What this adds beyond eDelivery and AS4

How the protocol compares with the EU's four-corner messaging infrastructure, what AS4 does better, and when each is the right choice.

Audience: both (architect-leaning) · Read route: understand

eDelivery is the European Commission's building block for secure document exchange between organisations, with AS4 as its messaging profile. It is mature, widely deployed and mandated in networks such as Peppol, customs and social security; eDelivery 2.0 was adopted in December 2024. Where the law or a network scheme says AS4, the answer is AS4.

The two occupy different layers with different guarantee scopes: AS4 is a messaging profile that secures the delivery of a message between two access points, while the base protocol is a data-plane architecture that secures the record of the exchange itself. Several comparisons below therefore compare adjacent layers rather than substitutes, and the page says so where it happens. This page is published by the SDX side of the comparison; the sources are cited so the claims can be checked, and what eDelivery does better is stated just as plainly, so you can choose on the merits.

The guarantee, corner by corner

eDelivery's common network deployment is known as the four-corner model. The sending party (corner one) hands a document to a sending access point (corner two), which transmits it over AS4 to the receiving access point (corner three), which delivers it to the receiving party (corner four). Corners one and four never speak AS4 themselves; keeping small parties off the wire through service providers is a deliberate design feature of the model, not a limitation. AS4 also profiles a two-corner topology in which a party operates its own access point and the message signature is that party's own.

In the four-corner form, AS4's security applies between corners two and three. The message is signed and encrypted between access points, and signed receipts give non-repudiation at that exchange. The scope is stated in the profile itself: in the four-corner topology enhancement, the origin is the sending access point; end-to-end non-repudiation of origin for the original sender (corner one) is placed out of scope, and so is end-to-end non-repudiation of receipt for the recipient (corner four). Access points parse envelope and routing data as a contracted, scheme-governed function. Whether the business payload is readable at the access point is a deployment choice: AS4 carries payloads of any type, so parties can add business-level end-to-end signatures and encryption inside the payload, and some schemes do.

The base protocol draws the boundary differently, as the default of the substrate rather than a per-scheme addition. The originator signs the record under a scoped mandate, every field is encrypted to the counterparty, and a commitment is anchored where any third party can verify it. The recipient, and any auditor later, verifies the party rather than the transport, and no routing party holds a decryption key for any field. What a third party can verify is that the exchange happened and the record is unchanged; reading content still requires the field keys, so this is proof of integrity and existence, not disclosure.

One asymmetry to keep in view throughout: eDelivery is a tested regime with conformance services and years of mandated production traffic, while SDX reflects specification v0.1, with provisional items open and only its first test-vector suites published.

The delta

eDelivery / AS4 concept	Base-protocol concept	What changes, and what it costs
Signature and encryption between access points (corners two and three)	Signature by the originating actor, anchored commitment	Verification reaches the party that acted and survives beyond delivery. The cost: the originating party now holds and manages signing keys.
Payload readable at the access point in the common deployment; end-to-end protection possible inside the payload per scheme	Per-field encryption to the counterparty as the protocol default	The guarantee moves from a scheme choice to the substrate. The trade: routing metadata is still visible to the overlay operator, and anchored commitments are public, so the fact of an exchange is visible even though its content is not.
Signed receipts between access points, third-party checkable if the evidence is retained	Anchored commitments on a public audit layer	Nobody has to retain private evidence for the proof to survive; verification covers integrity and existence, not content.
Discovery via SML and SMP against the network's PKI	Directory attestation and topic addressing	Both resolve counterparties. The trust root moves from a network certificate authority to a directory attestation, which has its own admission governance; who may operate a directory is a deployment question.
Accreditation of access points under a published network policy	An open specification, a key pair and a directory attestation	The accreditation gate becomes an attestation, and, where deployments use consortium overlays, a membership decision that the specification currently holds open as provisional item PROV-3. What the design removes is not the existence of operators but their discretionary power.
SOAP and WS-Security messaging, payloads of any type	Deterministic CBOR envelope, ES256, AES-GCM	No SOAP or WS-Security stack is involved; the encoding is byte-exact by specification, so two implementations commit to identical bytes.

