AS2 (Applicability Statement 2)

AS2 is an HTTP-based protocol for the secure point-to-point exchange of structured business data — including EDI (Electronic Data Interchange)|EDI messages — over the internet, using encryption, digital signatures, and delivery receipts. It is the dominant EDI transport protocol in North American retail supply chains and is mandated by Walmart, Amazon, Target, and thousands of other retailers for supplier connectivity.

What AS2 is and how it works

AS2 is a transport protocol, not a content standard — it carries EDI payloads (such as ANSI X12 or EDIFACT documents) without dictating their internal format. According to SEEBURGER (2026-07-22), AS2 transmits data as an "envelope" sent via HTTP or HTTPS: the sending system prepares and encrypts the data; the receiving system decrypts and verifies it; and the receiver then returns an MDN (Message Disposition Notification) confirming successful delivery. AS2 supports EDI, XML, plain text, and binary file formats — any mutually agreed-upon format may be transferred, making it format-agnostic at the transport layer.

Each AS2 participant requires a unique identifier, a certificate, and AS2-capable software. Trading partners must exchange public keys before communication can begin (SEEBURGER, 2026-07-22).

Key terms

Term	Meaning
MDN (Message Disposition Notification)	Digital receipt returned by the receiver to confirm successful delivery; can be synchronous or asynchronous; can include a Message Integrity Check (MIC) and digital signature for non-repudiation
S/MIME	The security standard used by AS2 for encryption and digital signatures
AS2 ID	Unique identifier assigned to each AS2 trading partner (sender and receiver each have one)
Trading Partner Agreement	Document defining protocol parameters exchanged between parties before AS2 communication begins — see Trading Partner Agreement
DEFLATE	Optional compression applied to AS2 payloads to reduce message size

Security features

Per SEEBURGER (2026-07-22), AS2 messages are secured through three mechanisms applied in combination:

AES or 3DES encryption for confidentiality
S/MIME digital signatures for authentication and non-repudiation
Optional DEFLATE compression to reduce message size

MDNs can be synchronous (returned in the same HTTP connection) or asynchronous; they can include a Message Integrity Check (MIC) and a digital signature to support non-repudiation (JSCAPE, undated).

Walmart specifically requires SHA-256 signed certificates for AS2 connections; certificate expiry is described as the most common cause of AS2 connectivity failure in supplier relationships (Aayu Technologies, 2025-09-08). According to gerloff.dev (2026-03-19), AS2 X.509 certificate expiration — typically on 1–2 year cycles — is the most common operational cause of AS2 outages; certificate renewal calendaring is described as non-optional operational hygiene in 2026.

Role in retail/ecommerce supply chains

Walmart was the first major retailer to mandate AS2 for suppliers, having originally mandated EDI in 1988; Amazon, Target, Lowe's, and Bed Bath & Beyond followed, and thousands of other retailers now require it (Aayu Technologies, 2025-09-08). In Europe, ASDA requires AS2 as the EDI transport protocol for its supplier trading-partner platform, served through TrueCommerce (TrueCommerce, undated). Migros also mandates AS2 (ecosio, 2025-08-08).

Walmart requires all four core EDI transactions to flow exclusively through AS2 (Crstl.ai Walmart 2026 Guide):

EDI 850 (Purchase Order)
EDI 855 (PO Acknowledgment, due within 24 hours)
EDI 856 (Advance Ship Notice, sent before shipment arrives at DC — best practice: within 30 minutes of carrier pickup)
EDI 810 (Invoice)

The EDI 856 (ASN) is described as the single most error-prone document in the Walmart ecosystem; it must match the physical shipment exactly on quantities, SSCCs, and PO references (Crstl.ai, 2026).

Compliance and penalties (as-of 2026)

OTIF (On-Time In-Full) failures at Walmart trigger automatic chargebacks typically set at 3% of the affected PO value; ASN timing and accuracy errors also attract per-incident fees of $50–$500 (as-of 2026, Crstl.ai 2026 Guide — vendor source; volatile). Amazon's mandates focus on 997 functional acknowledgments, ASN accuracy with tracking numbers, and invoice precision; errors result in similar penalties (Aayu Technologies, 2025-09-08).

AS2 vs alternative transport protocols

AS2 vs AS4

AS2 migration urgency: Aayu Technologies (2026-01-13 — vendor selling AS4 migration services) frames AS2 as "stretched beyond what it was designed for" and depicts enterprises "actively migrating to AS4." The same source simultaneously states "AS2 won't vanish soon" and confirms Walmart/Amazon still mandate AS2 with no announced changes. By contrast, SEEBURGER (2026-07-22), ecosio (2025-08-08), and gerloff.dev (2026-03-19) frame AS2 and AS4 as coexisting technologies — not a replacement cycle — with AS2 remaining non-negotiable in North American retail.

AS2 operates synchronously — sender and receiver must both be available simultaneously; if the receiving server is down, the transfer fails (Aayu Technologies, 2026-01-13). AS4 (Applicability Statement 4) became an ISO standard in 2020 and is natively asynchronous, using SOAP/ebMS 3.0/WS-Security; messages queue and retry automatically without requiring both parties to be online simultaneously (Aayu Technologies, 2026-01-13).

