On this page
- Technical architecture
- AS4 vs AS2
- Peppol mandate timeline
- Retail and ecommerce use cases
- Key implementations
- Open source
- Commercial / hosted (as-of 2026-06-30)
- Adoption landscape
- Peppol-mandated B2B e-invoicing (selected countries, as-of 2026-07-30)
- Sector-specific mandates
- Relation to ebMS 3.0
- 2025–2026 developments
- Key terms
- Gaps
AS4 (Applicability Statement 4)
AS4 (Applicability Statement 4)
AS4 is an open OASIS standard for secure, payload-agnostic B2B document exchange over web services. It is formally defined as a Conformance Profile of the ebMS 3.0 (OASIS ebXML Messaging Services) specification, trimming ebMS 3.0's comprehensive options down to a "just-enough" interoperable profile modelled on AS2 (Applicability Statement 2)'s functional requirements. It became an OASIS Standard on 23 January 2013 and an ISO/IEC Standard (ISO/IEC 15944-15) in July 2020 (as-of 2020-07). Source: OASIS Open (oasis-open.org, 2013-02-15); Wikipedia/AS4.
In European Peppol networks, AS4 is the sole mandatory transport protocol since 6 September 2023, replacing AS2 (Applicability Statement 2) across all cross-border procurement and B2B e-invoicing workflows. Source: pagero.com (via vatupdate.com, 2023-05-10); docs.peppol.eu eDelivery migration policy.
Technical architecture
Protocol stack: AS4 runs on SOAP (versions 1.1 and 1.2) over HTTP/HTTPS, applies WS-Security for message-level security (XML Digital Signatures and XML Encryption), and wraps payloads as MIME attachments. Source: SEEBURGER (seeburger.com, updated 2026-07-22); pro2col.com.
Payload agnosticism: AS4 carries EDI (Electronic Data Interchange) messages (EDIFACT, ANSI X12, EANCOM, UBL (Universal Business Language)), XML, binary files, or any other format without tying the document type to the SOAP operation. Source: SEEBURGER (2026-07-22); OASIS Open.
Four message types (per ebMS 3.0):
- User Message — carries the business payload between two parties
- Signal Message: Receipt — confirms the receiving MSH parsed the incoming message
- Signal Message: Error — indicates a parsing problem
- Signal Message: Pull Request — enables the pull exchange pattern
Source: SEEBURGER (2026-07-22).
Message Exchange Patterns (MEPs):
- One-Way/Push — the sender actively transmits; the Peppol network mandates push-only (pull and two-way are excluded in the Peppol AS4 Profile v2.0.3). Source: docs.peppol.eu/edelivery/as4/specification (as-of 2024-04-22).
- One-Way/Pull — the recipient polls for messages when not directly addressable (e.g., behind a firewall). This MEP is available in the OASIS AS4 standard but excluded from the Peppol profile. Source: OASIS AS4 spec; Wikipedia/AS4.
AS4 Compression Feature: Payloads can be compressed as MIME attachments. HTTP chunked transfer encoding is mandatory for receiving Access Points in the Peppol AS4 specification. Source: docs.peppol.eu (Peppol AS4 Profile v2.0.3, 2024-04-22).
AS4 vs AS2
| Dimension | AS2 | AS4 |
|---|---|---|
| Standard family | IETF EDIINT (RFC 4130, 2002) | OASIS/ebXML (ebMS 3.0, 2007; AS4 profile, 2013) |
| Message format | Pure MIME | SOAP envelope + MIME attachments |
| Security | S/MIME (digital signatures + encryption) | WS-Security (XML Digital Signatures + XML Encryption) |
| Acknowledgement | MDN (Message Disposition Notification) | XML Receipt Signal Message |
| Exchange pattern | Push-only (both endpoints simultaneously reachable) | Push + Pull (recipient can poll) |
| Multi-payload | Not natively supported | Multiple file transfers per message |
| Metadata richness | Limited | Rich metadata support |
| Global prevalence | More widely adopted globally (legacy inertia) | Dominant in Europe due to Peppol mandate |
Sources: SEEBURGER (2026-07-22); pro2col.com; commport.com; Wikipedia/AS4.
