Access tiers in the battery passport: public, legitimate interest, authorities

The battery passport has three access tiers. The information in Annex XIII, point 1, is public. Persons with a legitimate interest also see points 2 and 4; notified bodies, market surveillance authorities and the Commission see points 2 and 3 (Art. 77(2)). Exactly who has a legitimate interest, and what they may do with the data, is for an implementing act under Article 77(9). Its deadline passed on 18 August 2026. On 19 October 2026 the Commission published a draft for feedback.

This article puts the draft in context: whom it entitles, what it allows and forbids, what it leaves open and what manufacturers and importers can do now. The tiers themselves, with everything they contain, are explained on our access tiers page; the basics of the passport obligation are in the battery passport guide.

Which access tiers does the Battery Regulation set up?

Article 77(2) splits the passport's content into three groups:

• Public: Annex XIII, point 1, with label information, composition with chemistry and hazardous substances, the model's performance and durability values, the declaration of conformity and further model data.
• Persons with a legitimate interest get points 2 and 4: the model's detailed composition, part numbers and spare-part sources, dismantling information and safety measures, and the data on the individual battery such as performance values, state of health, status and usage data.
• Notified bodies, market surveillance authorities and the Commission get points 2 and 3, adding the results of test reports.

The Regulation names two purposes for a legitimate interest: dismantling, including safety measures, and the detailed composition, so that repairers, remanufacturers, second-life operators and recyclers can do their work; and, for individual batteries, enabling the purchaser, or parties acting on its behalf, to make the battery available to independent energy aggregators or energy market participants. It leaves open who exactly qualifies and to what extent information may be downloaded, shared, published and re-used. That is for the implementing act (Art. 77(9)). The glossary defines legitimate interest.

What has the Commission published?

It published a draft implementing regulation “as regards access to and use of certain information in the battery passport”. The draft has been on the Commission’s “Have your say” portal since 19 October 2026 (initiative 16473), with feedback open until 16 November 2026. The draft has three articles: Article 1 names the persons with a legitimate interest and assigns them parts of Annex XIII, Article 2 sets purposes, downloading and sharing, and Article 3 provides for entry into force on the twentieth day after publication in the Official Journal.

What happens next is set by the Regulation: implementing acts under Article 77(9) are adopted under the examination procedure (Art. 90(3)). The committee set up by Article 39 of the Waste Framework Directive gives its opinion; without an opinion, the Commission does not adopt the act. On its initiative page, the Commission plans adoption for the fourth quarter of 2026. That is a plan, not a date.

1. 18 August 2026

   Deadline: access rights for a legitimate interest

   delayed By this date the Commission was to specify who counts as a person with a legitimate interest and to what extent they may download, share, publish and re-use which parts of the passport. When we checked, a draft was open for feedback from 19 October to 16 November 2026; the act had not been adopted. (Art. 77(9))

2. 18 February 2027

   Battery passport and QR code

   applies Every LMT battery, every industrial battery above 2 kWh and every EV battery placed on the market or put into service needs a battery passport. All batteries bear a QR code; the removability and replaceability rules of Article 11 start on the same day. (Art. 77(1), Art. 13(6))

We track the status of this and the other pending acts on our implementation status page.

Who gets which information under the draft?

The draft no longer treats points 2 and 4 as one block. It splits them and names its own groups for each part. The recitals explain two additions to the list in Article 77(2): the draft counts repurposers and vocational training centres among the key second-life operators, and waste treatment operators and recyclers need parts of the passport even when responsibility for the battery does not lie with them.

Two groups are left out on purpose. Notified bodies, market surveillance and the Commission already have their access under Article 77(2), point (b). And whoever takes over responsibility for a waste battery (the producer, the producer responsibility organisation or the selected waste management operator, Art. 77(7)) needs no entry of its own, according to the recitals, because it sees and modifies the full passport anyway.

The purchaser stands out: it gets the individual data of its battery and the spare-part information, according to recital 4 also for simple in-house repair. It does not get the detailed composition or the dismantling information.

What may the data be used for, and who may it go to?

Article 2 ties access to purposes. The persons in Article 1(1), (2) and (4) may use the information in points 2(a) to (c) and 4 only to evaluate the status, residual value and capability for further use of the battery, or for repair, preparation for re-use or repurposing, repurposing, remanufacturing and recycling, and for choosing between them. The purchaser may also use the individual data to make the battery available to independent aggregators or market participants. Downloading is allowed; downloaded information may be kept “no longer than is necessary” for the purpose.

Sharing and publishing are forbidden in principle. The exceptions are narrow:

The recitals explain the reasoning: information in the restricted tier could be commercially sensitive, except for the safety measures. Health and safety justify the exceptions for emergency services and poison centres; enforcement justifies those for authorities.

How does the draft differ from the Regulation's text?

What does the draft leave open?

Above all, how a passport knows who is asking. The Commission says so itself: the act will determine who may access restricted data and what they may do with it, “but not the detailed authentication mechanism”. Because the passport system is implemented in a decentralised way, authentication “cannot readily be specified or operated centrally”; national registers of recyclers, waste operators and similar actors may help confirm their status (FAQ 6.4).

It follows that:

• The economic operator manages access. The EU digital product passport registry does not give access to the full passport; it primarily records registration and metadata. The passport is hosted by the economic operator or an operator with its written authorisation, which manages access (FAQ 6.5).
• An email domain decides nothing. According to the Commission, an organisational email domain is not required and will not be used to decide who may access information (FAQ 6.6).
• The purchaser is not defined further. The draft speaks of “the purchaser of the battery”. It does not say how a later buyer of a used battery proves the purchase.
• Logging is not required. The draft does not ask for a record of access. Article 78, however, requires data integrity, a high level of security and the avoidance of fraud.

Which information is commercially sensitive?

Article 77(9), point (c), gives the act a criterion: access to and processing of commercially sensitive information must be limited to the minimum necessary. The draft does this mainly through limits on use and sharing (recital 5). For manufacturers, three parts are the most delicate:

• The detailed composition with the cathode, anode and electrolyte materials (point 2(a)). It can reveal recipes and suppliers.
• Part numbers and spare-part sources (point 2(b)). They show sourcing routes and components.
• Usage data of the individual battery (point 4(d)). Cycles, events and temperatures say something about how the customer runs it.

The draft, by contrast, does not consider safety measures commercially sensitive (recital 3). They matter to many operators, down to treatment facilities for end-of-life vehicles and electrical waste, and may be shared freely under the draft. Write them so they need no trade secrets.

What should manufacturers do now?

The passport starts on 18 February 2027, whenever the act arrives. The information in points 2 and 4 must then be in the passport and protected. Six steps are worth taking now:

1. Keep restricted data separate. The tiers belong in the data and on the server, not only in the display. A public data sheet that contains the detailed composition undermines the tier.
2. Organise by letter. Keep composition, spare parts, dismantling and safety apart. The draft grants access per part, and safety measures are meant to be shareable freely.
3. Decide who grants access, and how. Who checks that a recycler or repairer is what it claims to be? With which evidence, such as a permit as a waste treatment operator? For which purpose, and for how long?
4. Log every access. Who read which version, when, under which grant? Without that trail you cannot show anything if misuse is suspected.
5. Plan for buyers of used batteries. Under the draft, access to the individual data goes to the purchaser of the battery. When the battery is resold, the purchaser changes. Think about how access passes on.
6. Treat BMS access separately. For stationary storage, LMT and EV batteries, anyone who has legally purchased the battery already has read-only access at any time to the Annex VII data in the battery management system under Article 14(2), for example to evaluate residual value. That is a right of its own alongside the passport, not part of the implementing act.

If the draft affects you, for example because your customers resell batteries or you offer remanufacturing, you can give feedback on the initiative page until 16 November 2026.

How does BatteryPass handle the access tiers today?

The server separates the tiers. Public pages, the public JSON and public exports contain only the public tier; restricted information never appears in a public response in testing. Every published passport version is a signed snapshot from which each tier's view is derived. Before publishing, you see the passport as each tier would see it.

Access for persons with a legitimate interest and for authorities is deliberately limited until the act exists:

• It sits behind a switch and cannot be reached without a grant.
• An owner or admin grants a tier to an email address, with a purpose and a term of at most one year; a grant can be revoked at any time.
• The reader signs in with exactly that verified address. They do not need to be a member of your organisation.
• Every read writes an entry to your audit log, with the reader, the tier, the passport version and the grant.
• Documents of the restricted tier are listed by title only; they cannot be downloaded through this access.

We name two limits openly. A grant covers a whole tier, while the draft distinguishes by the letters of Annex XIII. And checking whether someone really is a recycler or a purchaser remains your decision: BatteryPass verifies the address, not the status. We therefore do not describe the feature as implementing Article 77(9); whether a grant per tier is enough is something we will check against the final text. How we protect data and access is described on Security. How provenance and review of values fit together is shown in Provenance and four-eyes review.