Peppol to Require ISO 27001 from July 2027

In a move to strengthen network security, OpenPeppol has announced plans to introduce a mandatory ISO 27001 (or equivalent) certification requirement for all service providers.

OpenPeppol, the organisation that governs the Peppol network, said it is initiating “a path towards establishing an obligation for all Peppol Service Providers and OpenPeppol itself to obtain ISO 27001 or similar in substance certification by 1 July 2027.”

The announcement has been welcomed by end-user IT professionals and service providers, with some describing it as “long overdue.”

Today, security maturity varies between Peppol access points. Some providers operate under strong, externally audited security frameworks, while others rely on internal or lighter controls. Making ISO 27001 certification mandatory will align all providers to a consistent, high standard, reducing the risk of attacks that could alter invoices, enable fraudulent transactions, expose sensitive data, or disrupt national e-invoicing systems.

The requirement is expected to reduce systemic risk across the network by establishing a consistent minimum security baseline.

In terms of implementation effort, the impact will vary. Larger e-invoicing providers with mature security programmes are likely to see minimal disruption, while smaller access points may face more significant changes, including the need to formalise or build a full information security management system.