A tax authority can be certain a transaction is correct at the moment it happens, and still never hold the transaction itself. That certainty is what this architecture delivers. It is the foundation behind a working prototype, developed and tested with the Netherlands Tax Administration in an R&D setting, where market parties joined the trials. The same foundation carries far more than VAT.
Public oversight has leaned on the same recipe for thirty years. Collect data centrally, analyse it in batches, check it after the fact. That recipe assumed the central store was the safe place to keep everything.
That assumption has shifted. Central data collection has become far more expensive to defend. AI lowers the cost of phishing, social engineering and credential attacks against any central database, and it does so at scale. The larger the store, the more attractive the target. An architecture that made sense when attacks were costly and manual looks very different once attacks are cheap and automated.
Three forces are converging on the same architectural answer.
Geopolitics. Europe is moving away from dependence on the United States and China. Sovereignty has turned from a slogan into a procurement criterion.
Regulation. ViDA, eIDAS2, the AI Act, MiCA and CSRD all ask parties to exchange data with each other, and all ask for privacy guarantees while they do it. Under ViDA, real-time digital reporting for intra-EU transactions applies from July 2030. eIDAS2 wallets are issued by the end of 2026, with mandatory acceptance across the regulated private sector by the end of 2027. DAC8 applies from January 2026. The deadlines are close, and they all ask for the same capability.
Society. Trust in "trust us with the data" as an architecture has worn thin. After a run of high-profile failures in how personal data was handled, the public no longer accepts central collection as a self-evident default.
The honest answer to all three is the same. Keep data at its source, and share proof instead of content.
The foundation is four reusable building blocks. They stay the same whether the application is VAT, gambling tax or construction.
Event streaming. Today, tax runs on quarterly or monthly returns, batch processing, and correction after the fact. With this architecture, every payment is an event, processed at the moment itself, with verification within milliseconds. The same pattern fits VAT, gambling-tax transactions and time registration in construction. In each, the economically relevant moment is the right moment to verify for tax. In the VAT pilot, VAT splits off to the tax authority at the moment of payment, the rest goes to the business. No separate filing, because the proof sits inside the transaction itself.
Digital identity. Today, answering "who am I dealing with?" means large-scale data collection and copies of personal data. With this architecture, verifiable digital identities establish who is acting, a business, a platform or an agent, with certainty and without personal data being shared. The system verifies identity, not the identity file. That makes oversight of foreign parties, platforms and autonomous AI agents possible without breaking the privacy principle.
Cryptographic proof. Today, oversight relies on records that are checked afterwards, which means reconstruction, matching and repair. With this architecture, every transaction is recorded in a shared log, immutable and verifiable. Not a coin, but a technical way to record that data has not changed since the moment it was written. Inspectors verify the tax base directly, without heavy after-the-fact audits.
Privacy-preserving verification. Today, oversight and privacy pull against each other, and bulk data aggregation is ever harder to justify. With this architecture, a business proves something is correct without the underlying detail becoming visible. It can show the right VAT rate was applied and remitted without exposing every invoice line. Across borders, it can show tax was paid without exchanging full datasets. That fits accounting software and cross-border compliance.
The insight underneath all four: the problem does not sit in the individual taxes, it sits in the execution logic beneath them. This is compliance by design. The architecture enforces the rule, rather than reporting on it later.
The privacy in "certainty without seeing everything" comes from privacy enhancing technologies. Not one technology, but three families.
01. Cryptographically signed recording. Every transaction leaves a signable fingerprint. Not the content, but the proof that a transaction happened, between which verified parties, at what moment, and with which tax parameters.
02. Selective disclosure. A business can show its VAT is correct, at the right rate, on the right amount, without sharing the invoice lines. Mathematically proven, and verifiable for an inspector.
03. Attribute-blind monitoring. The authority sees patterns and outliers in aggregated flows. No identity of sender or receiver, unless it is requested in a targeted, authorised way. Inspection stays as sharp as it is today, without the bulk storage.
One image holds all three together.
A postal carrier can prove that an envelope was delivered without ever knowing what is inside. The letter's secrecy stays intact, and the act is still recorded beyond dispute.
That is privacy-preserving verification in a sentence. The authority gets certainty about compliance without having to see everything. Same certainty, far less data.
Keys stay at the edge, with their owner. The architecture has no master key.
The difference with classical PKI matters here. Standard key-management systems rotate keys and use hardware modules, yet they still keep a chain of trust in one place. Here, cryptographic keys are never architecturally held by a single party. The segregation is built, not contractually promised, and the technology provider keeps no copy either.
An attacker who compromises the central infrastructure gets envelopes that no one in the network can open alone. Sovereignty then follows on its own. The system runs on-premise or in EU data centres, distributed, with no dependence on a single country or a single vendor.
Read as one grid, the change is simple to state.
From more data after the fact to more certainty up front.