beliq vs. self-hosting the official rulesets

The Schematron and XSD rulesets beliq runs are free and public. This page is the honest case for and against hosting them yourself, and what changes once you cover more than one authority.

The rules beliq checks your invoice against are not secret. They are the official Schematron and XSD artefacts that CEN, KoSIT, OpenPeppol, FNFE-MPE, and FeRD publish for free. Anyone can download them and run them. So the fair question for this exact buyer is: why not just self-host them?

The honest answer is that the artefacts are the easy part. What you take on when you self-host is the perpetual maintenance of every authority’s ruleset, and the failure mode when you fall behind is silent.

The artefacts really are free

beliq does not hide this, and it does not run a private approximation of the rules. It runs the authorities’ own files, pinned to a stated version and a SHA-256 checksum, and it publishes the full inventory. The validation artifacts page lists every pinned artefact, its version, its source, and its checksum. How verification works shows how you confirm, from values on your own result, that the artefact beliq ran is the one the authority published.

If a single, unchanging ruleset were the whole job, self-hosting would be the right call and this page would end here. It is not the whole job.

What self-hosting actually costs

The cost is not wiring the validator up once. It is the standing obligation that starts the moment you go live:

• Watch each authority for new releases. None of them notify you. You track their release channels yourself.
• Classify every change. Is it a safe fix that leaves valid documents valid, or a breaking change that turns a previously-valid invoice into a rejection? You read the diff and decide.
• Test and roll out before the cutover. A new ruleset has an effective date. Miss it and you are validating against rules the authority has already retired, or has not yet adopted.

That is not a one-time project. It runs for as long as you issue invoices.

The rulesets version independently

The reason this is heavier than it looks is that you are not maintaining one ruleset. Even a three-country footprint stacks several upstreams that do not coordinate their releases:

The mandate calendar shows how these obligations land on different dates. The rulesets behind them move on their own schedules too. Each new market you add is another upstream to watch, on top of the base standard they all layer on.

The failure mode is silent

KoSIT versions XRechnung with semantic versioning, and a MAJOR bump can make an XML document that validated cleanly yesterday invalid today. If you miss that bump, your self-hosted validator keeps returning “valid” against the rules you last pulled. Nothing errors. You find out when your buyer’s system rejects the invoice, or when a tax authority does, which is the most expensive place to learn it.

What beliq does with the same artefacts

beliq runs the identical public artefacts, and puts the maintenance work behind them:

• Pinned and checksummed. Every artefact is fixed to a version and a SHA-256 you can see and reproduce. See validation artifacts.
• Calendar-enforced re-verification. Each artefact carries a due date, and the build fails until someone re-checks it against the authority’s published source and moves the date forward. This is a published cadence, not a crawler watching upstream for you, and beliq states it that way.
• Breaking changes get notice, not surprise. A change that could newly invalidate a document is announced at least 90 days ahead, and the outgoing ruleset is retained on the previous channel so you can pin to it while you adapt. The mechanics are in ruleset versioning.
• You can still check the work. Because beliq pins the authority’s own files, you verify from your own result that the ruleset that judged you is the published one. See how verification works.

The difference is not the rules. It is who owns noticing when they change.

Self-hosting does not solve transmission either

Worth being clear about the boundary: the free artefacts are the validation layer and nothing more. They do not send your invoice. Whether you self-host or use beliq, getting the file to your buyer or to a tax authority is a separate step handled by your Access Point, certified platform, or ERP. See what beliq does and does not do and do I need a Peppol Access Point?. The compliance layer and the delivery step stay separate either way, so self-hosting the rules buys you nothing on the delivery problem.

When self-hosting is the right call

This is a real decision, not a foregone one. Self-hosting the free artefacts is a sound choice when:

• you validate a single format for a single country, and
• that authority’s release cadence is something you can commit to watching, and
• you have someone who owns that watching, indefinitely.

Under those conditions the official artefacts are genuinely enough, and beliq would be paying for maintenance you are already able to do.

beliq earns its place the moment that stops being true: when you span more than one authority, when the rulesets version independently, or when nobody on the team can promise to be the person tracking each authority’s next MAJOR bump. That is the buy-vs-build line, and it is worth deciding deliberately rather than discovering after an invoice bounces.

Related

• Scope: what beliq does and does not do, and where the transmission boundary sits today.
• How verification works: confirm the ruleset that judged you is the authority’s published one.
• Ruleset versioning: channels, the 90-day breaking-change policy, and the previous channel.
• Validation artifacts: the live inventory of pinned artefacts, versions, and checksums.