Peppol Service Provider ISO 27001: what changes for you

Every Peppol Service Provider must hold a valid ISO/IEC 27001 certification in 2027. OpenPeppol, the organisation that manages the Peppol network, has adopted an implementation plan for this with a fixed series of milestones. For your business, sending and receiving e-invoices through a service provider, Peppol Service Provider ISO 27001 status therefore becomes a selection criterion when choosing a provider and a continuity question if you are already connected. This article explains what OpenPeppol requires, which dates apply, what the certification does and does not tell you, and which questions and contract terms you want settled before 1 July 2027.

Why this matters to you

You are connected to the Peppol network through a service provider. That party operates the Access Point that sends and receives your e-invoices, and registers your Peppol ID in a Service Metadata Publisher (SMP) so your trading partners can find you on the network. If your service provider drops out, your Peppol invoice traffic stops, even when your own administration is fully in order.

The Italian Peppol Authority AgID describes ISO/IEC 27001 certification as “a fundamental requirement for continuing to operate on the Peppol network”. A service provider that is not certified in time therefore risks losing the condition for continuing to operate on the network. As e-invoicing becomes mandatory in more and more countries (see our overview of e-invoicing mandates in 2027), a stable connection is business-critical for many organisations.

Many businesses also have no direct contract with a service provider. They send e-invoices from their accounting or ERP package, while the software vendor uses a service provider behind the scenes. The new requirement affects you in that case too, only less visibly.

The requirement in brief: Peppol Service Provider ISO 27001

The core of the implementation plan is simple: by the deadline, every Peppol Service Provider must hold a valid and active ISO/IEC 27001 certificate, or an equivalent certification accepted by OpenPeppol. ISO/IEC 27001 is the international standard for an information security management system (ISMS).

A certificate alone is not enough. The Statement of Applicability (the document that records which controls fall within the certification) must cover Peppol operations explicitly and without exclusions. According to the AgID publication, this includes at least:

the Access Point;
the Service Metadata Publisher (SMP);
End User Identification, meaning the identification of the end users the provider connects to the network;
document management;
integrity controls;
logging and audit trail;
backup and business continuity.

Service providers that are already certified submit four documents, according to OpenPeppol: a copy of the valid certificate, the Statement of Applicability, the Service Provider Agreement (confirming that the certificate holder is the same legal entity that signed the agreement with the Peppol Authority) and a management-signed attestation that the certificate covers the scope set by OpenPeppol. Providers without a certificate must start an implementation project and engage an accredited certification body.

Timeline: 1 July 2027 or 1 October 2027?

Two official sources have published on the deadline. On 8 July 2026, AgID published the following timeline, based on the release candidate (v1.0rc) of the implementation plan:

T0, 30 June 2026: deadline for equivalence requests for other certificates;
T1, 1 September 2026: submission of existing ISO/IEC 27001 certificates;
T2, 1 October 2026: evidence of ongoing certification projects;
T3, 1 February 2027: first progress report;
T4, 1 May 2027: second progress report;
T5, 1 July 2027: certification mandatory.

OpenPeppol’s own ISO/IEC 27001 page states that the Managing Committee approved the final version of the plan on 24 June 2026. Because the final documentation became available three months later than planned, the certification deadline has shifted by three months to 1 October 2027. That page does not say whether the interim milestones T3 and T4 shift as well.

The publication by OpenPeppol, as the network’s governing body, is leading. For your planning, it is sensible to use 1 July 2027 as your working date and 1 October 2027 as the formal final date. That leaves room to switch if your provider misses the deadline.

What ISO 27001 does and does not guarantee

An ISO/IEC 27001 certificate shows that an organisation systematically assesses its information security risks, has put controls in place, and has had this audited by an accredited certification body. Certificates are usually issued for three years, with annual surveillance audits. For you, that means there is an externally audited framework for the confidentiality, integrity and availability of your invoice data.

What the certificate does not tell you:

Availability and service: ISO 27001 contains no guaranteed uptime, response times or recovery times. Those belong in an SLA.
Scope: a certificate can be limited to part of an organisation. Only the Statement of Applicability and the scope statement show whether the Peppol service you use falls within it.
Legal entity: for OpenPeppol, a certificate held by a parent or sister company only counts if the certificate holder is also the signatory of the Service Provider Agreement.
Subcontractors: if your supplier relies on another party, one party’s certificate says nothing about the other.
Privacy law: ISO 27001 supports compliance with data protection rules, but it does not replace a data processing agreement.

What this means for your supply chain

The impact depends on how you are connected to Peppol.

You have a direct contract with a service provider

Then the question is clear: is your provider certified, or on track? You can ask directly and record it in your contract.

