INTERNET OF THINGS (IOT)

May 22, 2023

If you own the finance/engineering stack in the UAE, 2026 isn't "far off"—it's one engineering roadmap away. The Ministry of Finance (MoF) is rolling out a national e-invoicing regime based on the PEPPOL network and a UAE-specific data model ("PINT AE"). Phase-1 starts in July 2026 with a phased rollout to follow. You'll issue and receive structured XML invoices via an Accredited Service Provider (ASP), while tax data is reported in near-real time to the Federal Tax Authority (FTA).

Below is a pragmatic CTO playbook—what changes architecturally, what to ask vendors, and a 90-day plan you can start now.

TL;DR for busy CTOs

Who's in scope? All B2B and B2G transactions; B2C is currently out of scope (you may exchange B2C via PEPPOL but do not report those to Corner-5).
When? Phase-1 is July 2026 with phased onboarding (MoF will announce waves and give notice). Pilot/voluntary onboarding can start as soon as ASPs and your systems are ready.
How? UAE is adopting a PEPPOL 5-corner model (Decentralized CTC + Exchange). You must use an Accredited Service Provider to validate/exchange invoices and to report tax data to FTA (Corner-5).
Format? PINT AE (a UAE customization of PEPPOL's international invoice), exchanged as structured XML(UBL-based). The official PINT AE BIS is published by OpenPEPPOL.
Good to know: English is permitted; no QR code is required; no extra digital signature beyond PEPPOL's security; credit notes are the way to correct errors; Payment Due Date must be present even for on-the-spot payments.

The model in plain English

Think two rails:

Exchange – Your ASP sends/receives invoices over PEPPOL (AS4 protocol).
Reporting – Your ASP also submits a Tax Data Document (TDD) to the FTA (Corner-5) in near real-time and handles status messages (MLS).

A typical flow:

Your ERP/PoS/e-commerce pushes invoice data to your ASP (Corner-2).
ASP validates against PINT AE, converts to UAE-standard XML if needed, and exchanges with the buyer's ASP (Corner-3).
In parallel, ASP reports the TDD to FTA (Corner-5); you receive status messages back.

Exports? If the buyer isn't on PEPPOL, you'll use a "dummy endpoint" for exchange and send the commercial copy off-network (e.g., email), but your ASP still reports the tax data to Corner-5.

Identifiers? Businesses are identified by TIN/TRN and a PEPPOL endpoint. VAT groups: each member needs its own endpoint (even though the group shares a TRN).

PEPPOL 5-Corner Live Flow Simulator

Watch how a UAE e-invoice moves across PEPPOL. Corners 1–4 deliver the invoice to the buyer. In parallel, your ASP sends the Tax Data Document (TDD) to the FTA (Corner-5) and returns MLS status updates. Choose a scenario, then press Run Flow.

Slow-mo

Invoice XML (PINT AE over AS4)

TDD → FTA (Corner-5)

MLS Status

Due Date required

Standard: PINT AE invoice with line-level tax codes. ASP validates, exchanges via AS4, and reports TDD to FTA; MLS statuses return.

AS4 transport

PINT AE (XML)

Corrections = Credit note

Due Date always set

Generated (Corner-1)
Validated & Exchanged (Corner-2 → 3)
Delivered to Buyer (Corner-4)
TDD Accepted (Corner-5 • MLS OK)

What changes in your stack

1) Data model & validation

The MoF's consultation paper publishes PINT AE with mandatory/conditional fields and use-case tables (standard tax invoice, reverse charge, zero-rated, FTZ, e-commerce, exports, margin scheme, commercial invoice, self-billing, etc.). You'll map internal fields to PINT AE (e.g., IBT-001 Invoice Number, IBT-005 Currency, IBT-009 Payment Due Date).

2) Integration pattern

Outbound: ERP/PoS → ASP via API/SFTP/ETL (your choice with the ASP). ASP → buyer ASP via PEPPOL (AS4). ASP → FTA (AS4).
Inbound: Buyer invoices arrive to your ASP and flow into your AP system; you'll consume status callbacks (MLS) and validation errors programmatically.

3) Security & hosting

For ASPs, MoF requires controls such as ISO/IEC 27001 for the product, ISO 22301 for business continuity, encryption at rest/in transit, MFA, and adherence to UAE National Cloud Security Policy where applicable.

4) Archiving & retention

Maintain VAT records for 5 years (longer for capital assets) and 15 years for real-estate records; align with corporate-tax record-keeping (commonly 7 years). Plan an immutable e-archive with strong search and legal-hold.

Vendor strategy: picking an ASP (and keeping leverage)

Only Accredited Service Providers can exchange/report under UAE e-invoicing. MoF has issued Ministerial Decision No. 64 of 2025 setting out eligibility and accreditation procedures (pre-approval, testing with OpenPEPPOL, EmaraTax API, insurance, ISO, conformance, two-year validity, ongoing evaluation). Accreditation applications opened in March 2025; expect a public register of ASPs.