AS4 uses WS-Security rather than AS2's S/MIME, enabling granular control over which parts of a message are signed or encrypted — headers can remain visible for routing while payload stays protected (Aayu Technologies, 2026-01-13). AS4 is the protocol of choice for Peppol (the European e-invoicing network), national e-invoicing platforms, and EUDAMED (EU medical device regulation); AS2 is not used in these contexts (Aayu Technologies, 2026-01-13).

AS2 vs VAN

Historically, EDI flowed through Value Added Network (VAN)|VANs (third-party messaging networks); AS2 enabled direct point-to-point transmission over the internet, bypassing VAN fees. A practitioner heuristic from gerloff.dev (2026-03-19): switching from VAN to direct AS2 becomes economical at approximately 10,000+ documents per month per partner, at which point per-document VAN fees typically exceed the overhead of managing a direct AS2 connection (as-of 2026 — pricing-dependent; volatile).

AS2 vs API (REST)

According to gerloff.dev (2026-03-19), REST APIs (via Amazon Vendor Central, Zalando, REWE Digital) are replacing AS2 for new modern-platform integrations; the boundary between "EDI" and "API integration" is blurring, though EDIFACT/AS2 continues for existing bulk structured-document exchange (POs, invoices, ASNs). The SPS Commerce 2026 Demand Report treats EDI connectivity (and AS2 implicitly) as baseline infrastructure rather than a 2026 differentiation point (SPS Commerce, 2026-03-03).

Setup and implementation

Onboarding timelines (as-of 2026)

Onboarding duration: Crstl.ai (an AI-powered EDI vendor) claims its platform achieves 1–3 weeks vs 8–14 weeks for legacy providers (8–14 week breakdown: provider onboarding 2–4 weeks, AS2 configuration 1–2 weeks, document mapping 2–4 weeks, certification testing 2–4 weeks). No independent benchmark validates the 1–3 week figure; the comparison originates from a vendor with commercial interest in the contrast (Crstl.ai, 2026).

Körber Supply Chain's EDI module promises 6–8 week implementation timelines for managed services (Körber, undated).

Deployment models (as-of 2026)

Cloud deployment of AS2 is growing — frequent trading-partner onboarding driven by new retail mandates favours cloud AS2 over on-premise for speed and certificate management. On-premise AS2 is positioned by vendors as fitting regulated, stable, high-volume workloads (Aayu Technologies, 2025-09-08).

Costs (as-of 2026 — volatile, vendor-sourced)

Legacy EDI provider costs: setup fees $1,000–$5,000; monthly minimums $300–$1,000; per-document fees $0.10–$0.50 (Crstl.ai, 2026 — vendor comparison source)
AI-powered platforms: flat subscription pricing $500–$2,000/month without per-document fees (Crstl.ai, 2026 — vendor comparison source)
GS1 Company Prefix (required for GTINs and SSCC codes): $250 initial + $50/year (up to 10 products) to $10,500 initial + $2,100/year (up to 100,000 products) (as-of 2026, Crstl.ai 2026)

Software ecosystem

The AS2 market includes both specialist managed-service networks and enterprise middleware platforms:

Vendor	Model	Notable for
SPS Commerce	Managed network	Largest retail trading-partner network (115,000+ businesses as-of 2026); managed only — no direct AS2 control (volatile, Cleo blog 2026)
TrueCommerce	Cloud-hosted managed	Full platform: EDI, API, ERP connectivity, e-commerce, marketplace integrations (Cleo blog, 2026)
SEEBURGER	On-premise + cloud	Enterprise AS2/AS4 integration platform; 2026-dated documentation
IBM Sterling B2B Integrator	On-premise + cloud	Dominant in enterprise retail and CPG; AS2 configuration tutorials still published 2025 (YouTube metadata)
MuleSoft Anypoint Partner Manager	Cloud iPaaS	Salesforce-owned; supports AS2 as first-class B2B transport (MuleSoft YouTube, 2024)
Aayu Technologies / MFT Gateway	Cloud SaaS	AS2+SFTP combined setup pattern; Walmart/Amazon mandate specialist (YouTube 2025)
Cleo	Hybrid	Supply chain orchestration; cited in Gartner Supply Chain Orchestration Platforms 2026-07-16
ecosio	Cloud SaaS	European EDI-as-a-Service; AS2 and AS4 supported; EU/EDIFACT-focused

AI tooling in 2026 can automate 50–70% of EDI mapping effort (structural field mapping) but cannot replace human input for business logic; AS2 transmission-layer operations — certificate management, retry logic — remain standard middleware concerns, not AI candidates (gerloff.dev, 2026-03-19).

What practitioners report

From YouTube metadata (2024-2025; no transcripts available):

IBM Sterling B2B Integrator AS2 setup tutorials were published as recently as February 2025, confirming Sterling remains an active runtime for AS2 in enterprise retail (YouTube metadata, 2025).
MuleSoft Anypoint Partner Manager supports AS2 as a first-class B2B transport; AS2 remains part of composable B2B stacks (YouTube metadata, 2024).
AS2+SFTP combined configurations are a current deployment pattern in 2025 (Aayu Technologies MFT Gateway demo, July 2025).
No conference-track content (ShopTalk, NRF, eTail) was found for AS2 in 2024–2026; it is treated as infrastructure, not a strategic conference topic.