If you own the finance/engineering stack in the UAE, 2026 isn’t “far off”—it’s one engineering roadmap away. The Ministry of Finance (MoF) is rolling out a national e-invoicing regime based on the PEPPOL network and a UAE-specific data model (“PINT AE”). Phase-1 starts in July 2026 with a phased rollout to follow. You’ll issue and receive structured XML invoices via an Accredited Service Provider (ASP), while tax data is reported in near-real time to the Federal Tax Authority (FTA).
Below is a pragmatic CTO playbook—what changes architecturally, what to ask vendors, and a 90-day plan you can start now.
TL;DR for busy CTOs
- Who’s in scope? All B2B and B2G transactions; B2C is currently out of scope (you may exchange B2C via PEPPOL but do not report those to Corner-5).
- When? Phase-1 is July 2026 with phased onboarding (MoF will announce waves and give notice). Pilot/voluntary onboarding can start as soon as ASPs and your systems are ready.
- How? UAE is adopting a PEPPOL 5-corner model (Decentralized CTC + Exchange). You must use an Accredited Service Provider to validate/exchange invoices and to report tax data to FTA (Corner-5).
- Format? PINT AE (a UAE customization of PEPPOL’s international invoice), exchanged as structured XML(UBL-based). The official PINT AE BIS is published by OpenPEPPOL.
- Good to know: English is permitted; no QR code is required; no extra digital signature beyond PEPPOL’s security; credit notes are the way to correct errors; Payment Due Date must be present even for on-the-spot payments.
The model in plain English
Think two rails:
- Exchange – Your ASP sends/receives invoices over PEPPOL (AS4 protocol).
- Reporting – Your ASP also submits a Tax Data Document (TDD) to the FTA (Corner-5) in near real-time and handles status messages (MLS).
A typical flow:
- Your ERP/PoS/e-commerce pushes invoice data to your ASP (Corner-2).
- ASP validates against PINT AE, converts to UAE-standard XML if needed, and exchanges with the buyer’s ASP (Corner-3).
- In parallel, ASP reports the TDD to FTA (Corner-5); you receive status messages back.
Exports? If the buyer isn’t on PEPPOL, you’ll use a “dummy endpoint” for exchange and send the commercial copy off-network (e.g., email), but your ASP still reports the tax data to Corner-5.
Identifiers? Businesses are identified by TIN/TRN and a PEPPOL endpoint. VAT groups: each member needs its own endpoint (even though the group shares a TRN).
PEPPOL 5-Corner Live Flow Simulator
Watch how a UAE e‑invoice moves across PEPPOL. Corners 1–4 deliver the invoice to the buyer. In parallel, your ASP sends the Tax Data Document (TDD) to the FTA (Corner‑5) and returns MLS status updates. Choose a scenario, then press Run Flow.
- Generated (Corner-1)
- Validated & Exchanged (Corner-2 → 3)
- Delivered to Buyer (Corner-4)
- TDD Accepted (Corner-5 • MLS OK)
What changes in your stack
1) Data model & validation
The MoF’s consultation paper publishes PINT AE with mandatory/conditional fields and use-case tables (standard tax invoice, reverse charge, zero-rated, FTZ, e-commerce, exports, margin scheme, commercial invoice, self-billing, etc.). You’ll map internal fields to PINT AE (e.g., IBT-001 Invoice Number, IBT-005 Currency, IBT-009 Payment Due Date).
2) Integration pattern
- Outbound: ERP/PoS → ASP via API/SFTP/ETL (your choice with the ASP). ASP → buyer ASP via PEPPOL (AS4). ASP → FTA (AS4).
- Inbound: Buyer invoices arrive to your ASP and flow into your AP system; you’ll consume status callbacks (MLS) and validation errors programmatically.
3) Security & hosting
For ASPs, MoF requires controls such as ISO/IEC 27001 for the product, ISO 22301 for business continuity, encryption at rest/in transit, MFA, and adherence to UAE National Cloud Security Policy where applicable.
4) Archiving & retention
Maintain VAT records for 5 years (longer for capital assets) and 15 years for real-estate records; align with corporate-tax record-keeping (commonly 7 years). Plan an immutable e-archive with strong search and legal-hold.
Vendor strategy: picking an ASP (and keeping leverage)
Only Accredited Service Providers can exchange/report under UAE e-invoicing. MoF has issued Ministerial Decision No. 64 of 2025 setting out eligibility and accreditation procedures (pre-approval, testing with OpenPEPPOL, EmaraTax API, insurance, ISO, conformance, two-year validity, ongoing evaluation). Accreditation applications opened in March 2025; expect a public register of ASPs.
RFP prompts for your shortlist:
- Certification & status: Current MoF pre-approval/accreditation; OpenPEPPOL conformance.
- Data residency & cloud: UAE hosting options; compliance with UAE National Cloud Security Policy.
- Resilience: ISO 22301/27001 evidence; RTO/RPO; dual access points; failover tests.