RFP prompts for your shortlist:

Certification & status: Current MoF pre-approval/accreditation; OpenPEPPOL conformance.
Data residency & cloud: UAE hosting options; compliance with UAE National Cloud Security Policy.
Resilience: ISO 22301/27001 evidence; RTO/RPO; dual access points; failover tests.
AP/AR coverage: Connectors for SAP/Oracle/Microsoft/NetSuite + PoS/e-commerce; multi-endpoint VAT-group support; buyer/supplier onboarding tooling.
Validation depth: Full PINT AE validations (cardinality, code lists), configurable business rules, and MLS/TDDtransparency.
Controls: Audit trails, immutable e-archive, retention policies, and export capabilities for regulator requests.

A reference architecture (at a glance)

Source systems: ERP (SD/AR & MM/AP), billing, PoS, marketplace/e-commerce.
E-invoicing gateway (ASP): API/ETL adapter → PINT AE validation → XML generation → PEPPOL exchange → TDD reporting → MLS webhooks.
Compliance services: Identity (TRN/TIN mapping), endpoint directory, exception queue, credit-note automation, retention vault, reconciliation to VAT return.

90-day plan (you can start this today)

Days 1–15 — Discover & decide

Name an owner (joint Finance–Engineering RACI) and define success (on-time issuance, <0.5 % validation failures, full AP ingest).
Scope inventory: list all B2B/B2G flows (ERP, PoS, portals, marketplaces, intercompany). Flag VAT-group members—each needs its own endpoint.
Data gap-fit vs PINT AE: map your fields to the mandatory/conditional set (invoice header, parties, lines, taxes, due date, currency, references). Create a backlog to remediate missing fields (e.g., buyer identifiers, UoM codes).
ASP shortlist & sandboxes: issue a mini-RFP using the prompts above and request test credentials and a PEPPOL test endpoint.

Days 16–30 — Design & prepare

Integration design: choose your push/pull method to ASP (API vs SFTP/ETL); define idempotency keys; design MLS callback handling; plan retries for transient AS4 errors.
Numbering & corrections: standardize invoice/credit-note numbering and flows; remember credit notes are used to fix errors (no overwrite).
Security & hosting: align with ISO 27001 controls and UAE cloud policy; finalize archival strategy that meets VAT/real-estate/corporate-tax retention.
Change management: update supplier/customer onboarding to capture PEPPOL endpoint IDs and contacts.

Days 31–60 — Build & test

Outbound AR pilot: generate PINT AE XML for 3–5 representative scenarios (standard, zero-rated, RCM, FTZ, export) and exchange via ASP test to dummy buyers; verify TDD is reported and MLS statuses are consumed.
Inbound AP pilot: receive invoices from ASP, auto-validate, and post to AP with tolerance rules (tax/category codes, totals).
Edge cases: ensure Payment Due Date always present; English content supported; confirm no QR code or extra signature required.

Days 61–90 — Harden & go-early

Perf & resilience: load-test your highest-volume day; simulate ASP outage and confirm queueing/failover.
Governance: finalize monitoring, alerting, and monthly reconciliation from MLS/TDD to VAT returns.
Pilot with live counterparties (where possible): MoF allows early exchange/pilot before legislation takes effectonce you and an ASP are ready.
Readiness sign-off: CFO, Head of Tax, CISO, and CTO jointly sign a go-live checklist; book the wave window once MoF/FTA announce onboarding phases.

90-Day Execution Tracker

Auto-schedule the CTO playbook into dated milestones. Track progress, add notes, and export to your calendar or CSV.

Start date Working days only

0/0 tasks completed Auto-saves locally · Notes included in exports

Field-level "gotchas" teams miss

Due date is mandatory even for immediate payment—set due date = invoice date for cash sales.
Currency rules: IBT-005 (invoice currency) must use ISO 4217; provide accounting currency and exchange rate when different from AED.
Tax codes at line level are required; ensure category codes align with UAE code lists.
Error correction = issue a credit note, don't overwrite the original.
VAT groups: same TRN, different endpoints; model this in your master data and routing.
Exports/non-PEPPOL buyers: you still report the TDD; send the human-readable copy off-network.

Compliance checklist (paste into your tracker)

ASP selected with MoF accreditation status and OpenPEPPOL conformance.
PINT AE mapping complete for your top 10 use cases (standard, RCM, zero-rated, FTZ, e-commerce, exports, margin, commercial invoice, self-billing).
Outbound AR and inbound AP interfaces built with MLS handling.
Retention policy meets 5-year VAT (and 15-year real-estate) + internal corporate-tax retention.
Security posture aligned to ISO 27001, ISO 22301, encryption, MFA, and UAE cloud policy.
Training for AP/AR teams on credit-note corrections and exception handling.

FAQs (for your board and auditors)

Is PDF still okay? No. E-invoices must be structured XML in PINT AE; PDFs can be shared for human readability but do not satisfy exchange/reporting.

Do we need to sign invoices? No additional signature beyond PEPPOL's framework is required.

What about B2C receipts? Currently out of scope; discuss optional handling with your ASP (do not report those to Corner-5).

Will there be waves? Yes—phased implementation with adequate notice. Pilot/voluntary onboarding is allowed beforehand.

How long must we keep records? VAT: generally 5 years (longer for real estate and some capital assets); align with corporate-tax policies (commonly 7 years).