tax Procedures Law framework. This means the data retention obligation has its own separate penalty mechanism that runs independently of the EIS penalties. A business that transmits all its invoices correctly through the EIS but fails to retain the XML data for the required 5 to 7 years is violating Article 11 of MD 243 and the Tax Procedures Law — not CD 106 directly. But the financial consequence is still real and separate from any CD 106 exposure.
Data retention violations are not covered directly in CD 106 — they are enforced under the Tax Procedures Law framework. This means the data retention obligation has its own separate penalty mechanism that runs independently of the EIS penalties. A business that transmits all its invoices correctly through the EIS but fails to retain the XML data for the required 5 to 7 years is violating Article 11 of MD 243 and the Tax Procedures Law — not CD 106 directly. But the financial consequence is still real and separate from any CD 106 exposure.
This is particularly relevant for businesses that switch ASP providers after go-live. If the transition between providers results in a gap in historical invoice data — and that data cannot be produced when the FTA requests it — the Tax Procedures Law penalty applies. Full details on data retention requirements are covered in Article 6 of this series.
What CD 106 Does Not Penalise — The Boundaries of the Law
Understanding what CD 106 does not penalise is as important as understanding what it does. There are specific situations where no EIS penalty applies, and these are explicitly protected in the official framework.
Voluntary Disclosure: The One Mechanism CD 106 Provides for Penalty Reduction
UAE tax law — including the framework that supports e-invoicing — provides a voluntary disclosure mechanism through which businesses that identify their own compliance errors can self-report to the FTA and receive a reduced penalty. This is not specific to CD 106, but it is relevant to businesses that discover e-invoicing violations retrospectively.
-
Identify the violation
Review your invoice transmission records and identify the period during which non-compliant invoices were issued. Calculate the total volume of non-compliant invoices and the months of ASP non-appointment, if applicable. -
Come into compliance immediately
Before or simultaneously with filing a voluntary disclosure, remedy the violation — appoint your ASP, complete EmaraTax onboarding, and begin transmitting compliant invoices. Voluntary disclosure while the violation is still ongoing provides limited benefit. -
File the voluntary disclosure via EmaraTax
The formal voluntary disclosure process is managed through the FTA’s EmaraTax system. The disclosure identifies the period of non-compliance, the nature of the violations, and the corrective action taken. -
Penalty reduction
Voluntary disclosure can result in a reduction of the penalty amount compared to what would be assessed in an FTA audit. The exact reduction depends on the timing of the disclosure, the nature of the violation, and FTA discretion. Voluntary disclosure does not eliminate the penalty entirely — it reduces it.
IMPORTANT — VOLUNTARY DISCLOSURE DOES NOT ELIMINATE THE DATA RETENTION EXTENSION
If you submit a voluntary disclosure in year 5 of your standard retention period, the Tax Procedures Executive Regulation requires you to extend your data retention by an additional 1 year from the date of disclosure. This is a separate consequence of voluntary disclosure that affects your data management obligations — it does not affect the penalty itself.
Full details on this extension are covered in Article 6 of this series on data retention rules.
If you submit a voluntary disclosure in year 5 of your standard retention period, the Tax Procedures Executive Regulation requires you to extend your data retention by an additional 1 year from the date of disclosure. This is a separate consequence of voluntary disclosure that affects your data management obligations — it does not affect the penalty itself.
Full details on this extension are covered in Article 6 of this series on data retention rules.
The Complete Penalty Picture: What CD 106 Means for Your Business
CD 106 is a short document by the standards of regulatory legislation. But its financial consequences — especially for high-volume businesses that delay — are substantial. The framework has three important characteristics that every finance leader should understand before finalising their implementation plan.
First: there is no warning letter. Unlike some regulatory frameworks where the first violation results in a warning and subsequent violations attract fines, CD 106 applies from the mandatory date. There is no first-offence grace period, no warning communication, and no opportunity to remedy before the clock starts. The fine begins on the first day of non-compliance after the mandatory date.
