What is an EGS device, and why does each CR need one?
In NBR e-invoicing, invoices are not signed by a person. They are signed by an e-invoicing generation solution unit, an EGS device, that you register with the NBR. It is a software identity: a key pair, a certificate and a name.
One device per commercial registration
The NBR certificate names your VAT number and one commercial registration (CR). A business with several CRs therefore registers several devices under the same VAT number.
How registration works
- In the NBR e-invoice portal you generate a one-time password (valid for one hour; up to 100 can be created in one request).
- Your solution creates a key pair and a certificate signing request, and keeps the private key.
- The NBR returns a temporary compliance certificate, valid 30 days.
- You send sample invoices of each type for the NBR compliance check.
- After they pass, the NBR issues the production certificate, valid four years.
Why the private key matters
Whoever holds the private key can sign invoices in your name. It must be created inside the signing service, stored encrypted and never leave it. A good system never shows it to anyone, not even an administrator.
Sandbox and production are different
The NBR sandbox is a separate test system with a published test one-time password. Devices registered there do not appear in the portal and invoices sent there never reach the real platform. Use the production device for real pilot invoices and keep the sandbox device for development.
Renewal and revocation
Renew a device before its certificate expires, using a new one-time password. To stop a device from issuing invoices, revoke it. A controlled revocation asks a second person to approve it and checks that no invoice is left in an unknown state.