EESSI vs EUDAMED vs PEPPOL: Untangling Europe's Three AS4 Mandates

For many years, digital communication across the European Union was highly fragmented because public offices and private companies used different local networks, paper forms, and fragile custom integrations. To help these different systems connect smoothly, the European Commission launched the Connecting Europe Facility (CEF) eDelivery project. The technical core of this project is the Applicability Statement 4 (AS4) messaging protocol, which started as a specialized tool but has now become the standard way to securely send business and government data across Europe.

Technically, AS4 is an open standard built on top of proven web service protocols like Web Services Security and SOAP messaging. While standard transport security only encrypts data while it travels through a network tunnel, AS4 applies security rules directly to the message itself. This message-level security ensures that your data stays encrypted and digitally signed even if it is stored temporarily on middle-man servers or routed through shared hubs. Additionally, AS4 can carry any type of file, compresses data to save space before encrypting it, and uses signed delivery receipts to create a clear, legally binding audit trail.

Even though the basic technology of AS4 is always the same, European countries use it under three very different regulatory frameworks. These frameworks are EESSI for social security coordination, EUDAMED for medical devices, and PEPPOL for public procurement. Each of these networks uses the AS4 protocol in its own specialized way to handle different kinds of everyday business workflows.

Read more: Is AS4 Mandatory? Understanding Global Compliance Requirements

EESSI: Decoupled Multi-Hop Messaging for Social Security Coordination

The Electronic Exchange of Social Security Information (EESSI) is a digital network set up under EU law to coordinate social security benefits across 32 European countries. This system connects around 3,400 national institutions and replaces old paper forms with fast, automated files. It helps these offices coordinate eight different areas of social security, such as pensions, sickness benefits, family support, and unemployment claims.

Unlike most networks, EESSI runs on TESTA, which is a highly secure private network completely separated from the public internet. It is also unique because it uses a “multi-hop” setup instead of sending files directly from sender to receiver. When an institution sends a message, it goes to their national Access Point and travels through several secure intermediate nodes before reaching the final office. To make sure messages end up in the right place, a central hub managed by the European Commission coordinates the network routing directories.

Every EESSI transaction follows a strict workflow called a Business Use Case (BUC), which tells clerks exactly which standardized XML forms to use. These electronic forms are known as Structured Electronic Documents (SEDs). Clerks log into EESSI using a European program called RINA or through their own national portal applications connected to their local Access Point. For example, Belgium routes all of its social security exchanges through a single national gateway called the Crossroads Bank for Social Security. Many countries use specialized middleware to connect their older internal databases directly to this complex network.

On the technical side, offices often use an open-source application called EESSI AS4.NET to handle their messaging connections. This software uses standard libraries to secure the data, encrypt messages, and save transactional logs locally. Before a country can connect to the live network, developers must test their setups with the central Conformance Testing Tool (CT Tool). This testing tool simulates the entire EESSI network so teams can safely find and fix bugs on their own servers.

EUDAMED: Bilateral Machine-to-Machine Integration for Medical Devices

European Database on Medical Devices (EUDAMED) is the official database set up under EU medical device regulations to improve the safety and tracking of all medical equipment in Europe. It is managed by the EU health department, which requires high-volume manufacturers, importers, and official auditors to use a secure, automated data channel. This automated channel is a machine-to-machine (M2M) link built entirely on the AS4 messaging standard.

While other networks use complex routing, EUDAMED uses a simple, direct link between two endpoints. A medical company must run a certified AS4 Access Point on their own servers or in the cloud to connect directly with EUDAMED over the internet. This direct link is much faster and more reliable than uploading files manually through a web browser. Manual uploads are limited to 300 devices per file and require human work, whereas the automated AS4 link has no size limits and sends data straight from a company’s internal software.

To set up this connection, companies must first register in EUDAMED’s database to get a unique Single Registration Number (SRN) from their national government. If a manufacturer is located outside the EU, they must appoint an authorized European representative to double-check their details before they can get their SRN. Once registered, the technical teams exchange security certificates with the EU support staff so they can test their connection in a sandbox environment before going live.

The receiving side of EUDAMED runs on an open-source software gateway called Domibus, which was built by the European Commission. Domibus was recently updated to run on the latest versions of Java and Jakarta EE to ensure better performance and modern security standards. Because of these major changes, older plugins are no longer compatible and must be updated by technical teams. The newest version of Domibus supports advanced features like secure cloud storage and real-time security certificate checks.

