NHS PEPPOL mandate — GS1 + PEPPOL for the NHS

The NHS (National Health Service, the UK public health service) published in 2014 an eProcurement Strategy requiring its suppliers to adopt two complementary standards: GS1 to uniquely identify products and locations (GTIN, GLN), and PEPPOL to exchange procurement messages (order, despatch advice, invoice). PEPPOL is a "4-corner" network linking buyers and suppliers through certified access points. It is the UK public sector's main PEPPOL deployment.

History — the 2014 eProcurement Strategy

In 2014, the Department of Health published the NHS eProcurement Strategy. The observation: the NHS spends billions on medical supplies through fragmented, poorly traceable and costly purchasing processes. The strategy imposed two building blocks: adopting GS1 to unambiguously identify each product (GTIN) and each location (GLN), and PEPPOL to exchange procurement documents electronically between Trusts and suppliers.

The Scan4Safety programme, launched in 2016 across six demonstrator Trusts, is its showcase: scanning a GS1 barcode at the patient bedside links the right product (notably implants), the right patient and the right clinician — improving safety, traceability and product recall. PEPPOL is the transport rail for the associated orders and invoices.

text nhs-peppol-timeline.txt

2014       | The Department of Health (DH) publishes the "NHS eProcurement
           | Strategy". It mandates adoption of GS1 (identification) and
           | PEPPOL (messaging) by NHS England Trusts and their suppliers.
           |
2016       | Launch of the "Scan4Safety" programme across 6 demonstrator
           | Trusts (Derby, Leeds, Plymouth, Salisbury, North Tees,
           | Cornwall) — GS1 GTIN/GLN at the patient bedside, traceability
           | of implantable products.
           |
2018-2020  | Gradual rollout of PEPPOL access points at large medtech and
           | consumables suppliers. NHS Supply Chain adopts PEPPOL messages
           | (Order, Despatch Advice, Invoice).
           |
2019       | The UK joins OpenPeppol as a PEPPOL Authority via the public
           | sector — NHS as the principal national use case.
           |
2021-2023  | Consolidation: NHS England takes over stewardship, messages
           | aligned with PEPPOL BIS 3.0. GS1 UK supports Trusts on GLN
           | addressing and product catalogues.
           |
2024-2026  | PEPPOL remains the NHS reference public rail. Open debate on
           | extending a broader PEPPOL framework to the whole UK public
           | sector.

Governance — DH then NHS England / GS1 UK

The mandate was initially driven by the Department of Health, then stewarded by NHS England (and NHS Supply Chain for central purchasing). GS1 UK supports Trusts on GLN allocation, product catalogue quality and GTIN compliance. On the PEPPOL side, the UK acts as the public-sector PEPPOL Authority via OpenPeppol, overseeing access point certification.

In practice, each Trust is assigned a GLN, registers in a PEPPOL SMP (Service Metadata Publisher) and connects via a certified access point. Suppliers do the same on the sending side. Interoperability rests on PEPPOL BIS 3.0 profiles and the GS1 framework.

Technical schema — GS1 + PEPPOL 4-corner

The PEPPOL model is "4-corner": the sender (corner 1) goes through their access point (corner 2), which routes the message to the recipient's access point (corner 3), which delivers it to the receiver (corner 4). Addressing uses iso6523 identifiers; for the NHS, the GS1 GLN via ICD 0088.

GTIN — Global Trade Item Number: GS1 product identifier (13 digits, former EAN).
GLN — Global Location Number: location/party identifier (Trust, warehouse, ward).
ICD 0088 — GS1 GLN identification code in PEPPOL addressing.
AS4 transport — secure protocol between PEPPOL access points.
SMP / SML — directory of receiving capabilities (which message to which GLN).
PEPPOL BIS 3.0 — Order, Despatch Advice, Invoice profiles (UBL aligned with EN 16931).

xml nhs-peppol-invoice.xml

<!-- PEPPOL BIS 3.0 — SBDH header + invoice to an NHS Trust -->
<StandardBusinessDocument>
  <StandardBusinessDocumentHeader>
    <Sender>
      <Identifier Authority="iso6523-actorid-upis">0088:5060000000001</Identifier>
    </Sender>
    <Receiver>
      <!-- NHS Trust GLN (ICD 0088 = GS1 GLN) -->
      <Identifier Authority="iso6523-actorid-upis">0088:5012345678900</Identifier>
    </Receiver>
    <DocumentIdentification>
      <Standard>urn:oasis:names:specification:ubl:schema:xsd:Invoice-2</Standard>
      <Type>Invoice</Type>
    </DocumentIdentification>
  </StandardBusinessDocumentHeader>
  <Invoice xmlns="urn:oasis:names:specification:ubl:schema:xsd:Invoice-2">
    <cbc:CustomizationID>urn:cen.eu:en16931:2017#...#peppol:billing:3.0</cbc:CustomizationID>
    <cbc:ProfileID>urn:fdc:peppol.eu:2017:poacc:billing:01:1.0</cbc:ProfileID>
    <cbc:ID>INV-NHS-2026-0042</cbc:ID>
    <cbc:IssueDate>2026-06-16</cbc:IssueDate>
    <cbc:DocumentCurrencyCode>GBP</cbc:DocumentCurrencyCode>
  </Invoice>
</StandardBusinessDocument>

NHS PEPPOL vs Finvoice / CTC mandates

Dimension	NHS PEPPOL (UK)	Continental CTC mandate
Scope	Public health sector (NHS)	Often universal B2B + B2G
Network	PEPPOL 4-corner	Platform/exchange (varies)
Identification	GS1 GTIN + GLN	National tax identifiers
Tax reporting	No (procurement, not VAT)	Yes (often)
Character	Sectoral mandate	General mandate
Format	PEPPOL BIS 3.0 (UBL)	UBL / CII / national

Adoption — Scan4Safety and beyond

6 Scan4Safety demonstrator Trusts (2016) — Derby, Leeds, Plymouth, Salisbury, North Tees, Cornwall — proved the bedside GS1 model.
NHS Supply Chain — the NHS central buyer now exchanges orders, despatch advices and invoices in PEPPOL with large suppliers.
Medtech suppliers — implant and consumables makers connect via PEPPOL access points to remain on the supplier roster.
Extension debated — the NHS remains the main public PEPPOL case; extending PEPPOL to the whole UK public sector feeds the post-Brexit e-invoicing debate.

Common pitfalls

Confusing GS1 and PEPPOL. GS1 identifies (GTIN/GLN), PEPPOL transports. The mandate requires both — one does not replace the other.
Mis-allocated GLN. An incorrect or unregistered GLN in the SMP blocks PEPPOL routing: the invoice never reaches the Trust.
Believing the mandate is universal. It targets the NHS, not all UK public procurement nor private B2B.
Forgetting the BIS 3.0 profiles. A UBL not conforming to the PEPPOL BIS profile (CustomizationID/ProfileID) is rejected at Schematron validation.
Neglecting the GTIN catalogue. Without clean GTINs on the supplier side, order/receipt/invoice matching at the bedside fails — the core of Scan4Safety.

Foundations

Standards

Flagship messages

Tools