How to Choose a Peppol Access Point Provider: 9 Criteria to Check Before 2027

Choosing a Peppol access point used to be a technical procurement detail. In 2026 it became a compliance decision. Belgium has enforced Peppol-based B2B e-invoicing since April, the UAE's first phase goes live on 1 January 2027 on a Peppol-based five-corner model, and Slovakia's mandate starts the same day. If your provider cannot deliver, validate and report your invoices correctly, the consequences land on you, not on them.

This guide sets out nine criteria for evaluating a Peppol access point provider, the questions to ask in an RFP, and the red flags that show up in practice. It is written for finance, IT and compliance teams comparing providers for one country or for a multi-country rollout.

What a Peppol access point does (and why you cannot connect without one)

Peppol is a network of certified service providers that exchange documents on behalf of their customers. Businesses do not connect to Peppol directly. You connect to a Peppol access point (corner 2), which validates your invoice and sends it to your customer's access point (corner 3), which delivers it to your customer. This is the four-corner model. In countries that add tax reporting, such as the UAE and the planned Belgian e-reporting from 2028, invoice data also flows to the tax authority, making it a five-corner model.

Two roles matter when you compare providers:

• Access Point (AP): sends and receives documents over the Peppol transport protocol (AS4).
• Service Metadata Publisher (SMP): publishes your Peppol ID and the document types you can receive, so that senders' access points can find you.

Most buyers need a provider that runs both. If you have not yet started, our step-by-step article on how to join the Peppol network covers onboarding. This article focuses on the step before that: choosing who to onboard with.

9 criteria for choosing a Peppol access point provider

1. Verified certification, not a logo on a website

OpenPeppol publishes the official list of Peppol certified service providers. Each entry shows whether the provider is AP certified, SMP certified or both, and which Peppol Authority oversees it. Providers can be removed from the list if they are subject to non-compliance penalties, so check the live list at the time of signing, not a screenshot in a sales deck. A provider that is only SMP certified cannot send documents for you.

2. Readiness for the 2026–2027 network changes

The Peppol network itself is changing, and a provider that falls behind puts your invoice flows at risk. Three changes are worth asking about:

• ISO/IEC 27001 becomes mandatory. From 1 July 2027, every Peppol service provider must hold a valid ISO/IEC 27001 certification to keep operating on the network. OpenPeppol set interim deadlines in 2026 for submitting existing certificates or evidence of an ongoing certification project. Ask whether your provider is already certified and whether the scope covers its Peppol operations.
• New PKI certificates. Peppol moved to third-generation (G3) certificates in 2026, and G2 certificates expired on 1 April 2026. Any active provider should have completed this, but it is a quick test of operational maturity.
• SML migration. The Service Metadata Locator, the central lookup service, moved from the European Commission to OpenPeppol, and access points had to switch their lookup configuration by 31 August 2026.

3. National accreditation where the mandate requires it

Peppol certification is not always enough. Several mandates add a national approval layer on top:

• UAE: only an Accredited Service Provider (ASP) approved by the Ministry of Finance can exchange e-invoices. Businesses with revenue of AED 50 million or more must appoint an ASP by 30 October 2026 (extended from 31 July) and go live on 1 January 2027. Our UAE Peppol compliance guide explains the model.
• Slovakia: the 2027 mandate relies on certified delivery service providers.
• Belgium: no extra accreditation, but invoices must follow Peppol BIS Billing 3.0, and the tolerance period ended on 31 March 2026. The Belgian finance ministry's announcement on the tolerance period sets out how it was applied.

If you operate in more than one of these countries, check that the provider holds every approval you need, not only the Peppol one.

4. Specification and country coverage

Every Peppol access point supports Peppol BIS Billing 3.0, the Peppol implementation of the European standard EN 16931 (explained in our EN 16931 guide). Differences appear at the edges: national rules and CIUS variants such as XRechnung for German public-sector invoicing, Peppol PINT specifications such as the UAE's PINT AE, and readiness for upcoming e-reporting flows. Ask for a list of the specifications the provider has in production today, not on its roadmap.

