Author: Hans Christian B Pedersen

OpenPeppol is making ISO/IEC 27001 certification mandatory for all Peppol Service Providers. Learn why the requirement has been introduced, who it affects, what ISO 27001 readiness really means, and the practical steps providers should take to prepare before the implementation deadline.

The Peppol network is gradually evolving from a document exchange framework into infrastructure capable of supporting machine-coordinated commercial processes across organizations and jurisdictions.

That may sound abstract at first. But if we look at where the network seems to be heading, particularly through the transition from Message Level Response (MLR) to Message Level Status (MLS), an interesting picture starts to appear.

On 23 June 2026, HMRC's Tax Update 2026 confirmed Peppol as the core interoperability network for the UK's e-invoicing mandate, settling a key open question for businesses and software vendors. This post breaks down what the decision means, the decentralised four-corner model, the confirmed 1 April 2029 scope for B2B and B2G VAT invoices, and what still sits open ahead of the Budget 2026 roadmap, including the emerging PINT UK format. The work of getting ready for the mandate starts now.

OpenPeppol published the SML Insourcing Plan for 2026 and by end of May all Peppol Certified Service Providers must have made change to new address. The main point is simple. This is an infrastructure move. It is not a rewrite of the Peppol network. It is not a new way to exchange documents.

The UK’s mandatory e-invoicing mandate starts on 1 April 2029, but software vendors need to prepare now. Businesses that invoice UK companies should assess Peppol readiness, Access Point and SMP infrastructure, and build-vs-buy options well ahead of compliance deadlines.

The days of emailing a PDF invoice to French business partners are numbered. We break down the mandate, the five-corner model, and how to get compliant before the deadline.

Belgium’s B2B e-invoicing mandate is now law. From 1 January 2026, nearly all Belgian VAT-registered businesses must send and receive structured electronic invoices using Peppol BIS Billing 3.0, aligned with EN 16931. PDFs and paper invoices will no longer suffice. The framework also prepares Belgium for near real-time VAT e-reporting by 2028, with penalties for non-compliance already defined.

The Peppol Network has become the global standard for secure and effective document exchange for public and private sectors. Using the four-corner model and OpenPeppol's certification program for service providers, certified Peppol Access Point ensures validation of each document entering the network creating compliance and trust between senders and recievers.The Peppol Network has the potential to cut costs and boost digital efficiency worldwide.

The OpenPeppol PKI migration is a mandatory, breaking change that moves the Peppol network from G2 to G3 certificate authority chains. Service Providers must support both G2 and G3 by February 2026, with all G2 certificates revoked on 1 April 2026. The migration increases security but adds technical complexity, making dual-PKI support, testing and timely cut-over essential to avoid service disruption.

OpenPeppol is introducing mandatory security updates for the Peppol network. From 1 February 2026, all Service Metadata Publishers (SMPs) must operate exclusively over HTTPS, and CNAME-based SML lookups will be fully replaced by NAPTR records. These changes improve security and scalability but require Access Point and SMP providers to update certificates, DNS records and software in line with strict transition timelines.