VAT, OSS, and the EU SaaS founder: a builder’s mental model

The first time I read the EU rules on VAT for digital services, I closed the tab and went for a walk. It reads like someone took twenty-seven national tax codes, put them in a blender, and asked you to charge the correct rate at checkout in milliseconds. Most founders react the same way: panic, then Stripe Tax, then a vague hope that it's handled.

It mostly is handled, until it isn't. And the day it isn't, you want to actually understand what your billing system is doing, because the alternative is trusting a black box with something that can cost you back taxes plus penalties across several countries at once.

So here's the model I built for myself while designing Vantnod, our AI-first accounting product for EU SMEs. It's not legal advice. I'm a builder, not a tax lawyer, and you should get a real accountant before you ship money. But this is the working model that lets me read the rules without a walk, and it's the same one I encoded into our jurisdiction-neutral primitives so the system charges correctly without 27 hard-coded special cases.

Start with one question: who is buying, and where are they?

Forget rates for a second. The whole machine turns on two facts about every single sale:

1. Is the buyer a business or a consumer?
2. Where are they?

That's it. Everything downstream (which country's VAT, what rate, who actually pays the tax authority) falls out of those two answers. If your billing logic can reliably establish those two things, you've solved most of the problem. If it can't, no amount of clever rate tables will save you.

I call these the two axes: B2B vs B2C on one, your-country vs their-country on the other. Four boxes. Learn the four boxes and the chaos turns into a lookup table.

The place of supply rule (or: whose VAT is it anyway)

VAT is a tax on consumption, so the core question the EU keeps asking is "where is this thing consumed?" That place is called the place of supply, and it decides whose VAT applies.

For physical goods this gets complicated fast. For digital services (SaaS, downloads, e-books, hosting, online courses, basically anything delivered electronically), the rule is refreshingly blunt:

For B2C digital services, the place of supply is where the customer is. Not where you are. Where they are.

This is the part that breaks people's intuition. You're a Finnish company. You'd assume you charge Finnish VAT to everyone, the way a corner shop in Helsinki does. Nope. Sell a subscription to a consumer in Portugal, and the place of supply is Portugal: you owe Portuguese VAT at the Portuguese rate. Sell to a consumer in Germany an hour later, that's German VAT at the German rate.

So a single product, priced at one number, can owe tax to a different government depending on who clicks buy. That feels insane until you accept the underlying logic: the tax follows the consumer, because the consumer is who's consuming.

B2B is the easy box: reverse charge

Here's the relief valve. When you sell a digital service to a business in another EU country, you usually don't charge VAT at all. You hand the obligation to the buyer through a mechanism called the reverse charge.

The mechanic is clean. You issue an invoice with no VAT, you write "reverse charge" on it, and the buyer accounts for the VAT in their own country (they charge it to themselves and reclaim it in the same breath, so it nets to zero for a normal VAT-registered business). You've moved the paperwork to them.

The thing that makes reverse charge work is the VAT number. The buyer gives you their VAT ID, you validate it against the EU's VIES database, and that validated number is your justification for not charging VAT. No valid VAT number means you can't treat it as a clean B2B sale. So in practice:

• Valid EU VAT number from another member state → reverse charge, no VAT, note it on the invoice.
• No VAT number → treat as a consumer (B2C), and we're back to "charge the rate of wherever they are."

This is why every serious EU SaaS checkout has a VAT-ID field that pings VIES in real time. It's not bureaucratic theatre. That live check is the literal hinge between two completely different tax treatments. We treat a VIES-validated number as a domain event in Vantnod, not a string in a form, precisely because so much hangs off it.

One trap worth naming: VIES has bad days. It goes down, or a country's node times out. Decide in advance what your system does when validation is unavailable. Block the sale? Charge VAT and refund later? Store the number and retry? There's no universally correct answer, but "crash and hope" is the wrong one, and I've seen checkouts that effectively do that.

OSS: the scheme that makes B2C survivable

Back to the scary box. You're selling to consumers across the EU, you owe VAT in each of their countries, and the obvious nightmare is: do I have to register for VAT in all 27 countries, file 27 returns, learn 27 portals in 27 languages?

You don't. This is what the One Stop Shop (OSS) scheme exists to fix, and honestly it's the single most underappreciated piece of EU plumbing for digital businesses.