5. Document types beyond the invoice

Peppol carries more than invoices and credit notes. Orders, order responses, despatch advice and catalogues also run over the network. If your supply chain already uses EDI for orders and delivery notes, a provider that handles both EDI and Peppol can run all flows through one integration instead of two.

6. ERP integration and conversion

The access point is only as good as the connection to your ERP. Ask how the provider receives your data (API, SFTP, ERP connector or web portal), which source formats it can convert (for example SAP IDoc, EDIFACT, CSV or custom XML), and whether it validates invoices against Peppol and national rules before sending them. Pre-send validation is what keeps invalid invoices from ever leaving your system.

7. Receiving, registration and master data

Receiving is where many projects slip. Your provider should register every legal entity under the correct Peppol identifier (such as a VAT or company registration number), advertise the right document types in its SMP, and keep that data consistent with the Peppol Directory. Mismatched or incomplete registrations are a common reason invoices cannot be delivered. Our article on the Peppol Lookup Service explains why participant data quality matters.

8. Monitoring, status messages and support

A technical delivery receipt confirms that the receiving access point got the file. It does not confirm that your customer accepted the invoice. Ask whether the provider supports business-level responses such as the Peppol Invoice Response (accepted, rejected, under query), how errors are shown to your team, and what service levels apply to uptime and support response times. For finance teams, this visibility is what turns compliance into faster payment.

9. Commercial terms, archiving and exit

Compare pricing on a like-for-like basis: setup fees, per-document or volume-tier pricing, charges for received documents, and the cost of adding new countries or document types. Check whether the provider archives invoices for the retention period your countries require and where that data is stored. Finally, ask how you would move your Peppol registration to another provider if you ever needed to, and how long that would take. A clear exit process is a sign of a provider confident in its service.

Peppol access point checklist: what to ask and what to watch for

One provider or several?

Peppol is designed so that one connection reaches every participant on the network. In practice, multi-country groups also face non-Peppol systems such as Poland's KSeF, Italy's SDI and France's approved platforms. Using one provider that covers Peppol and these national systems reduces the number of integrations, contracts and monitoring tools you maintain. Our Complete Guide to Global E-Invoicing Compliance sets out how to build that kind of framework, and the Compliance Tracker follows mandate changes country by country.

FAQ: Peppol access points

What is a Peppol access point?

A Peppol access point is a certified service that sends and receives electronic documents, such as invoices and orders, over the Peppol network on behalf of a business. Businesses cannot connect to Peppol directly and must use an access point provider.

Is a Peppol access point the same as a Peppol service provider?

Not exactly. A Peppol service provider is the company, and it can be certified to run an Access Point (AP), a Service Metadata Publisher (SMP) or both. Most businesses need a provider certified for both, so it can send their documents and register them to receive.

How do I check whether a Peppol access point is certified?

Check the official list of Peppol certified service providers on the OpenPeppol website. It shows each provider's AP and SMP certification and its Peppol Authority, and providers can be removed if they are penalised for non-compliance.

Can I switch Peppol access point providers later?

Yes. Your Peppol registration can be moved from one provider to another, but it must be coordinated so that invoices keep reaching you during the switch. Ask any new provider to explain its migration process before you sign.

Conclusion: choose for the mandate you face next, not only the one you face today

A Peppol access point provider should be certified on the live OpenPeppol list, ready for the ISO/IEC 27001 requirement in July 2027, approved wherever your mandates require it, and able to connect your ERP to every network you trade on. Checking these points now is far cheaper than switching providers after a go-live date.

Infinite IT Solutions (Infinite sp. z o.o.) is AP and SMP certified on the OpenPeppol list under the Polish Peppol Authority, an Accredited Service Provider in the UAE and a certified delivery service provider in Slovakia. Learn more about our Peppol access point and service provider offering. Contact our team to compare your current setup against this checklist and plan your Peppol connection.