- AP/AR coverage: Connectors for SAP/Oracle/Microsoft/NetSuite + PoS/e-commerce; multi-endpoint VAT-group support; buyer/supplier onboarding tooling.
- Validation depth: Full PINT AE validations (cardinality, code lists), configurable business rules, and MLS/TDDtransparency.
- Controls: Audit trails, immutable e-archive, retention policies, and export capabilities for regulator requests.
A reference architecture (at a glance)
- Source systems: ERP (SD/AR & MM/AP), billing, PoS, marketplace/e-commerce.
- E-invoicing gateway (ASP): API/ETL adapter → PINT AE validation → XML generation → PEPPOL exchange → TDD reporting → MLS webhooks.
- Compliance services: Identity (TRN/TIN mapping), endpoint directory, exception queue, credit-note automation, retention vault, reconciliation to VAT return.
90-day plan (you can start this today)
Days 1–15 — Discover & decide
- Name an owner (joint Finance–Engineering RACI) and define success (on-time issuance, <0.5 % validation failures, full AP ingest).
- Scope inventory: list all B2B/B2G flows (ERP, PoS, portals, marketplaces, intercompany). Flag VAT-group members—each needs its own endpoint.
- Data gap-fit vs PINT AE: map your fields to the mandatory/conditional set (invoice header, parties, lines, taxes, due date, currency, references). Create a backlog to remediate missing fields (e.g., buyer identifiers, UoM codes).
- ASP shortlist & sandboxes: issue a mini-RFP using the prompts above and request test credentials and a PEPPOL test endpoint.
Days 16–30 — Design & prepare
- Integration design: choose your push/pull method to ASP (API vs SFTP/ETL); define idempotency keys; design MLS callback handling; plan retries for transient AS4 errors.
- Numbering & corrections: standardize invoice/credit-note numbering and flows; remember credit notes are used to fix errors (no overwrite).
- Security & hosting: align with ISO 27001 controls and UAE cloud policy; finalize archival strategy that meets VAT/real-estate/corporate-tax retention.
- Change management: update supplier/customer onboarding to capture PEPPOL endpoint IDs and contacts.
Days 31–60 — Build & test
- Outbound AR pilot: generate PINT AE XML for 3–5 representative scenarios (standard, zero-rated, RCM, FTZ, export) and exchange via ASP test to dummy buyers; verify TDD is reported and MLS statuses are consumed.
- Inbound AP pilot: receive invoices from ASP, auto-validate, and post to AP with tolerance rules (tax/category codes, totals).
- Edge cases: ensure Payment Due Date always present; English content supported; confirm no QR code or extra signature required.
Days 61–90 — Harden & go-early
- Perf & resilience: load-test your highest-volume day; simulate ASP outage and confirm queueing/failover.
- Governance: finalize monitoring, alerting, and monthly reconciliation from MLS/TDD to VAT returns.
- Pilot with live counterparties (where possible): MoF allows early exchange/pilot before legislation takes effectonce you and an ASP are ready.
- Readiness sign-off: CFO, Head of Tax, CISO, and CTO jointly sign a go-live checklist; book the wave window once MoF/FTA announce onboarding phases.
90-Day Execution Tracker
Auto-schedule the CTO playbook into dated milestones. Track progress, add notes, and export to your calendar or CSV.
Field-level “gotchas” teams miss
- Due date is mandatory even for immediate payment—set due date = invoice date for cash sales.
- Currency rules: IBT-005 (invoice currency) must use ISO 4217; provide accounting currency and exchange rate when different from AED.
- Tax codes at line level are required; ensure category codes align with UAE code lists.
- Error correction = issue a credit note, don’t overwrite the original.
- VAT groups: same TRN, different endpoints; model this in your master data and routing.
- Exports/non-PEPPOL buyers: you still report the TDD; send the human-readable copy off-network.
Compliance checklist (paste into your tracker)
- ASP selected with MoF accreditation status and OpenPEPPOL conformance.
- PINT AE mapping complete for your top 10 use cases (standard, RCM, zero-rated, FTZ, e-commerce, exports, margin, commercial invoice, self-billing).
- Outbound AR and inbound AP interfaces built with MLS handling.
- Retention policy meets 5-year VAT (and 15-year real-estate) + internal corporate-tax retention.
- Security posture aligned to ISO 27001, ISO 22301, encryption, MFA, and UAE cloud policy.
- Training for AP/AR teams on credit-note corrections and exception handling.
FAQs (for your board and auditors)
Is PDF still okay? No. E-invoices must be structured XML in PINT AE; PDFs can be shared for human readability but do not satisfy exchange/reporting.
Do we need to sign invoices? No additional signature beyond PEPPOL’s framework is required.
What about B2C receipts? Currently out of scope; discuss optional handling with your ASP (do not report those to Corner-5).
Will there be waves? Yes—phased implementation with adequate notice. Pilot/voluntary onboarding is allowed beforehand.
How long must we keep records? VAT: generally 5 years (longer for real estate and some capital assets); align with corporate-tax policies (commonly 7 years).