AS4 vs AS2 global adoption: pro2col.com (undated) states AS2 remains "more widely used and preferred" globally and that AS4 "has not yet gained wide adoption." Aayutechnologies.com (2026) frames AS4 as the dominant modern standard in "Why Enterprises are Upgrading in 2026." The pro2col framing likely reflects a non-EU, non-Peppol view; within Europe's Peppol network, AS4 has been the sole permitted protocol since September 2023. Neither source provides quantitative global market share data.
Peppol mandate timeline
| Date | Event |
|---|---|
| December 2017 | OpenPeppol released the Peppol AS4 Profile v1.0 |
| 28 January 2019 (as-of) | OpenPeppol market readiness survey: ~60% of sampled businesses had implemented or planned AS4 by end of Q3 2019 |
| February 2019 | OpenPeppol passed a resolution to mandate AS4 |
| August 2019 | New Peppol Access Point providers required to support AS4 |
| 1 February 2020 | AS4 mandatory for ALL Peppol Access Points; AS2 support became optional |
| 6 September 2023 | Definitive AS2 end-of-life in Peppol; all AS2 endpoints removed |
| 22 April 2024 (as-of) | Current Peppol AS4 Profile version: v2.0.3, built on CEF eDelivery AS4 Profile v1.14 |
Sources: Unimaze Software (unimaze.com, 2022-05-24); vatupdate.com citing pagero.com (2023-05-10); EC CEF Digital (ec.europa.eu, 2019-02-19); docs.peppol.eu.
The 60% market readiness figure is from a survey dated 28 January 2019 — it reflects pre-mandate sentiment, not current adoption.
Retail and ecommerce use cases
In retail supply chain, AS4 is used within the Peppol four-corner model to exchange:
- ORDERS (purchase orders)
- INVOIC (invoices)
- DESADV (despatch advice / Advance Shipment Notification) — enables automated goods receipt at the warehouse
- RECADV (receipt advice) — confirms receipt of goods
In this model, the sending Access Point (C2) validates the structured document against Peppol BIS specs, wraps it in an SBDH (Standard Business Document Header) envelope, signs it, and transmits it to the receiving Access Point (C3) via AS4. C3 validates the SBDH, verifies the signature, delivers to the recipient (C4), and returns a transport acknowledgement. Source: medium.com/@node42-dev (2025); Peppol AS4 Profile v2.0.3.
EANCOM (the GS1 retail EDIFACT subset used by major European retailers) is a payload format commonly carried over AS4 in Peppol-connected retail networks. Source: edicomgroup.com; SEEBURGER (2026-07-22).
SEEBURGER lists retail alongside healthcare, utilities, and automotive as key AS4 sectors. Source: SEEBURGER (2026-07-22).
SAP integration: SAP S/4HANA Cloud supports receiving electronic invoices through the Peppol network via AS4 Access Points. SAP Cloud Integration (CPI) provides an AS4 adapter. Source: SAP Community (community.sap.com); YouTube AS4 adapter walkthroughs (2024).
Outside Europe: AS2 remains the dominant EDI transport for retail supply chain outside Europe. No source was found linking AS4 to major consumer ecommerce platforms (Shopify, Amazon) outside the Peppol context. Source: pro2col.com; web gaps noted 2026-07-30.
Key implementations
Open source
| Name | Notes |
|---|---|
| Domibus | European Commission reference implementation. v5.2.1.1 (as-of 2026-07-17), Java 21 + Jakarta EE 10. GitHub: github.com/cefedelivery/domibus |
| Oxalis | Leading open-source Peppol Access Point; widely used in Nordic countries |
| phase4 | Java-based AS4 library, actively maintained. GitHub: github.com/phax/phase4 |
| Holodeck B2B | Open-source ebMS 3.0 / AS4 gateway |
| Mendelson AS4 | GPL-licensed open-source AS4 software |
Source: OpenPeppol, peppol.org/tools-support/links-to-software (as-of 2026-06-30); EC Digital Building Blocks (2026-07-17).