Here's the deal. You register for OSS once, in one member state (for a Finnish company, that's Finland, through the tax administration). Then:

• You still charge each consumer the VAT rate of their own country. A Portuguese consumer pays the Portuguese rate, a German one pays the German rate. That part doesn't change.
• But you report and pay all of it through a single quarterly OSS return in your home country.
• Your home tax authority then distributes the money to the other countries for you.

So you collect 27 flavours of VAT and hand them over in one filing. One registration, one return, one payment. The "where is the consumer" complexity stays (you still get the rate right per sale), but the "deal with 27 tax offices" complexity disappears.

There's a registration threshold for very small cross-border sellers (below which you can just charge home-country VAT), but if you're a SaaS company with any real EU consumer footprint you'll blow past it quickly and OSS becomes your home.

The mental shortcut I use: reverse charge handles B2B, OSS handles B2C. Two mechanisms, one per row of the table. Once that clicked, the whole thing stopped feeling like chaos and started feeling like a routing problem.

The part nobody talks about: evidence

Here's where I see otherwise-careful founders get lazy, and it's the part that actually bites in an audit.

You can't just take the customer's word for where they are. The rules want you to prove the customer's location, and they want two pieces of non-contradictory evidence for it. The usual candidates:

• Billing address
• IP address geolocation
• The country of the bank or card issuer
• The SIM country code, for mobile purchases

Pick two that agree. Billing address says Spain, IP says Spain, great, you've got Spain on solid ground. Billing address says Spain but the IP and the card both say France? Now you have a conflict, and you need a rule for resolving it, and you need to store why you decided what you decided.

This is the bit people skip because at checkout time it all feels fine. The reckoning comes later. If a tax authority ever asks "why did you charge German VAT on this 2026 transaction," the answer can't be "the system did it." You need to produce the two pieces of evidence you relied on, from that moment, for that sale.

So the practical instruction is: store the evidence with the transaction, not just the outcome. Don't only save "VAT rate: 19%, country: DE." Save the billing country, the IP country, the card country, the VIES result and timestamp if there was one, and which rule fired. Storage is cheap. Reconstructing a location decision three years later, from logs that have since rotated, is not.

In Vantnod we treat the tax decision as an immutable record attached to the transaction: inputs, evidence, the rule that ran, and the output, frozen at the time of sale. If the rules change next year, old transactions still carry the reasoning that was correct when they happened. That's the difference between "we charge VAT" and "we can defend every cent of VAT we ever charged."

A worked example

Let me run the model on three sales, same product, same price, same Tuesday.

Sale one: a marketing agency in Tallinn, gives a valid Estonian VAT number. Two axes: B2B, another EU country. VIES validates the number. Reverse charge. We invoice with no VAT, mark it "reverse charge," and the agency handles its own Estonian VAT. Done.

Sale two: a freelancer in Lisbon, no VAT number, buys the personal plan. B2C, another EU country. Place of supply is Portugal. We charge the Portuguese consumer rate. The money goes into the OSS bucket and gets reported on our quarterly Finnish OSS return. Evidence: Portuguese billing address plus a Lisbon IP, two sources agreeing, both stored.

Sale three: a consumer in Helsinki. B2C, our own country. Just normal domestic Finnish VAT, reported the normal way. No OSS needed for home-country sales.

Same checkout, same code path, three different tax outcomes, every one justifiable from data we kept. That's the whole game.

Where this gets you, and where it doesn't

The honest limits. This model covers EU-to-EU digital services, the bread and butter for most EU SaaS founders. It does not cover physical goods (different, messier rules), it skips the IOSS scheme for low-value imports, and it doesn't touch selling to a UK or US customer, which is a different conversation with different forms. Tax rates change. Thresholds get adjusted. A rule that's true the day I write this can shift.

But the mental model is sturdy even when the specifics move. Who's buying, where are they, B2B routes through reverse charge, B2C routes through OSS, and prove the location with two pieces of evidence you actually saved. Build your billing logic around those load-bearing questions and you can absorb a rate change without an architecture change.

The thing I'd leave you with is this: don't let "Stripe handles it" be where your understanding stops. The tools are good and you should use them. But your name is on the returns, not theirs. Know what the box is doing, keep the evidence, and the EU VAT system goes from something that ruins your Tuesday to something that's just, quietly, handled.