You invoice through your accounting or ERP software

Then your software vendor is usually not a service provider itself, but relies on a certified party. The ISO requirement applies to that underlying service provider. Ask your software vendor which party that is, with whom your Peppol ID is registered in the SMP, and what the vendor will do if that party misses the deadline. The Peppol.now knowledge base advises, when procuring a Peppol service, to always know who a subcontractor is and how responsibilities are divided in the contract.

What happens if your provider is not certified in time

The ISO/IEC 27001 publications do not name specific sanctions. The Service Provider Agreement, the contract between a service provider and its Peppol Authority, does set out a general escalation process for non-compliance: a warning with a remediation deadline, publication of the non-compliance, temporary and ultimately permanent removal from the network. After termination, a provider may no longer use the network and affected third parties must be informed in writing. Whether and how this process is applied to the ISO requirement is for OpenPeppol and the Peppol Authorities to decide.

For you, the practical consequence is that your Peppol ID has to move to another provider. A Peppol ID is registered with one service provider at a time; the old provider must transfer or end the registration before the new one can take it over. Without clear arrangements, you risk invoices not reaching you during that period.

Practical guide: what you want settled before 1 July 2027

These steps help you assess your current provider or choose a new one. They apply regardless of the country in which you operate.

Step 1: map your chain

Record which software or service you use to send and receive e-invoices.
Establish which Peppol Service Provider sits behind it and with whom your Peppol ID(s) are registered in the SMP.
Check whether you have several entities or several Peppol IDs, for example per branch or country.

Step 2: ask your (future) service provider these questions

Are you ISO/IEC 27001 certified, and if so, by which accredited certification body and until when?
Is the certificate holder the same legal entity that signed the Service Provider Agreement?
Does the Statement of Applicability cover the Access Point, the SMP, End User Identification, document management, integrity controls, logging and audit trail, and backup and continuity, without exclusions?
If not: what stage is the project at, when is the certification audit scheduled, and have you submitted the progress reports to OpenPeppol on time?
Do you use subcontractors for the Peppol service, and are they certified too?
How, and within what period, will you transfer my Peppol ID if I switch, and at what cost?
How do I get my sent and received documents and metadata back when the contract ends?

Step 3: put it in the contract

An obligation to maintain the certification and to inform you immediately of loss, suspension or a warning from the Peppol Authority.
The right to see the certificate and a summary of its scope on request.
An early termination right if the provider loses network access or misses the certification deadline.
An exit arrangement with fixed steps, lead times and costs for transferring your Peppol ID and returning your documents.
An SLA covering availability, response times and a periodically tested continuity plan.
If you work through a software vendor: the same terms, plus a commitment that the vendor will move to another certified service provider in time.

Step 4: prepare an exit plan

Select at least one alternative provider in advance that can demonstrate its certification.
Decide who is internally responsible for the switch and who informs your trading partners.
After switching, check in the Peppol directory that your Peppol ID is visible at the new provider, and test receiving an invoice.

Step 5: schedule your checkpoints

After 1 February 2027 and after 1 May 2027: ask your provider about the status of its project, in line with the progress reports in the AgID timeline.
By 1 July 2027 at the latest: request a copy of the certificate. If there is none, start your exit plan so that the switch is completed before 1 October 2027.

For software vendors and service providers

Software vendors: check your chain

If your software offers e-invoicing, you are either a Peppol Service Provider yourself or dependent on one. In the first case, the requirement applies to you directly. In the second, your customers will ask you about your partner’s status. Request the certificate and the Statement of Applicability, agree a switching arrangement and prepare your customer communication. According to the Australian Peppol Authority (ATO), the requirement applies to new service providers from 1 January 2027; if you are choosing a new partner, take this into account.

Peppol Service Providers: mind the progress reports

If you are still in a certification project, the AgID timeline has you reporting progress on 1 February 2027 (T3) and 1 May 2027 (T4). Check with your Peppol Authority whether these dates still apply after the deadline shift, and make sure the certificate, Statement of Applicability, Service Provider Agreement and management attestation all relate to the same legal entity.

Frequently asked questions

Does my business need its own ISO 27001 certification to use Peppol?

No. The OpenPeppol requirement applies to Peppol Service Providers. You do need to check whether your provider, or the provider behind your software, complies in time.

What is the deadline: 1 July 2027 or 1 October 2027?

AgID states 1 July 2027, based on the release candidate of the implementation plan. OpenPeppol states that, following approval of the final version, the deadline is 1 October 2027. The OpenPeppol source is leading; use 1 July 2027 as your working date.

What happens to my Peppol ID if my provider does not comply?

Your Peppol ID then has to be registered with another service provider. Agree in your contract in advance how, and within what period, your current provider will transfer the registration.

Sources

Want to compare Peppol Service Provider ISO 27001 certifications? The Peppol.now comparison tool shows the certifications each provider has listed, so you can assess your current provider or choose an alternative with confidence.