How to set up your own Peppol Access Point: run it yourself or outsource operations

Some organizations need to hold the Peppol Service Provider role in their own name: a software vendor entering a mandated market, a service provider applying for national accreditation, or a group that wants full control of its e-invoicing infrastructure. They usually compare two routes. One is to build and run the Access Point yourself, for example on open-source software such as Oxalis or phase4. The other is to outsource the operations through a Hosted Access Point, where your organization holds the role and the certificates while another provider operates the infrastructure.

If what you need is Peppol for many customers inside your own product, you may not need the Service Provider role at all. With Embedded Peppol, Qvalia holds the role and operates the Access Point, and you register and connect your customers through one API, each with its own Peppol ID where required.

This guide compares the routes as of October 2026: what stays your responsibility in either case, what open-source Access Point software covers and what it leaves to you, the network requirements that take effect in 2027, and where national accreditation adds its own conditions.

Holding the role means signing a Service Provider Agreement, meeting OpenPeppol’s security and reporting requirements, and answering to the relevant Peppol Authority for the traffic you carry. If the goal is to let your customers send and receive e-invoices from your product, you can do that without becoming a Service Provider. With Embedded Peppol or a white-label platform, Qvalia holds the role and the certification obligations.

The role is worth taking on when a regulator, a contract or your business model requires it. Examples are national regimes such as the UAE’s, where the accredited provider must be the party of record, and organizations that sell Peppol access as their own service. The partner overview compares the three delivery models.

The deciding question is often the market. Where Qvalia holds the accreditation your customers need, Embedded Peppol covers it. Where national rules require you to be the accredited party yourself, or where you sell Peppol access under your own identity, you need the role.

Whether you run the Access Point yourself or use a Hosted Access Point, these obligations sit with your legal entity:

OpenPeppol’s fees are the same in both cases. For a company with 11 to 50 employees in the Access Point and SMP category, OpenPeppol lists EUR 2,100 to join, EUR 3,700 a year, plus a EUR 2,500 certification fee that is billed on first certification and then added to the annual fee (OpenPeppol fees).

Several open-source projects implement the Peppol AS4 profile, the protocol Access Points use to exchange documents. They differ in how much they include beyond transport and in how they fit into your systems.

Oxalis is widely used in the Peppol network. It was first developed by SendRegning and maintained by the Norwegian agency Difi until March 2020. The classic Oxalis-AS4 line is frozen at version 7.2.0, and the project directs users to Oxalis-NG, which reached version 1.5.0 in September 2026. Its release notes show what keeping any Access Point current involves: MLS support, removal of the G2 Peppol PKI after OpenPeppol revoked those certificates on 20 April 2026, and new default domains as OpenPeppol takes over the SML from the European Commission.

Sources: the projects’ own repositories and KoSIT’s Comparison of AS4 solutions for Peppol (August 2023). Check each project’s current release before you choose.

A production Access Point needs more than AS4 transport. Depending on the software you choose, some of these parts are included and the rest are yours to build and operate:

For a team that already runs Java services and PKI in production, none of this is unusual. It is a permanent operating commitment rather than a one-time project.

Sources: OpenPeppol’s MLS phase-in plan (July 2026), the ISO/IEC 27001 timeline published by Peppol Authority Italy and the End User Statistics Reporting specification. Check OpenPeppol’s current plans before you commit to a schedule.

OpenPeppol sets the baseline. Many markets add their own approval, and it applies whichever software runs the Access Point.

E-invoicing in the UAE runs through Accredited Service Providers approved by the Ministry of Finance under Ministerial Decision No. 64 of 2025, as amended by Ministerial Decision No. 56 of 2026. Applicants need, among other things, a UAE company with paid-up capital of at least AED 50,000, ISO 22301 certification, ISO/IEC 27001 for the product they deliver on, professional indemnity, crime and cyber fraud insurance, and completed onboarding and production testing with the Federal Tax Authority. A third-party product is allowed, and the applicant keeps full responsibility for the service. Read the UAE e-invoicing guide.

France’s reform went live on 1 September 2026: every VAT-registered business must be able to receive e-invoices, and small and micro businesses start issuing on 1 September 2027. Invoices are exchanged through plateformes agréées (approved platforms), which the tax administration DGFiP registers once they meet the regulatory requirements and pass technical and interoperability tests. The DGFiP publishes the list of registered platforms (Ministry of the Economy, January 2026). It is also the Peppol Authority for France and sets its own requirements for Service Providers operating there. A platform that is registered or applying as a plateforme agréée can run its Access Point on Qvalia’s infrastructure under its own Service Provider role. Read more on our France e-invoicing page.

Domestic e-invoicing from 1 January 2027 runs through certified delivery service providers on the Financial Administration’s list. A platform that does not want its own certification can be registered as a delivery service intermediary under a certified provider, which then takes responsibility for the intermediary’s compliance.

The Norwegian Peppol Authority requires providers to verify end users against the Central Coordinating Register for Legal Entities, check that the person signing for an end user is authorized to do so, and report statistics. Public sector receivers must be registered in ELMA, the central SMP operated by Digdir. More in our ELMA article.

Oman runs its own accreditation for Fawtara service providers, described on our Oman e-invoicing page.

The Australian Taxation Office (ATO) is the Peppol Authority in Australia and accredits Access Points and SMPs. Applicants sign the Peppol Service Provider Agreement and go through due diligence, including a criminal record check and professional indemnity insurance of at least AUD 1 million per occurrence. They complete the A-NZ eInvoicing Security Questionnaire, as a self-assessment or with an independent audit against ISO/IEC 27001 or the Australian or New Zealand Information Security Manual (ISM), and pass the Peppol Testbed, including the PINT A-NZ interoperability tests. Accreditation is reviewed every year (ATO accreditation process). Read more about PINT A-NZ.

New Zealand’s Peppol Authority sits within the Ministry of Business, Innovation and Employment (MBIE). Australia and New Zealand have aligned their accreditation processes: a provider accredited in Australia can request mutual accreditation from the New Zealand Peppol Authority. Both countries use PINT A-NZ.

In Singapore, only Access Point providers accredited by IMDA may operate on the InvoiceNow network, and they are bound by IMDA’s own Peppol requirements. The tax authority IRAS is phasing in the GST InvoiceNow Requirement for GST-registered businesses: new voluntary registrants since 1 April 2026, then existing businesses by turnover from 1 April 2028, until all are covered on 1 April 2031. A copy of the invoice data reaches IRAS through the network (IRAS FAQ, September 2026). Read more about PINT SG.

Building it yourself fits when:

A Hosted Access Point fits when:

Embedded Peppol fits when: