Battery
Access Roles and Tiers in the Battery Passport
Battery passport access tiers under Annex XIII: public, legitimate interest and authority, role verification, audit logging and the expected implementing act
The battery passport is not a single page but three views of the same data. Article 77 and Annex XIII of the EU Battery Regulation (EU) 2023/1542 assign every attribute to an access group: those open to everyone, those open to persons with a legitimate interest and the Commission, and those open only to authorities and notified bodies. Which field sits in which tier is covered in Annex XIII data fields; here we deal with how the tiers are implemented.
The general DPP access model is explained in DPP access rights: who sees what. For batteries, dynamic data and "legitimate interest" appear explicitly in the regulation's text.
Three tiers, example fields
| Tier | Who has access | Example fields |
|---|---|---|
| Public | Anyone scanning the QR; no login, no fee | Manufacturer and plant, model and chemistry, weight and capacity, carbon footprint and class, recycled content shares, end-of-life information |
| Legitimate interest and the Commission | Repairers, remanufacturers, second-life operators, recyclers; the definitive list comes with the act | Detailed composition, dismantling instructions and safety measures, spare-part information, SoH and usage data |
| Authorities and notified bodies | Market surveillance, customs, notified bodies, the Commission | Test reports, conformity file, verification records |
There is also a write side: the economic operator that creates and updates the passport, and the service provider acting on its behalf. Write permission and read tier must be designed separately; a repairer reads the dismantling instructions but cannot change the manufacturer's data. The public tier is free and login-free under the EN 18220 principles; restricted tiers open only to verified roles.
What the implementing act will settle
Article 77 tasks the Commission with adopting implementing acts that define the persons with a legitimate interest, their access rights (view, download, reuse) and the functions the passport must offer. The legal deadline was 18 August 2026; as of September 2026 the act has not been published and is expected in the last quarter of the year.
Waiting for the act does not mean postponing the design: define the roles the regulation already names (repairer, remanufacturer, second-life operator, recycler); extending the list later is easier than starting from scratch. The same model as the cross-sector EN 18239 restricted data tiers can be used.
How a role is verified
You prove that a recycler really is a recycler in one of three ways:
- Registration and approval: application through the platform, document upload, manual approval. Works at small volume, does not scale.
- Sector credentials: relying on an existing document such as an EU waste treatment permit, an OEM authorised service contract or a professional register. The document's validity date sets the access period.
- Verifiable credential: the role attestation presented as a VC; the most scalable route, matching the roles the act will define. See verifiable credentials and the DPP.
Whichever route you choose, access must be time-limited and revocable: a token for a specific battery or fleet and period, not a permanent entitlement. Role verification and access grant are separate records: the role is proven once, the grant is issued per battery or fleet.
Dynamic data and privacy
SoH and usage data in the legitimate interest tier can link the battery to a vehicle and therefore to a driver; that is where the GDPR comes in. Design rules: write no personal data into the passport, carry no location, use aggregated metrics. For detail see battery state of health and dynamic data and GDPR and DPP data.
When a battery is repurposed the access map changes too: the repurposer is responsible for the new passport, and the old one stays accessible. See second-life batteries and passport continuity.
Audit trail and versioning
Every access to a restricted tier is logged: who, when, which battery, which field group, on what grounds. Data changes are never overwritten; the passport is versioned append-only and every version is stored as a signed snapshot. That is what lets you answer an authority's "what did you publish in 2027" with evidence. For the mechanism see audit trails and versioning; for the authentication and access-control requirements of Article 78 see battery passport technical design.
The audit trail itself contains personal data (a recycler employee's identity, for instance); tie its retention and access to a policy. The overall timetable and preparation steps are in the battery passport guide.
Frequently asked questions
Who is a person with a legitimate interest in the battery passport?
The regulation points to roles such as repairers, remanufacturers, second-life operators and recyclers; the definitive list and the access rights will be settled by the implementing act expected in the last quarter of 2026.
Can a login be required for the public tier of the battery passport?
No. The public tier must be free, login-free and app-free; that follows from both the regulation and the access principles of EN 18220.
How do I verify a recycler's identity?
Through registration and approval, a sector document such as a waste treatment permit, or a verifiable credential. Grant access for a limited period and write every access to the audit trail.