Commercial / hosted (as-of 2026-06-30)
Axway, Babelway, IBM (webMethods B2B), SAP Integration Suite, SEEBURGER, Storecove, Tickstar, B2BRouter, Unimaze, Arratech, eConnect, Layer Security, Link4, Chasquis, ClayDesk/GoRoute, Billberry, 4CEE, Suma Technology Services. Source: peppol.org/tools-support/links-to-software (as-of 2026-06-30).
EDICOM is a named certified Peppol Access Point. Source: edicomgroup.com/peppol.
Adoption landscape
Peppol-mandated B2B e-invoicing (selected countries, as-of 2026-07-30)
| Country | Mandate | AS4/Peppol requirement |
|---|---|---|
| Belgium | 1 January 2026 (penalties from 1 April 2026) | UBL 2.1 + Peppol BIS 3.0 + AS4 mandatory for all VAT-registered B2B |
| France | 1 September 2026 | Peppol/AS4 one permitted channel |
| Poland | February 2026 (KSeF clearance model) | AS4/Peppol available as channel |
| Germany (B2B general) | January 2027 (>€800K turnover), January 2028 (all) | AS4/Peppol expected channel |
| Greece | 1 February 2026 (myDATA) | AS4/Peppol channel |
Sources: fiskaly.com (2026); kpmg.be (2025/2026); comarch.com; edicomgroup.com.
Sector-specific mandates
German energy sector (MaKo AS4):
- Electricity market communication: AS4 mandatory from 1 April 2024 (as-of 2024-04-01). Source: energyone.com; SEEBURGER (2026-07-22).
- Gas market communication: AS4 mandatory from 1 April 2025 (as-of 2025-04-01). Source: soptim.de; arvato-systems.com.
- Regulatory basis: Bundesnetzagentur directive of 31 March 2022. Source: energyone.com.
- MaKo AS4 requires ECC Brainpool curves and a Hardware Security Module (HSM) for key storage. Source: SEEBURGER (2026-07-22).
- Binding release dates in 2026 (1 April and 1 October) introduce further EDIFACT-to-JSON API migration alongside AS4. Source: innobu.com (2025/2026).
ENTSOG (European gas pipeline operators): AS4 mandated via interoperability network code, in force 1 May 2016. The ENTSOG AS4 Usage Profile mandates encryption and constrains algorithm choices. Source: entsog.eu; EC CEF Digital.
EUDAMED (EU medical devices): AS4 mandated for machine-to-machine submissions. By May 2026, all new medical device registrations in the EU required AS4 connectivity (as-of 2026). Source: aayutechnologies.com (2026).
Other sectors / regions:
- e-CODEX (EU cross-border justice): court document exchange
- EPREL (EU energy product registry)
- JEITA (Japan electronics industry)
- Superstream Pensions (Australia): XBRL-based superannuation data exchange
- IATA (aviation)
Source: SEEBURGER (2026-07-22).
Relation to ebMS 3.0
AS4 is a Conformance Profile of the OASIS ebXML Messaging Services Version 3.0 (ebMS 3.0). ebMS 3.0 defines user messages, signal messages, multiple MEPs, P-Modes (processing modes), and security requirements — but contains "numerous options and comprehensive alternatives." AS4 constrains these into an interoperable profile using "just-enough" design principles, taking AS2's functional requirements as the blueprint. Source: OASIS Open (ebxml.xml.org); OASIS AS4 Profile v1.0 specification (docs.oasis-open.org).
eDelivery AS4 2.0 (European Commission extension): The EC's eDelivery AS4 Profile is a further constraint of OASIS AS4 used across EU digital services. Version 2.0 was adopted by the eDelivery Operational Management Board on 4 December 2024. AS4 2.0 adds Elliptic Curve Cryptography (ECC), ebCore Agreement Update, multiple certificate support, and Dynamic Discovery lookup by recipient Access Point identity. Source: EC Digital Building Blocks (ec.europa.eu, 2024-12-05; 2026-02-27).
