What is a Peppol Access Point?
Last updated 27 July 2026
Every explanation of EU e-invoicing eventually hits the phrase “certified Peppol Access Point.” It sounds like a piece of hardware, or something you have to apply for. It's neither. An Access Point is simply the certified provider that puts your invoice on the network and gets it to the other side — and understanding that one piece makes the rest of Peppol fall into place.
The four-corner model, in plain English
Peppol doesn't work like a portal you log in to. It works like email. You don't have a direct line to every business in Europe; you have a provider, they have a provider, and the two providers know how to talk to each other. Peppol calls this the four-corner model:
| Corner | Who | What they do |
|---|---|---|
| C1 | Sender | You — or rather the system that produces the invoice: your shop, ERP or invoicing app. |
| C2 | Your Access Point | Validates the document, works out where it has to go, and transmits it securely onto the network. |
| C3 | Receiver's Access Point | Receives the document on the buyer's behalf, checks it, and passes it on. |
| C4 | Receiver | Your buyer's accounting system, where the invoice lands as structured data. |
The important consequence: you only ever deal with corner two. You never negotiate a connection with each customer, and you don't care which provider they use. Connect once, reach every business registered on the network.
What an Access Point actually does
“Sends the invoice” hides a fair amount of machinery. A certified Access Point is responsible for:
- Address lookup. Peppol keeps a distributed registry: a SML (Service Metadata Locator) points to the buyer's SMP (Service Metadata Publisher), which says which document types that participant can receive and at which endpoint. Your Access Point does this lookup on every send — which is also how a send fails fast when a buyer isn't registered to receive that document type.
- Transport. Delivery uses the Peppol AS4 profile over TLS, with messages signed using certificates from the Peppol PKI. Both ends can prove who they are, and that nothing was altered on the way.
- Validation. The document is checked against the Peppol BIS Billing 3.0 rules — the Peppol profile of the European standard EN 16931 — plus any country-specific rules. Invalid invoices are rejected here rather than silently lost.
- Acknowledgement. Peppol delivery is asynchronous. The transport layer confirms the receiving Access Point took the document, and a Message Level Status reports transport and processing outcomes. Neither carries business acceptance. MLS explicitly excludes it, so whether the buyer agrees with the invoice travels outside Peppol unless both sides have implemented the separate Invoice Response profile.
- Registration. If you also want to receive Peppol documents, your Access Point registers your participant ID in an SMP so other senders can find you.
Do you need your own Access Point? Almost certainly not.
This is the question that stalls a lot of projects, so here's the blunt answer: no. Becoming a Peppol Access Point is a formal accreditation, not a technical weekend. It means signing a Peppol Transport Infrastructure Agreement with a Peppol Authority (the national body that accredits providers under OpenPeppol), running certified AS4 messaging with Peppol PKI certificates, standing up and maintaining SMP infrastructure, passing conformance testing, and then keeping up with each release of the specifications and the periodic re-accreditation that comes with them — indefinitely.
That effort makes sense if being a Peppol provider is your business. It makes no sense at all if you sell furniture to German wholesalers. For everybody else, connecting through an existing certified Access Point is the normal route, and the resulting invoice is exactly as compliant — the network cannot tell whether corner two is your own infrastructure or your provider's.
How apps connect a shop to the network
For a Shopify or ERP merchant, the Access Point is the last hop, not the whole job. The app in front of it does the work that decides whether the invoice is accepted:
| Step | Where it happens | What has to be right |
|---|---|---|
| 1 · Capture | Your shop / app | Buyer's legal name, address, VAT number and Peppol participant ID. |
| 2 · Generate | Your app | A structured EN 16931 invoice in UBL, in the Peppol BIS Billing 3.0 profile — with net, VAT and gross that reconcile to the cent. |
| 3 · Address | Your app + Access Point | The participant ID with the right ISO 6523 scheme (for example 9930 for a German VAT ID, 0208 for a Belgian company number), then the SMP lookup. |
| 4 · Transmit | Access Point | AS4 delivery to the receiving Access Point, signed and encrypted. |
| 5 · Track | Access Point → your app | The signed AS4 receipt proving the receiving Access Point took the document, surfaced where you actually work. Peppol does not report whether the buyer accepted it. |
Note where the failure modes live. An Access Point will happily transmit a technically valid invoice with the wrong VAT treatment on it. Reverse charge for an intra-EU B2B sale, prices that include tax versus exclude tax, a rounding difference of one cent between line totals and the document total — those are decided in step two, in your app, long before the network sees anything. That's why “we're connected to Peppol” is a much weaker claim than it sounds.
