Peppol Access Point Deployment Models: Build vs. Buy Analysis and 2027 Compliance Obligations

Context

The Peppol network, a critical infrastructure for electronic invoicing in the EU and beyond, is governed by OpenPeppol. As of October 2026, organisations must choose between three primary deployment models for their Peppol Access Point: self-hosted open-source solutions, hosted Access Points operated by third parties, or embedded models integrated into existing platforms. This decision is not merely technical but also carries significant regulatory and financial implications.

The urgency of this decision is amplified by the 2027 compliance deadlines. By 1 July 2027, all Peppol Service Providers (PSPs) must achieve ISO/IEC 27001 certification, a requirement with no grandfathering provisions. Additionally, Message Level Status (MLS) capabilities—both receiving and sending—must be implemented by 28 February 2027 and 31 March 2027, respectively. These deadlines are non-negotiable and apply uniformly across all deployment models.

Deployment Model Landscape

Self-Hosted Open-Source

Organisations opting for a self-hosted open-source model bear the full responsibility for compliance, certification, and operational maintenance. Available software stacks include Oxalis-NG (LGPL-3.0, standalone, v1.5.0 as of September 2026), phase4 (Apache-2.0, library-mode), phoss-ap (Apache-2.0, standalone), and Domibus (EUPL-1.2, the EU Commission reference implementation). While the software itself is cost-free, the operational burden includes managing PKI certificates, ensuring continuous compliance with OpenPeppol standards, and maintaining network connectivity.

The revocation of all G2 PKI certificates by OpenPeppol on 20 April 2026 serves as a cautionary tale. Any self-hosted deployment that had not migrated to the current PKI by this date would have lost network connectivity, highlighting the operational risks inherent in self-hosted models.

Hosted Access Point

In the hosted model, a third-party PSP operates the Access Point infrastructure on behalf of the client. This approach reduces the operational burden but still requires the client to maintain OpenPeppol membership and a Service Provider Agreement (SPA) if they wish to hold PSP status. Alternatively, clients can connect as corner-2 or corner-3 participants through the hosted provider's credentials.

This model is particularly attractive for organisations seeking to avoid the complexities of PKI management and continuous compliance monitoring. However, it does not absolve the client from all regulatory responsibilities, particularly those related to ISO/IEC 27001 certification and MLS capabilities.

Embedded Model

The embedded model integrates Access Point capabilities into existing platforms or ERPs via API or SDK. This abstraction of network-layer operations from the end user can simplify integration and reduce operational overhead. However, it requires careful vendor selection to ensure compliance with all Peppol standards and upcoming regulatory obligations.

Regulatory Obligations

Regardless of the deployment model chosen, all Peppol Service Providers must comply with specific regulatory obligations. OpenPeppol membership and a signed Service Provider Agreement are mandatory for any entity acting as a PSP. Additionally, ISO/IEC 27001 certification becomes mandatory by 1 July 2027, with no grandfathering provisions in place.

Message Level Status (MLS) capabilities are another critical requirement. Receiving capability is required by 28 February 2027, while sending capability and response-time enforcement must be in place by 31 March 2027. These obligations apply network-wide and cannot be waived by deployment model choice.

Financial Considerations

The financial implications of Peppol integration vary significantly depending on the deployment model. For organisations in the 11–50 employee band, the costs include a EUR 2,100 joining fee, EUR 3,700 annual membership, and EUR 2,500 certification fee. This totals EUR 8,300 in the first year, excluding infrastructure, staffing, and audit costs.

Self-hosted models may incur additional costs related to PKI management, compliance monitoring, and operational maintenance. Hosted models, while reducing some of these costs, still require investment in OpenPeppol membership and certification. Embedded models may offer cost savings by leveraging existing infrastructure but require due diligence in vendor selection to ensure compliance.

Geographic Scope

While the Peppol network is predominantly used within the EU, its reach extends globally. Outside the EU, national regimes impose additional layers of regulation. For example, the UAE requires Accredited Service Providers under Ministerial Decision No. 64 (2025) and No. 56 (2026), with a minimum AED 50,000 paid-up capital. This creates a distinct accreditation track separate from OpenPeppol membership, adding complexity for organisations operating in multiple jurisdictions.

Implications for Organisations

Organisations must carefully evaluate their deployment model choices against the backdrop of upcoming regulatory deadlines. The permanent, ongoing nature of PSP obligations—including ISO 27001 audits, MLS enforcement, and PKI rotation—underscores the importance of selecting a sustainable deployment model.

Self-hosted models offer flexibility but require significant internal resources for compliance and maintenance. Hosted models reduce operational burden but still necessitate investment in membership and certification. Embedded models provide simplicity but require rigorous vendor due diligence to ensure compliance.

Outlook and What to Watch

Looking ahead, organisations should monitor developments in OpenPeppol governance, particularly any updates to the ISO/IEC 27001 certification process and MLS requirements. The operational risks associated with self-hosted models, as illustrated by the PKI certificate revocation event, highlight the importance of proactive management.

Additionally, organisations operating in multiple jurisdictions should stay informed about national regulatory requirements, such as those in the UAE. These additional layers of complexity necessitate careful planning and resource allocation.