What eDelivery does better

On these points eDelivery is the stronger tool:

Legal and network standing. AS4 is the mandated profile in Peppol, ICS2, EESSI and other schemes. Interoperability with those networks is a compliance fact, and no alternative protocol substitutes for it.
Qualified evidentiary status. eIDAS-qualified electronic registered delivery carries a legal presumption of integrity, of sending and receipt by identified parties, and of date and time accuracy. An anchored commitment carries no such presumption, and SDX does not claim qualified-trust-service status.
The four-corner separation itself. Keeping corners one and four off the wire is a design achievement: a small organisation joins by contracting a service provider and posting a document, without operating messaging infrastructure of any kind.
Reliable-messaging semantics at scale. Retries, duplicate elimination, receipts and large-message handling are battle-tested across years of mandated production traffic, under contractual service levels with recourse.
A mature product ecosystem. Off-the-shelf access-point software, commercial support, conformance testing and an operator market exist today.
Formal governance. Profiles are versioned and adopted by an operational management board; change management is institutional, not project-based.

If your exchange lives inside a mandated network, use eDelivery.

Where the guarantee scopes differ

The substantive difference is evidentiary scope, not onboarding weight. A four-corner deployment produces hop-level evidence between access points; proving what the originating party committed to, end to end, is out of the profile's scope and is solved per scheme where it is solved at all. The base protocol makes originator-signed, anchored, independently verifiable records the default for every exchange.

A 2020 presentation from the Commission's DIGIT services examined the fit limits of AS4 and proposed a REST profile for lighter contexts: organisations without resources to operate messaging infrastructure, low-throughput scenarios, single-individual counterparties and HTTP-client-only parties. The adopted eDelivery 2.0 set (AS4 2.0, SMP 2.0, BDXL 2.0, ebCore Party Id 2.0) does not include a REST messaging profile, though service providers and tooling such as Domibus serve HTTP-only backends within the four-corner model today. The base protocol approaches the same contexts from the other end: verification works from any environment that can check a signature, and participation starts from a key pair and an attestation rather than from a network contract.

The trades this page does not hide

Metadata and the public graph. The overlay operator sees routing metadata much as an access point does, and anchored commitments are public and permanent: the fact that exchanges happened is visible to anyone, even though content is not.
Availability. The overlay is not trusted for integrity, but it is relied on for delivery and liveness. An accredited access point runs under contractual service levels; an overlay operator's obligations are whatever the deployment agrees.
Admission is not zero. A key pair creates a pseudonymous account; acting toward regulated counterparties requires a directory attestation binding a legal entity to that key, and someone performs that binding. Consortium-overlay membership is held open as provisional item PROV-3.
Cost and custody. Anchoring has a per-record cost and a funding and custody model that the current specification scopes out; a deployment has to answer both.
Data protection. Public, append-only commitments meet erasure obligations through the erasable-mandate pattern, held as provisional item PROV-4 in Identity and delegation; the link-erasure mechanism itself is operator configuration, outside the open specification.
Maturity. Specification v0.1, provisional items open, first test vectors published and the rest pending. eDelivery's conformance regime is years ahead.

When to use which

Situation	Choice
A mandated network flow (Peppol invoicing, ICS2, EESSI)	eDelivery. The network defines the profile.
High-volume document delivery inside an accredited network	eDelivery. The ecosystem and semantics are built for it.
An exchange whose record must be verifiable by third parties afterwards (auditors, regulators, courts)	The base protocol. Originator-signed, anchored records are the design centre; note that this proves integrity and existence, with content disclosure a separate, keyed step.
Parties that want verifiable exchange without joining an accredited network	The base protocol is designed for this: a key pair and a directory attestation rather than a network contract. The trades listed above still apply.
Data that must stay selectively disclosed per counterparty, as a substrate default	The base protocol. Field-level encryption is on by default; inside AS4 networks the same end can be reached per scheme at the business-document layer.
Both needs at once	Run both. Keeping the mandated AS4 flow and anchoring commitments alongside it is a design option, not yet a demonstrated pattern.

The trade in one line

eDelivery secures delivery inside accredited networks, with legal standing and a qualified evidentiary regime; the base protocol makes every exchange leave an originator-signed record that anyone can verify happened and is unchanged. For the wider landscape mapping, see standards and interoperability; for how anchoring and verification work underneath, see anchoring and the audit log.