Choosing a Slovakia Peppol Access Point in 2026: Buyer's Checklist

Why this matters

By 2027 every B2B invoice exchanged in Slovakia will pass through a Peppol Access Point on at least one side. The Access Point you pick will sit on the critical path of your accounts-receivable and accounts-payable cycles. Choose it like an enterprise system, not a SaaS subscription.

This is the buyer's checklist we recommend our customers use — equally applicable when you're benchmarking GoRoute against an alternative.

Eight questions to ask every vendor

1. Show me your OpenPeppol Service Provider identifier

A certified vendor publishes their POPxxxxxx identifier on every page of their site, and is listed on the OpenPeppol Service Provider directory. You can verify it on the OpenPeppol public directory. If the vendor cannot answer this in one sentence, walk away.

2. Which document profiles are in production?

The minimum for Slovakia in 2026/2027 is Peppol BIS Billing 3.0 and Peppol BIS Self-Billing 3.0. If you operate cross-border, also ask for PINT specialisations (Oman, the UAE, Singapore, Malaysia, Japan, Australia/New Zealand, EU) and any national CIUS layers (XRechnung, Factur-X) you depend on.

3. What is in the validation pipeline?

The right answer is layered:

UBL 2.1 XSD
EN 16931 (CEN baseline) Schematron
Peppol BIS 3.0 Schematron
PINT or national CIUS Schematron when applicable
eDEC code-list checks

A vendor that does only XSD has not built a real validator.

4. How is the Peppol PKI handled?

G3 production keystores must be (a) KMS-encrypted, (b) on access-controlled storage, (c) rotated on a tested schedule, (d) accessible only to the AP service identity. Ask how the rotation is rehearsed.

5. What happens when AS4 reception fails?

The right answer covers idempotency, retries with exponential backoff, dead-letter queues, and operational alarms with named on-call. There must never be a path where a successfully-received Peppol document is silently dropped.

6. What is the SMP architecture?

A Peppol-aware vendor runs an SMP, not a brochure for one. Ask for the SML registration evidence, the publish/lookup latency numbers, and the handling of participant migration.

7. What is the security posture?

ISO/IEC 27001:2022 certification of the operating entity is the floor; ISO 22301:2019 for the BCMS is the next floor. Ask for the latest external audit summary, the encryption-at-rest design, and the customer-data isolation pattern.

8. What does pricing actually include?

Per-document, per-participant, by environment, fixed-price tiers — every model is defensible if it is transparent. The wrong answer is "let's discuss commercials at the end of the procurement". Get the numbers up front and benchmark against your throughput.

The procurement scorecard

Score every shortlisted vendor 0–5 against these 16 dimensions. Anything below 60% is a no.

Dimension	Weight	Notes
Peppol AP certification	5	Must be verifiable on the OpenPeppol directory
SMP operation under same identity	4	Single-vendor operation beats handoffs
BIS Billing 3.0 + Self-Billing 3.0	5	Slovakia baseline
National CIUS coverage	3	XRechnung, Factur-X, etc. if cross-border
PINT specialisation coverage	3	Important for multi-country scope
Validation depth (XSD + EN16931 + BIS + CIUS)	5	Drives compliance
ISO/IEC 27001:2022 certified entity	4	Security floor
ISO 22301:2019 BCMS	3	Continuity floor
MFA on every console	3	Identity hygiene
KMS-managed PKI custody	4	Peppol G3 hygiene
Documented SLA + monitoring	4	99.95% inbound; sev-tiered response
Audit trail + 7y retention	3	Tax-law compliance
Multi-tenant isolation pattern	3	Critical for groups
API quality	3	OpenAPI, SDKs, sandbox
UAE / EU / Asia roadmap	3	Future-proofing
Transparent pricing	4	No surprises

The "fast no" list

Vendors that match any of the following should be ruled out before the second meeting:

No verifiable OpenPeppol Service Provider identifier.
AS4 endpoint not reachable on the public internet for testing.
"We will get certification soon" — the certification is not on a future PowerPoint, it is on the directory or it isn't.
No published SLA.
No production references in your region.

How GoRoute scores

GoRoute (Peppol Service Provider POP000991, parent ClayDesk LLC) operates a certified Access Point and SMP, with PINT Oman in production today and PINT-AE on the 2026 plan. The platform runs on AWS with the security and BCMS posture described in our Peppol onboarding checklist for finance teams and how to choose a Peppol Access Point.

For the regulatory backdrop, start with the Slovakia e-invoicing mandate guide and the e-invoicing mandates 2026 tracker.

Book a demo when you want a real, technical conversation.

Sources: OpenPeppol Service Provider directory; Peppol BIS Billing 3.0 specification; ISO/IEC 27001:2022 and ISO 22301:2019.

Frequently asked questions

What is a Peppol Access Point?

A Peppol Access Point is a certified piece of infrastructure that exchanges AS4-secured documents on the Peppol network on behalf of senders and receivers. Every participant on Peppol must be reachable through a certified Access Point.

How do I verify that a vendor is really Peppol-certified?

Look up the vendor's Peppol Service Provider identifier on the OpenPeppol public directory. The directory shows the legal entity, the certification type and the supported document profiles. Anything not on the directory is not certified.

What is the difference between a Peppol AP and an SMP?

The AP exchanges the document. The SMP publishes which AP a participant uses for which document type. Most providers operate both; some operate only the AP and rely on a third-party SMP.

What should the SLA look like?

99.95% on inbound AS4 reception, 24×7 monitoring, severity-tiered response with named first-response targets, and committed RTO/RPO numbers under a documented BCMS.

Can I switch Access Points later?

Yes. Endpoint reassignment is published through your SMP entry and propagates within minutes. Build the business case once; do not let switching cost paralyse the choice.