Read more: AS4 healthcare deployment best practices

PEPPOL: Dynamic Discovery and the Four-Corner Model in Public Procurement

Pan-European Public Procurement On-Line (PEPPOL) is a global electronic business network managed by a non-profit group called OpenPeppol. It standardizes how companies and governments trade everyday documents like digital invoices, purchase orders, and shipping notices. To keep things simple, PEPPOL uses a smart “four-corner model” that keeps buyers and sellers technically independent from each other.

In this model, the seller (Corner 1) and the buyer (Corner 4) never have to connect their systems directly or worry about matching document formats. Instead, the seller sends an invoice to their own certified Access Point (Corner 2). This Access Point validates the file, wraps it in a standardized electronic envelope, and sends it securely via AS4 to the buyer’s Access Point (Corner 3). The buyer’s Access Point then decodes the message and delivers it directly to the buyer’s internal software. The electronic envelope is very important because it holds routing information on the outside so that the network can deliver the message without opening or reading the private business contents inside.

PEPPOL uses a dynamic lookup system to find exactly where to route every document:

• Service Metadata Locator (SML): A central internet directory that acts like a main switchboard to point senders in the right direction.
• Service Metadata Publisher (SMP): Decentralized registries that act like local address books for each company on the network.

When your Access Point wants to send an invoice, it takes the buyer’s unique participant number and asks the central SML for directions. The SML automatically redirects the query to the specific SMP that handles that buyer’s data. That SMP then replies with the buyer’s exact web address, the types of documents they can receive, and the digital certificate needed to encrypt the file.

A major infrastructure change happened in 2026 when OpenPeppol moved its central SML directory to its own servers. This migration moved the lookup directories away from the European Commission’s hosting to a private OpenPeppol network. Because of this move, all certified service providers had to update their technical lookup configurations and management software to use the new web addresses.

To make sure all files are easy to read, PEPPOL invoices must follow a standard European layout called PEPPOL BIS Billing 3.0. The network officially transitioned from the older AS2 transport method to the much more secure AS4 standard between 2016 and 2020. Today, most providers use proven open-source or commercial AS4 engines like Domibus, Holodeck, phase4, or Oxalis to handle these daily transfers.

Read more: AS4 vs AS2

Architectural and Milestone Comparisons

The differences in the structural design, network access, and transport mechanisms across these three mandates are structured in the tables below.

Table 1: Technical and Architectural Configuration of Europe’s AS4 Mandates

Table 2: Key Compliance Timelines and Migration Milestones

Enterprise Integration and Implementation Strategy

For large companies working across different regulated sectors, dealing with these three overlapping mandates can be a major challenge. Running separate, isolated gateways for EESSI, EUDAMED, and PEPPOL creates a lot of unnecessary maintenance work and increases your security risks. Instead of building these technical silos, smart organizations are moving toward unified, multi-profile AS4 gateways. These modern gateways can handle PEPPOL, EUDAMED, and EESSI standards on a single, shared system to save time and reduce costs.

Using a single gateway makes it much easier to manage your technical infrastructure:

• Automated Certificate Management: Because AS4 uses digital security certificates to encrypt files, an expired certificate will immediately block your data flows. Automated tools can track these expiration dates, send alerts, and swap out old certificates without shutting down your systems.
• Secure Key Storage: Strict industry rules require keeping your private security keys in secure physical storage systems or protected Windows certificate stores. This high level of protection prevents unauthorized people from accessing sensitive financial or medical data.
• Durable Message Queues: If a recipient’s database goes offline unexpectedly, your gateway needs to keep trying to send the message without losing the data. Standardized systems can save these files in durable queues, retry delivery automatically, and log the exact error codes for troubleshooting.
• Scalable Cloud and Serverless Setups: Many modern AS4 gateways are built using cloud containers like Docker and Kubernetes, alongside serverless architectures. This setup lets you automatically scale your systems to handle huge spikes in volume, such as during end-of-month invoicing or massive product registrations, without paying for idle server power when traffic is low.

Conclusions

Europe’s move toward standardized digital communication shows that while AS4 is a highly versatile protocol, each network uses it in a very different way. EESSI shows how a secure multi-hop network can help government offices collaborate across international borders. EUDAMED acts as a rigid, direct database gateway for medical companies to submit mandatory product details to the EU Commission. Meanwhile, PEPPOL provides a dynamic commercial network where you can connect once and trade with any partner in the world using automated lookups.

For business and IT leaders, staying compliant is not just about establishing a basic connection. Instead, you need to focus on long-term scalability, regular maintenance, and proper document validation. Investing in a modern, multi-profile AS4 gateway helps your company avoid complex integrations, secure sensitive customer data, and stay resilient as European standards continue to evolve.

Contact us to learn how the Aayu MFT Gateway can unify your EESSI, EUDAMED, and PEPPOL AS4 connections on a single platform.