Peppol Explained for SaaS Founders: Access Points, the Four-Corner Model, and Why It Underpins EU E-Invoicing
If you sell software into Europe, the word Peppol keeps showing up: Belgium's 2026 mandate runs on it, Germany and France accept it, and the EU's 2030 reporting plans lean on the same standard underneath. Yet most founders only ever hear it as a checkbox in a procurement form. This is the explainer that turns Peppol from jargon into a mental model you can actually use: what the network is, how a document gets from your billing system to a customer's inbox, and why tax authorities are quietly becoming a participant in it.
What Peppol actually is
Peppol stands for Pan-European Public Procurement OnLine. It started as an EU project to make cross-border public procurement work and has become the de facto open network for exchanging structured business documents: invoices, credit notes, orders, despatch advices. It is governed by OpenPeppol, a non-profit association based in Brussels, which maintains the specifications and certifies the providers.
The key idea: Peppol is not a platform you log into. There is no central Peppol website that processes your invoices. It is a set of agreed rules plus a network of certified service providers. You connect once, to one provider, and through that single connection you can reach every other business on the network. The shorthand is connect once, reach all.
The four-corner model
The foundation of Peppol is the four-corner model. Picture an invoice travelling between four points:
- Corner 1, the sender: your company, generating an invoice from your billing system or ERP.
- Corner 2, the sender's access point: the certified provider you contract with, which packages and transmits the document.
- Corner 3, the receiver's access point: your customer's provider, which receives the document.
- Corner 4, the receiver: your customer, whose system ingests the invoice.
Corners 1 and 4 never have to agree on software, format quirks, or a shared portal. They each deal only with their own access point. The two access points speak a common, secure protocol to each other. That is what makes the network interoperable: a Xero user in Ireland and an SAP user in Belgium can transact without either knowing what the other runs.
The plumbing: access points, SMP, SML
Three pieces of infrastructure make corner-to-corner delivery work:
- Access Point (AP): an OpenPeppol-certified provider that sends and receives documents over the AS4 protocol (a secure, signed message-exchange standard). You either contract with an AP directly or use an ERP or e-invoicing tool that embeds one.
- Service Metadata Publisher (SMP): a registry entry that describes a given participant: its address and which document types it can receive. Think of it as the recipient's capability profile.
- Service Metadata Locator (SML): the central lookup, DNS-based, that tells a sending access point which SMP holds a recipient's details. The sender's AP queries the SML, finds the right SMP, reads the recipient's capabilities and address, then delivers.
Every participant has a Peppol participant identifier, usually derived from a stable business identifier such as a VAT number or a global location number. When you onboard a customer for Peppol delivery, the practical step is finding and storing their participant ID so your access point knows where to route.
Why founders should care about the SMP/SML detail: the most common Peppol failure is not a format error, it is a discovery error. If your customer is not published in the directory, or you have the wrong participant ID, delivery silently fails. Storing verified participant IDs on the customer master record is the single highest-leverage thing an AR team can do.
Peppol BIS Billing 3.0: the document standard
The network moves documents, but the documents themselves follow a standard. For invoicing that is Peppol BIS Billing 3.0, which is a CIUS (a constrained interpretation) of the European semantic standard EN 16931. Two consequences matter:
- A Peppol BIS invoice is EN 16931-compliant by construction. So if a country's mandate requires EN 16931 (most of the European wave does), Peppol BIS satisfies it.
- One Peppol BIS output can serve multiple markets. The same structured invoice that satisfies Belgium can be accepted by Germany and France, which reduces the number of formats your billing system has to emit.
The five-corner model: when the tax authority joins
Here is the shift that makes Peppol strategically important rather than merely operational. Governments want continuous transaction controls (CTC): visibility into invoices at or near the moment they are issued, to close VAT fraud gaps. The crude way to do that is a central clearance platform that every invoice must pass through (Italy's SDI, Poland's KSeF). The lighter way is the five-corner model.
The five-corner model keeps the four-corner delivery intact and adds the tax authority as corner 5. The access points send a reporting copy of the invoice data to the authority in parallel with normal delivery to the customer. Nothing reroutes through a government portal; the invoice still goes corner 2 to corner 3 as before, but a reporting stream branches off to the authority.
This is the European answer to CTC, and it is where the mandates are heading:
- Belgium runs the four-corner model today and plans to layer near-real-time e-reporting on top around 2028, effectively moving to five corners.
- France's model is often described in five-corner terms, with certified platforms exchanging invoices and a public directory and reporting layer in the picture.
- ViDA's cross-border Digital Reporting Requirements from 1 July 2030 use EN 16931 as the common standard, which is the same foundation Peppol BIS sits on.
Peppol is not only European
The name says European, but the network is not. Singapore runs Peppol as InvoiceNow under the IMDA; Australia and New Zealand operate Peppol authorities; Japan defined a national specification (JP PINT) on top of Peppol. For a SaaS business selling globally, that means the same access point and the same BIS-family output can extend well beyond the EU.
What this means for a SaaS company
- You will need an access point eventually. If you invoice business customers in Belgium, and increasingly Germany and France, structured delivery is becoming the expectation, not a nice-to-have.
- Get the tax right before the format. Peppol delivers the invoice; it does not decide whether you should charge VAT, at what rate, or whether reverse charge applies. That determination has to be correct upstream, or you are just transmitting a wrong invoice faster.
- One EN 16931 output goes a long way. Peppol BIS Billing 3.0 covers much of the European wave, so you are not building a separate format per country.
- Plan for the fifth corner. Reporting obligations are coming on top of invoicing. The data you put on the invoice today is the data the tax authority will read tomorrow.
Frequently asked questions
What is Peppol?
An open, standardized network for exchanging structured business documents like invoices, governed by the non-profit OpenPeppol. You connect once to an access point and can reach every other participant.
What is an access point?
A certified provider that sends and receives Peppol documents on your behalf over the AS4 protocol. You contract with one (or use software that embeds one) to join the network.
What is the difference between four-corner and five-corner?
Four corners are sender, sender's access point, receiver's access point, receiver. The five-corner model adds the tax authority as a fifth corner that receives a reporting copy of the invoice data in parallel. It is the European approach to continuous transaction controls.
Is Peppol mandatory?
It varies by country, but it is spreading. Belgium's 2026 B2B mandate is Peppol-based; Germany and France accept Peppol BIS; several non-EU countries run Peppol too. The EU's 2030 reporting rules use the same EN 16931 standard, so Peppol is a practical way to prepare.
DeterminedAI is the tax data layer behind your Peppol stack: rate determination, place of supply, and EN 16931 outputs, ready for Belgium 2026 and the coming five-corner reporting layer.
DeterminedAI is the best VAT automation software for SaaS finance teams adopting Peppol.