Everything you don't need to know about Peppol

Jon Højlund Arnfred

Peppol is becoming increasingly widespread, not just in Denmark and Europe, but also in Asian countries such as Singapore and Japan, and in Oceania, where Australia and New Zealand have joined. In 2025, Nigeria became the first African country fully connected to the Peppol network. The network enables companies to send structured business documents, including invoices, securely and efficiently.

If you would like to learn a little about the different components of Peppol, read on. If you just want to send and receive invoices through Peppol, skip this post—we already have the solution for you. Book a meeting with us. Otherwise, let's get into it.

Peppol's four corners

Peppol is often described as a model with four “corners”. Those four corners are:

  1. The sender: The company issuing a document, such as an invoice.
  2. The sender's Access Point: The certified service provider the sender is connected to. It validates the document and forwards it onto the network. It does this by using the recipient's Peppol ID to look up the SML (Service Metadata Locator) and find out which SMP (Service Metadata Publisher) the recipient is registered with. In Denmark, a Peppol ID is typically a CVR number (the Danish business registration number) or a GLN/EAN with a scheme prefix: 0184 for CVR and 0088 for GLN/EAN.
  3. The recipient's Access Point: The certified service provider the recipient is connected to. The recipient's Access Point validates the signature, acknowledges receipt to the sender's Access Point, and forwards the document to:
  4. The recipient: The company or public authority receiving the document.

The clever part of this model is that corners 1 and 4—the sender and recipient—each need only one agreement to send and receive a document. They only need an agreement with an Access Point. Communication between corners 2 and 3, where the document is actually transmitted, is standardised. You could perhaps say that only corners 2 and 3 are really part of the Peppol network. The sender and recipient are simply its users.

Who runs the network?

The Peppol network is governed by the non-profit organisation OpenPeppol. Several countries also have a Peppol Authority—in Denmark, this is the Danish Business Authority—which has the mandate to approve Access Points. The actual conformance test and PKI certificate, however, come from OpenPeppol. PKI stands for Public Key Infrastructure, and every Access Point needs a digital certificate to participate in the network at all.

AS4 and the alphabet of standards

Communication between Access Points takes place over the AS4 protocol. AS4 is what is known as Peppol's transport layer, and it is an OASIS standard. Named after the band? No. OASIS stands for Organization for the Advancement of Structured Information Standards. It is simply an international standards organisation, and many of Peppol's building blocks are OASIS standards.

AS4 is functionally related to the older AS2, an IETF standard that is still widely used in retail and e-commerce. IETF stands for Internet Engineering Task Force—yet another standards organisation, which develops and publishes internet standards known as RFCs (Requests for Comments), such as TLS and SMTP.

Both AS2 and AS4 transport messages over HTTP(S). The difference lies in the layers above: AS2 uses S/MIME for signing and encryption, while AS4 is a simplified profile of ebMS 3.0, in which messages are packaged in SOAP envelopes and secured with WS-Security.

ebMS 3.0 stands for ebXML Messaging Services version 3.0 and is used in practice through simplified profiles such as AS4. SOAP is a protocol for sending structured messages—a kind of XML envelope with fixed rules for how the content is packaged. In principle, SOAP is transport-independent, but it is usually sent over HTTPS.

Peppol itself switched from AS2 to AS4 back in 2020, and today AS4 is the only permitted option.

What is inside the envelope?

The content, such as an invoice, is packaged in an SBDH (Standard Business Document Header) envelope, which is sent as a compressed MIME attachment to the AS4 message. The SOAP part contains metadata and a signature that ensures the document has not been altered in transit.

The invoice itself, inside the envelope, uses the Peppol BIS Billing 3.0 format, a specialisation of the European invoicing standard EN 16931. In practice, UBL is the standard syntax for BIS Billing 3.0, but it also supports UN/CEFACT CII. UBL stands for Universal Business Language. It was originally an OASIS standard and is now also approved as an ISO/IEC standard (ISO/IEC 19845).

NemHandel and the move to Peppol BIS 4

In Denmark's NemHandel network, the format is called OIOUBL, which stands for Offentlig Information Online (Public Information Online) – Universal Business Language. All registered digital bookkeeping systems in Denmark currently have to support OIOUBL and Peppol BIS. In a few years, around 2028–2029, OIOUBL will be phased out, and NemHandel will migrate to a localised version of Peppol BIS 4.

Peppol BIS 4 is not yet in place, but once it has been fully developed and the migration takes place, the distinction between NemHandel and Peppol will disappear. All electronic invoices in Denmark will then use a single format: Peppol BIS 4 with Danish localisation.

And sometimes there is a fifth corner

Finally, you may also hear about a five-corner model, where the fifth corner is a public authority receiving a copy of the document for reporting purposes. This works by having the recipient's and/or sender's Access Point send the document in parallel to, for example, a tax authority. We see this in countries such as France and Singapore. Other countries, including Belgium, have passed legislation in this direction that will take effect later.

You can leave the complexity to us

Does all of this sound a little complicated? That's because it is. A lot has to work, be tested, be understood, and be tested again to get an Access Point up and running. And we have only scratched the surface here.

But once it is in place, it opens up significant opportunities for the companies connected to the network. At eCourier, we have built a certified Access Point, and we are ready to help your company get started with Peppol and NemHandel without having to think about or master the complexity. Whether you want to send invoices to Malaysia or receive credit notes from your local greengrocer.