Security and compliance: what Peppol does and doesn't cover
Peppol gives you a genuinely strong delivery layer: accredited providers, mutual authentication via the Peppol PKI, signed AS4 messages over TLS, and a common validation profile so both sides agree what a correct invoice looks like. Documents are transported, not published — Peppol has no central database of everyone's invoices.
What it does not do, and where people get caught out:
- It isn't an archive. Your statutory retention obligation (commonly 8–10 years, depending on the country) stays with you.
- It isn't a tax authority reporting channel by itself. Some countries route reporting over Peppol-based infrastructure and some don't; the mandate text governs, not the network.
- It doesn't calculate your VAT. It validates structure and syntax, plus some arithmetic consistency — it has no opinion on whether reverse charge was the right call.
- It doesn't guarantee your buyer is reachable. If they aren't registered to receive that document type, the lookup fails and you need a fallback route.
How Zeppol delivers over Peppol
Zeppol is corner one and the app in front of corner two: it turns your Shopify orders into EN 16931-valid e-invoices and delivers them through a certified Peppol Access Point, keeping the signed AS4 receipt that proves the receiving Access Point took the document. Peppol reports transport delivery, not buyer acceptance, so that receipt is the strongest evidence any sender gets. You don't apply to anything, and you don't run AS4 infrastructure.
We're deliberately narrow about what that includes. Zeppol focuses on getting the invoice correct and delivered — VAT treatment for EU B2B (reverse charge, VIES checks on the buyer's VAT number), a document that passes validation, and honest delivery status rather than a green tick the moment the API returns. Zeppol is not a tax suite: it won't file your returns, run OSS/IOSS reporting, or replace your accountant. Germany-first, built for the 2027 mandate wave, and clear about its edges.
Frequently asked questions
What is a Peppol Access Point?
A certified service provider that connects businesses to the Peppol network. It validates your e-invoice, looks up where the receiver's documents should go, transmits it securely, and reports delivery status. Access Points are accredited by a Peppol Authority and are the only parties that exchange documents directly on the network.
What is the Peppol four-corner model?
Sender (C1) → your Access Point (C2) → the receiver's Access Point (C3) → receiver (C4). You only ever deal with your own Access Point; it handles routing to the other side, much like an email provider delivering to another provider.
Do I need my own Peppol Access Point?
Almost certainly not. Becoming one means a Peppol Transport Infrastructure Agreement with a Peppol Authority, certified AS4 messaging with Peppol PKI certificates, SMP infrastructure, conformance testing and ongoing re-accreditation. Sending through an existing certified Access Point is faster, cheaper and equally compliant.
How does an app connect a webshop to an Access Point?
It captures the buyer's VAT number and Peppol participant ID, generates a structured EN 16931 invoice in the Peppol BIS Billing 3.0 profile, and hands it to a certified Access Point over that provider's API. The Access Point does the SMP lookup, transmits over AS4, and returns delivery status to display in your admin.
Is Peppol secure?
Transport uses AS4 over TLS with messages signed using Peppol PKI certificates, so both Access Points can prove identity and integrity, and providers must be accredited. But Peppol is a delivery network, not an archive — retention and bookkeeping obligations remain yours.
Is an Access Point the same as an e-invoicing provider?
Not necessarily. Many e-invoicing products are applications connected to somebody else's certified Access Point, which is perfectly valid. What matters is that the invoice is EN 16931-valid, correctly addressed, and delivered through a certified Access Point.
Keep reading
- Peppol for Shopify — what the network is and how a store connects.
- EN 16931 explained — the standard behind XRechnung, ZUGFeRD and UBL.
- Germany's 2027 mandate — what Shopify merchants must do, and when.
This guide is general information for merchants, not legal or tax advice. Rules, mandates and thresholds vary by country and change over time — confirm your obligations with a qualified tax adviser.
E-invoices from your Shopify B2B orders
Zeppol turns every B2B order into an EN 16931 document, checks it against the EU and the German rules, and sends it over Peppol or by email. Join the list and I'll be in touch before the deadline.