PEPPOL — founding Authority and European leadership

PEPPOL (Pan-European Public Procurement OnLine) is an open network that lets any company send electronic invoices and orders to any other, across borders. For newcomers: it is the equivalent of the global telephone network, but for business documents — connect once to an operator (Access Point) and you can reach everyone. Norway, through DFØ (formerly Difi), is one of the founding PEPPOL Authorities and among the highest-adoption countries in the world.

History — from the EU pilot to OpenPEPPOL

PEPPOL began as a Large Scale Pilot co-funded by the European Commission between 2008 and 2012, to make public procurement interoperable across borders. Norway, through Difi, played a driving role. In 2012 the project became the association OpenPEPPOL AISBL, of which Norway is a member and founding PEPPOL Authority. The country then wired its EHF B2G mandate onto PEPPOL, creating a virtuous loop: mandate + open network = mass adoption.

2008-2012  | PEPPOL Large Scale Pilot co-funded by the European Commission
           | to make public procurement cross-border interoperable.
           | Norway (Difi) is highly active in it.
           |
2012       | OpenPEPPOL AISBL founded (Brussels). Norway is one of the
           | founding members and PEPPOL Authorities.
           |
2014-2017  | Transport migrates AS2 → AS4. Norway drives national adoption
           | via EHF + B2G mandate.
           |
2018       | PEPPOL BIS Billing 3.0 published — becomes the basis of EHF 3.0.
           |
2019       | Reorganisation of Norwegian agencies: PEPPOL / e-invoicing
           | responsibility moves to DFØ.
           |
2020-2023  | PEPPOL goes global (Australia, Singapore, NZ, Japan). Norway
           | remains among the highest adoption rates.
           |
2024-2026  | PEPPOL chosen as the technical basis for several DRR/ViDA
           | rollouts. Norway, already mature, serves as a reference.

Governance — DFØ as PEPPOL Authority

A PEPPOL Authority is the national body that accredits operators (Access Points and SMPs) and enforces PEPPOL rules on its territory. In Norway that role belongs to DFØ (Direktoratet for forvaltning og økonomistyring). Concretely, DFØ:

• signs the Transport Infrastructure Agreements with Norwegian Access Points;
• publishes and maintains the national rules (EHF CIUS);
• represents Norway in OpenPEPPOL governance;
• operates the Anskaffelser.no portal, the documentation entry point for public procurement and formats.

OpenPEPPOL, in turn, runs the central SML, the conformance framework and the twice-yearly specification (BIS) release cycle.

Architecture — 4-corner model, AS4, SMP/SML

PEPPOL rests on the 4-corner model: the sender (C1) hands its document to its Access Point (C2), which routes it to the recipient's Access Point (C3), which delivers it to the final recipient (C4). Address discovery happens via the SML (a DNS service pointing to the recipient's SMP) and then the SMP (which declares which documents the recipient can receive). Transport is secured with AS4 (ebMS 3.0 profile).

# PEPPOL participant identifier (Norway)
#   <scheme>:<value>
#   0192 = ICD for the Norwegian organisasjonsnummer

iso6523-actorid-upis::0192:991825827

# Address resolution (4-corner model):
#   1. C2 (sending Access Point) queries the SML (DNS)
#      → finds the recipient's SMP URL
#   2. The SMP lists the documents the recipient can receive
#      (e.g. PEPPOL BIS Billing 3.0 / EHF)
#   3. C2 sends the message over AS4 (ebMS 3.0) to C3 (receiving AP)
#   4. C3 delivers the invoice to C4 (the recipient / their ERP)

PEPPOL vs closed national networks

Adoption — Norway in the lead

• Top density. Relative to its population, Norway has one of the highest densities of companies connected to PEPPOL.
• B2G → B2B network effect. The public mandate pulled the private ecosystem along: large buyers require EHF, hence PEPPOL, from their suppliers.
• Nordic interoperability. Sweden, Denmark, Finland and Norway all share PEPPOL, smoothing intra-Nordic exchange.
• Exported model. The Norwegian PEPPOL architecture is a reference for countries adopting the network for their own reforms.

Common pitfalls

• Assuming PEPPOL = a single operator. PEPPOL is a network of competing Access Points. Choosing an AP does not lock you in — any compliant AP can reach any recipient.
• Forgetting to publish in the SMP. A recipient that has not declared its receiving capabilities in an SMP is unreachable, even when connected.
• Wrong ICD. In Norway it is 0192 (organisasjonsnummer). Reusing another country's ICD (e.g. 0007 Sweden) breaks resolution.
• Confusing Authority and Access Point. DFØ is the Authority (governance); it does not route messages — private APs do.
• Thinking PEPPOL = invoices only. PEPPOL also carries orders, catalogues, despatch advices (post-award) and responses.

Cross-links

• Norway hub — full view
• EHF — national PEPPOL format
• Organisasjonsnummer — ICD 0192
• Altinn — government platform
• Norway, the EEA and ViDA
• OpenPEPPOL — official site
• Anskaffelser.no — procurement and formats