Peppol AS4 spec vs eDelivery AS4 2.0: The current Peppol AS4 Profile v2.0.3 (2024-04-22) references CEF eDelivery AS4 v1.14 as its base — the pre-2.0 version. The eDelivery AS4 2.0 profile was adopted December 2024. Whether and when OpenPeppol will align its specification with eDelivery AS4 2.0 is not stated in any source found (as-of 2026-07-30).
2025–2026 developments
- Domibus 5.2 (Java 21 + Jakarta EE 10): RC1 published November 2025; final February 2026; v5.2.1.1 security patch released 2026-07-17. Source: EC Digital Building Blocks (2025-11-26; 2026-07-17).
- eDelivery AS4 2.0 interoperability validation: December 2025 interop event (first post-adoption test) and January 22 2026 follow-up confirmed implementation maturity across four external providers + Domibus. February 27 2026: EC published post-event report. Source: EC Digital Building Blocks (ec.europa.eu, 2026-02-27).
- Belgium B2B live: January 1 2026 — Peppol/AS4 mandatory for Belgian VAT-registered businesses; penalties enforced from April 1 2026. Source: fiskaly.com; kpmg.be.
- France B2B mandate: September 1 2026. Source: fiskaly.com.
- Germany MaKo gas: AS4 mandatory from April 1 2025; 2026 release dates introduce EDIFACT-to-JSON API migration. Source: innobu.com; energyone.com.
- Peppol PKI G2→G3 migration completed Q1 2026: Old DigiCert CA chain retired April 1 2026. Source: openpeppol.atlassian.net.
- OpenPeppol November 2025 Release: Updates effective February 23 2026. Source: peppol.agid.gov.it.
- EUDAMED AS4 mandate: By May 2026, AS4 required for all EU medical device registrations. Source: aayutechnologies.com (2026).
Key terms
| Term | Meaning |
|---|---|
| ebMS 3.0 | OASIS ebXML Messaging Services 3.0 — the parent standard AS4 profiles |
| AS4 Conformance Profile | The subset of ebMS 3.0 options that AS4 mandates |
| SOAP | Simple Object Access Protocol — the message transport envelope |
| WS-Security | Web Services Security — XML-level digital signing and encryption used in AS4 |
| MSH | Message Service Handler — the software component that sends/receives AS4 messages |
| SBDH | Standard Business Document Header — Peppol envelope wrapping the payload |
| P-Mode | Processing Mode — configuration file defining AS4 message handling parameters |
| MEP | Message Exchange Pattern — push (sender-initiated) or pull (receiver-polled) |
| MDN | Message Disposition Notification — AS2's receipt mechanism (replaced by XML Signal in AS4) |
| Access Point | Service provider connecting a business to the Peppol network via AS4 |
| MaKo | Marktkommunikation — German energy market communication, with its own AS4 sector profile |
| Four-corner model | Peppol message path: sender (C1) → sending AP (C2) → receiving AP (C3) → recipient (C4) |
| ECC Brainpool | Elliptic Curve Cryptography curves mandated in MaKo AS4 and eDelivery AS4 2.0 |
Gaps
- No quantitative throughput or performance benchmarks comparing AS4 and AS2 in any source found.
- AS4 outside Europe (non-Peppol retail) not well-documented — AS2 appears to remain dominant for retail EDI in North America and Asia-Pacific.
- OpenPeppol's timeline for aligning the Peppol AS4 Profile with eDelivery AS4 2.0 not announced as of 2026-07-30.
- Ecosio.com AS4 content not reachable during this harvest.
- Reddit/practitioner perspectives not available (MCP unavailable in Cowork cloud).