Exact status, exact entity
Record whether the bidder is a member, certified network provider, country-accredited provider or applicant. Capture the legal entity and current official evidence.
Buyer’s guide · 12 questions
Choose the evidence. Then choose the provider.
An e-Invoicing Service Provider becomes part of your tax, finance and technology operating model. Evaluate the exact legal entity, service chain, controls and exit obligations—not only the product demonstration.
Before the shortlist
Set three non-negotiable rules.
The UAE five-corner model is provider-mediated, but C2 and C3 are transaction roles—not two separate ASP purchases for each business. Your appointed provider relationship should support your organisation when it sends and when it receives.
One complete relationship
Evaluate outbound and inbound scope together: supplier-side C2 functions when you sell and buyer-side C3 functions when you buy.
Evidence over adjectives
Replace “secure,” “compliant” and “seamless” with documents, demonstrations, test results, operating procedures and enforceable obligations.
The due-diligence register
Twelve questions that reveal the operating model.
Issue the questions in writing. Score the answer, the evidence and the contractual commitment separately; a convincing presentation is not evidence of sustained service.
01Regulatory status
What status does the bidding legal entity hold today?
Separate OpenPeppol membership, Peppol service-provider certification, UAE accreditation and an application still under review.
RequestOfficial register entry, legal entity name, jurisdiction, scope and current date.
Red flagOne label—“approved” or “certified”—used for several different statuses.
02Service relationship
Can one appointment support us as both supplier and buyer?
Confirm the provider’s contracted scope for outbound and inbound processing, including C2 and C3 responsibilities across your transaction roles.
RequestService description, onboarding model, RACI and inbound/outbound demonstration.
Red flagStrong outbound capability but unclear AP delivery, status or reporting ownership.
03Operating chain
Who operates each material part of the service?
Subcontracting is not automatically a weakness, but ownership, escalation and data handling must remain visible.
RequestService-chain diagram, subprocessors, operating entities and end-to-end accountability.
Red flagCritical network or reporting dependencies disclosed only after contracting.
04Document coverage
Which UAE document profiles and scenarios are evidenced?
Evaluate Invoice, Credit Note, Self-Billed Invoice and Self-Billed Credit Note support against the applicable PINT AE baseline.
RequestRuleset versions, mapping catalogue, test cases and upgrade/version policy.
Red flag“PINT compatible” without exact versions, document types or negative tests.
05Reporting & status
Can every exchange and reporting outcome be correlated?
Require a single evidence chain across source records, PINT AE documents, transport, MLS, TDD/TDS and customer-system delivery.
RequestLifecycle model, identifiers, negative-path evidence and reconciliation demonstration.
Red flagA dashboard status that cannot be traced back to underlying messages and timestamps.
06Integration
How will our real systems connect and recover?
Assess APIs, webhooks, files, ERP connectors, correlation, duplicate prevention, retries, rate controls and operational reprocessing.
RequestAPI documentation, error model, sandbox approach and representative integration plan.
Red flagOnly happy-path demonstrations or no clear source-system status synchronisation.
07Security & privacy
Which controls cover our data and privileged access?
Evaluate identity, MFA, RBAC, encryption, secrets, logging, monitoring, vulnerability management, subprocessors and data-location disclosures.
RequestControl matrix, certification scope, architecture, access-review evidence and incident process.
Red flagA certificate name without entity, system, location, scope or validity details.
08Resilience & support
What happens during a serious incident?
Review service objectives, support hours, severity definitions, escalation, notification, recovery, root-cause review and continuity tests.
RequestContracted SLA/SLO schedule, support RACI, continuity summary and sample incident report.
Red flagAvailability promises with exclusions, dependencies or recovery obligations left undefined.
09Delivery
How will scope become tested production operation?
Demand a plan covering entities, flows, mapping, environments, positive and negative tests, reconciliation, training, cut-over and hypercare.
RequestDelivery method, stage gates, acceptance criteria, customer responsibilities and change control.
Red flagA fixed go-live date before discovery of entity and integration scope.
10Regulatory change
How are rule and specification changes governed?
Assess monitoring, impact analysis, version support, customer notification, regression testing and deployment approval.
RequestChange procedure, release notes, supported-version policy and sample impact notice.
Red flagAutomatic updates with no visibility into behavioural or mapping changes.
11Commercial model
Can we predict the cost as scope and volume change?
Model implementation, subscriptions, volumes, overages, support, environments, country activation, change requests and third-party charges.
RequestOne authoritative rate schedule, worked scenarios, reconciliation rules and price-change controls.
Red flagLow headline price with material network, support or environment costs left open.
12Exit & portability
How do we change provider without losing control?
Define data and evidence export, format, integrity, transition support, deletion, retention, continuity and charges before signature.
RequestExit schedule, export sample, transition obligations and verified deletion process.
Red flagExit support described as “to be agreed” after termination.
Weighted evaluation
Make the score reflect operational risk.
Score each domain from 0–5, multiply by the weight, and preserve the evidence reference beside the score. Set minimum gates for regulatory status, security and exit—not only a total-score threshold.
DomainWhat the score should representWeight
Regulatory status & service scopeExact legal entity, current status, sending/receiving scope and accountable operating chain.20%
UAE functional coveragePINT AE documents, validation, reporting, message status and exception handling.20%
Integration & evidenceConnectivity, correlation, recovery, reconciliation and auditability.15%
Security & resilienceControl scope, access, monitoring, continuity and incident obligations.15%
Operations & supportService levels, escalation, root-cause process and operating transparency.10%
Delivery & changeImplementation method, acceptance, regulatory change and customer responsibilities.10%
Commercials & exitPredictable cost, change controls, portability and transition protection.10%
Scoring discipline: award no more than 2/5 when the answer is plausible but unevidenced. Treat a missing mandatory gate as a disqualification even if the weighted total is high.
Contract translation
Turn good answers into enforceable obligations.
A due-diligence response has limited value if the final agreement narrows it through schedules, exclusions or undefined dependencies.
01
Scope schedule
Name entities, document types, environments, integrations, jurisdictions and provider responsibilities.
02
Service and support schedule
Define service objectives, severity, notification, escalation, maintenance, reporting and remedies.
03
Security and data schedule
Record data locations, subprocessors, controls, audit rights, incident duties and deletion obligations.
04
Change schedule
Separate regulatory updates, included maintenance, customer changes and chargeable enhancements.
05
Exit schedule
Pre-agree export, transition assistance, evidence continuity, deletion, timing and charges.
Apply the same test to Invocor
Our current position, without shortcuts.
Invocor should be evaluated against the same questions and minimum gates as any competing provider. Product capability and regulatory permission remain separate.
Membership is distinguishable from certified service-provider status and UAE accreditation.
Invocor is not live as an accredited UAE eInvoicing Service Provider.
PINT AE, Self-Billing, provider-side exchange, reporting, integration, status and evidence capabilities are implemented or configurable in the controlled baseline.
Accreditation, production onboarding, certificates, authority access, customer testing and cut-over are required before live operation.
Primary references
Verify against current official records.
- UAE Ministry of Finance — Accreditation of eInvoicing Service Providers
- OpenPeppol — Certified Service Providers
- OpenPeppol — Testbed and technical conformance
- OpenPeppol — Service Level Requirements
This guide supports procurement analysis and does not replace legal, tax, security or regulatory advice. Verify the current status and applicable requirements at the time of selection and contracting.
Put the same twelve questions to us.
Use the scorecard to structure a focused provider and architecture discussion.