Second: the penalty is continuous, not one-time. The AED 5,000 monthly penalty is not a fixed fine that is paid once and ends the matter. It accumulates every month until the violation is remedied. A business that takes six months to come into compliance after its mandatory date does not pay AED 5,000 once — it pays AED 30,000 plus the per-invoice violations for all the non-compliant invoices in those six months.
Third: CD 106 is the visible cost. The less visible costs — void invoices, buyer payment holds, FTA real-time reconciliation data gaps, and the triggered VAT audit risk — are not in CD 106. They arise from the interaction between the EIS framework and the existing UAE VAT and Tax Procedures Law. The Article 4 penalty overview in this series covers these hidden costs in full.
First: there is no warning letter. Unlike some regulatory frameworks where the first violation results in a warning and subsequent violations attract fines, CD 106 applies from the mandatory date. There is no first-offence grace period, no warning communication, and no opportunity to remedy before the clock starts. The fine begins on the first day of non-compliance after the mandatory date.
Second: the penalty is continuous, not one-time. The AED 5,000 monthly penalty is not a fixed fine that is paid once and ends the matter. It accumulates every month until the violation is remedied. A business that takes six months to come into compliance after its mandatory date does not pay AED 5,000 once — it pays AED 30,000 plus the per-invoice violations for all the non-compliant invoices in those six months.
Third: CD 106 is the visible cost. The less visible costs — void invoices, buyer payment holds, FTA real-time reconciliation data gaps, and the triggered VAT audit risk — are not in CD 106. They arise from the interaction between the EIS framework and the existing UAE VAT and Tax Procedures Law. The Article 4 penalty overview in this series covers these hidden costs in full.
THE COMPLETE CD 106 SUMMARY: FIVE POINTS
- AED 5,000 per month for failure to appoint ASP by deadline or failure to go live by mandatory date. Starts immediately. No warning period. Runs continuously until compliant.
- AED 100 per invoice for specific invoice-level violations from mandatory go-live date. Adds rapidly for high-volume businesses.
- No EIS penalties during the voluntary period — from July 1, 2026 until your mandatory date, regardless of errors.
- CD 106 runs alongside CD 40 of 2017 (VAT penalties) for VAT-registered businesses — both apply simultaneously from mandatory date.
- Voluntary disclosure reduces but does not eliminate penalties. It must be filed via EmaraTax and accompanied by active remediation of the violation.
The Law Is Clear — So Is the Action It Requires
Cabinet Decision No. 106 of 2025 is not a complex document. It establishes two penalties, defines when they apply, and protects the voluntary period. The complexity is not in the law — it is in the business consequences that follow from non-compliance, which extend well beyond the headline fine to void invoices, frozen payments, and audit exposure.
The action that CD 106 makes most clearly sensible is the one it explicitly protects: going live before your mandatory date. The voluntary period from July 1, 2026 is penalty-free by design — the drafters of MD 244 and CD 106 built this protection specifically to encourage early adoption and to give businesses a risk-free window to test and resolve issues. Using that window is not just strategic — it is the legally rational response to the penalty framework that CD 106 establishes.
Aiverix is an FTA-accredited Accredited Service Provider and certified Peppol Access Point. We can have Wave 1 businesses live in the voluntary pilot period — before your mandatory date creates any CD 106 exposure. Standard implementation takes 2−4 weeks. Request a no-cost compliance assessment at aiverix.ae.
The action that CD 106 makes most clearly sensible is the one it explicitly protects: going live before your mandatory date. The voluntary period from July 1, 2026 is penalty-free by design — the drafters of MD 244 and CD 106 built this protection specifically to encourage early adoption and to give businesses a risk-free window to test and resolve issues. Using that window is not just strategic — it is the legally rational response to the penalty framework that CD 106 establishes.
Aiverix is an FTA-accredited Accredited Service Provider and certified Peppol Access Point. We can have Wave 1 businesses live in the voluntary pilot period — before your mandatory date creates any CD 106 exposure. Standard implementation takes 2−4 weeks. Request a no-cost compliance assessment at aiverix.ae.