HMRC Becomes the UK Peppol Authority

Who is the UK Peppol Authority?

Today the UK Peppol Authority function sits within NHS Supply Chain, and the government has said HMRC will take it over. The statement is in the e-invoicing implementation roadmap published on GOV.UK on 28 October 2026: "HMRC will become the UK Peppol Authority, taking on responsibility for the governance and oversight of the Peppol framework in the UK." The roadmap adds that further work will determine "the timing and detailed governance arrangements for the transition".

So the change is announced, but not dated. This page explains what the role is, what it means for NHS suppliers, and what the roadmap says about Access Point certification. The wider picture is in HMRC's e-invoicing roadmap: what the UK decided.

What does a Peppol Authority do?

Peppol is governed internationally by OpenPeppol. Countries that adopt it typically set up a national Peppol Authority to oversee how the framework works in their jurisdiction. OpenPeppol publishes a list of Peppol Authorities, which names NHS Supply Chain Coordination Limited for England.

The roadmap describes the UK Authority as the country's "stewardship body for Peppol". Its role includes:

• overseeing compliance with the core Peppol framework and any UK-specific requirements;
• supporting software provider assurance;
• coordinating with OpenPeppol;
• helping to maintain a trusted e-invoicing ecosystem.

It is a governance role. The roadmap says plainly that the Peppol Authority "will not receive copies of VAT invoices for business transactions", and that safeguards for data handling will be a core part of the programme. Invoices still travel between Access Points, not through a government hub. The roadmap describes a decentralised network where businesses use a provider that connects them to others.

Why is the role moving from the NHS to HMRC?

Because the job is getting bigger. The roadmap says Peppol has been used in the UK for a number of years, "particularly within the NHS, following the NHS eProcurement Strategy", which is why the Authority function currently sits within NHS Supply Chain. It says this was "sufficient to support the NHS's use of Peppol", but the planned expansion of e-invoicing across the wider economy "means that new arrangements are needed to support the Authority's broader role across the UK".

From 1 April 2029, VAT-registered persons must issue and receive VAT invoices as e-invoices, with Peppol as the core framework. A body that oversaw one buyer's supply chain now has to oversee a national network. The roadmap does not give HMRC's reasons beyond this. We do not know why HMRC rather than another body was chosen, and we do not say.

What changes for NHS suppliers today?

Nothing yet. The roadmap gives no date for the transfer, and says only that timing and governance are still to be determined. If you supply NHS bodies over Peppol, your existing arrangements continue. The roadmap notes that the NHS has already required its suppliers to provide e-invoices, and that NHS Shared Business Services reports that, on average, electronic invoices are paid 26 days faster than paper or email invoices (based on 2023 data).

What an NHS supplier can sensibly watch for:

• the date and detail of the transfer to HMRC, when announced;
• the Spring 2027 technical consultation, which covers proposed standards and Access Point certification requirements;
• whether any UK-specific requirements affect how your provider sends to NHS buyers. The roadmap says this is not yet decided, so we cannot say.

If you also supply private customers, the 2029 rule will cover those VAT invoices too. See who must e-invoice in the UK from 2029, and who is exempt. The NHS background and consultation history are in UK e-invoicing 2029: the mandate, the consultation and Peppol.

What are Peppol Authority Specific Requirements?

Individual countries can add rules on top of the international Peppol framework. These are called Peppol Authority Specific Requirements (PASRs), and the country's Peppol Authority publishes them. They apply to software providers operating in that country. The roadmap's Annex 2 lists the themes a UK set could cover:

• business identifiers, such as VAT registration numbers or other recognised identifiers;
• security requirements, verification and assurance;
• reporting and transaction information that providers may need to share about network activity;
• service level requirements;
• local interoperability requirements for UK business practice, legal requirements and existing document types;
• software provider accreditation, which could include assurance, testing or accreditation.

The roadmap says "work is ongoing to consider whether any UK-specific requirements are needed". It does not say that any will be. Anyone who tells you what the UK requirements are today is guessing. The roadmap also says the government's approach is "to build on established Peppol governance wherever possible and avoid creating unnecessary additional requirements".

What is the Access Point certification timetable?

An Access Point is the certified service that connects a business to the Peppol network. The roadmap says providers must be certified before they can operate on Peppol. The steps it expects in the UK are: prepare systems to meet OpenPeppol and UK Peppol Authority requirements, apply to join and complete testing, receive certification, then offer access to businesses. Certification may need to be maintained as standards change.

The roadmap also says the framework for software providers will apply to those that do not run an Access Point and are not subject to Peppol accreditation, so a provider does not escape UK requirements by buying its connection from someone else. Businesses themselves do not need to become Access Points. Most will reach the network through their accounting or finance software provider.

What does this mean when choosing an access point?

Two practical points follow from the roadmap, both of which are our reading rather than something it states.

First, certification today is through OpenPeppol, and the roadmap expects UK requirements to be added on top later. Ask any provider you consider what it plans to do when those requirements appear, and when it expects to know.

Second, the registered identity of the provider matters. GoRoute is a certified Peppol Access Point and SMP, registered with OpenPeppol as POP000991. That is the whole of our claim. We do not say we meet UK requirements, because they have not been published, and we will say so here when they are. For how to compare providers on the points that matter now, read how to choose a Peppol Access Point.

Our Peppol Access Point and SMP page describes the service. To discuss an NHS supplier set-up, book a short call. Recorded guides are on the tutorials page, the technical reference is in the developer documentation, and the UK summary is on the UK e-invoicing page. If you want to know why a PDF does not count, read PDF, EDI or Peppol: what counts as a UK e-invoice.

Sources: HMRC and the Department for Business and Trade, "E-invoicing implementation Roadmap", published 28 October 2026 (UK Peppol Authority, Annex 2, certification timeline). OpenPeppol, Peppol Authorities. This is not tax or legal advice.