Two months late, the battery passport access rules have a draft. It says who may look, not how they prove it

On 19 October 2026 the Commission published the draft of the implementing act that Article 77(9) of the battery regulation required by 18 August 2026: who counts as a person with a legitimate interest in the restricted parts of a battery passport, and what that person may do with the data. It is five pages long, has three articles and is open for public feedback until 16 November 2026. We wrote about this act three times while it was missing: twelve days before the deadline, on the day it passed and when its feedback counter stood at zero. This is what the draft actually says.

What the regulation had already fixed

Article 77(2) sets three audiences. Annex XIII point 1 is public. Points 2 and 3 are for notified bodies, market surveillance authorities and the Commission. Points 2 and 4 are for any natural or legal person with a legitimate interest, and only for two purposes: dismantling, safety and composition, so that repairers, remanufacturers, second-life operators and recyclers can do their work; and, for an individual battery, the needs of the purchaser or of parties acting on the purchaser's behalf, so that the battery can be offered to independent energy aggregators or energy market participants.

Point 2 describes the battery model: (a) detailed composition, including the materials of the cathode, anode and electrolyte; (b) part numbers and contact details of sources for spare parts; (c) dismantling information, such as exploded diagrams, disassembly sequences, fastenings and tools; (d) safety measures. Point 4 describes the individual battery: performance and durability values at placing on the market and at each change of status, state of health, the status itself (original, repurposed, re-used, remanufactured, waste), and data from use such as cycles, negative events, temperatures and state of charge. In the Commission's guidance table the model part sits in fields 45 to 50, together with the test reports of point 3, and the individual part in fields 51 to 71. We counted them row by row in October.

What the regulation left open is who exactly has the legitimate interest. That is the job of the Article 77(9) act.

Who gets what under the draft

Article 1 of the draft splits point 2 into its letters and gives each letter its own list of persons. Article 2 says what those persons may do with the data.

Two groups are new compared with the regulation. Vocational training centres appear because, in the words of recital 1, they are key second-life operators alongside repurposers. Treatment facilities for end-of-life vehicles and electrical waste appear only for safety measures, because a battery usually reaches them inside a car or an appliance. One group is absent on purpose: the producer, the producer responsibility organisation or the waste management operator that takes over responsibility for a waste battery's passport under Article 77(7). Recital 2 says they already have the full passport and need no listing.

Three decisions in five pages

The purchaser holds the key to the individual battery. Point 4, the part with state of health and usage history, goes to the purchaser and to whoever acts on the purchaser's behalf, and to no one else on the list. A repairer or a second-life company that wants a battery's state of health gets it through the owner, not in its own right. Recital 4 adds that on resale the purchaser may show the data to prospective buyers, and that the purchaser also needs part numbers and spare part sources, including for simple in-house repair. Composition and dismantling data, on the other hand, are not given to purchasers. That was the contested point: a working document the Commission shared with stakeholders in May 2026 had an option giving purchasers composition and dismantling data, and EUROBAT, the association of automotive and industrial battery makers, wrote on 27 May that proof of purchase alone is not a sufficient basis for access to confidential information. The draft follows that line for point 2 and cannot follow it for point 4, because the regulation itself ties individual battery data to the purchaser.

Safety measures become public in practice. Article 2(5) lets everyone with access to point 2(d) use, download, share, publish and re-use it without restriction. Recital 3 gives the reason: information on safety measures is not commercially sensitive and many operators need it. Annex XIII still lists it among restricted data, but once any recycler may publish it, keeping it behind a login protects nothing.

Access comes with a purpose and an expiry date. Under Article 2(1), data from points 2(a) to 2(c) and 4 may be used only to evaluate the status, residual value and further usability of the battery, or for repair, preparation for re-use or repurposing, repurposing, remanufacturing or recycling, or to choose between those operations. The purchaser may also use point 4 to make the battery available to independent aggregators or market participants (Article 2(2)). Downloading is allowed, but the data may be kept no longer than necessary (Article 2(3)). Sharing and publishing are prohibited except in the cases listed in the table (Article 2(4)), and the operator who placed the battery on the market can authorise more (Article 2(4)(e)).

What the draft does not decide

• How anyone proves who they are. The draft names roles. It says nothing about how a repairer shows it is a repairer, how a purchaser shows it bought the battery, or who checks either claim. Article 78(f) requires access rights to follow Annex XIII and this act, so the act now defines the roles and leaves the gate to whoever runs the passport. EN 18239, the standard on access rights management, was published by CEN on 16 September 2026 and has not been cited in the Official Journal, so following it gives no presumption of conformity.
• Who the purchaser is after the first sale. Neither the regulation nor the draft defines "purchaser". A battery in a used car, a leased forklift or a fleet changes hands; the draft lets the purchaser show the data to prospective buyers, but says nothing about how access passes to the next owner.
• When it starts to apply. Article 3 sets entry into force on the twentieth day after publication, with no transitional period and no separate date of application. The register still plans adoption for the fourth quarter of 2026. The passport date does not depend on it: 18 February 2027 comes from Article 77(1).
• Anything about content. Annex XIII is unchanged. The draft decides who opens which drawer, not what is inside.

What it means for a passport system

Most passport tools have one restricted layer for persons with a legitimate interest and one for authorities. The draft makes that too coarse. Inside the restricted part it creates four audiences:

• composition and dismantling (2(a) and 2(c)) for the repair, second-life and recycling trade, without the purchaser;
• part numbers and spare part sources (2(b)) for repairers, remanufacturers and repurposers, plus the purchaser;
• safety measures (2(d)) for a wider circle, with no restriction on publication;
• the individual battery (point 4) for the purchaser and its agents only.

If your system stores each field with its Annex point and letter, mapping it to these audiences is configuration. If it stores a single "restricted" flag, it is a rebuild. The purpose limitation adds a second requirement: a read log that records not only who looked, but for which declared purpose, because Article 2(1) makes the purpose a condition of access.

For full disclosure: in DPPera today the restricted battery fields sit in two layers, one for authorities and one for repair and recycling, and until roles exist any signed-in user can read them, with every read logged. The draft shows how that second layer will have to split.

What to raise before 16 November

Feedback goes through the Have Your Say page of initiative 16473; we explained how to file a response in September. By the morning of 23 October there were ten responses, about half of them from companies building passport or battery data software, and the theme that came up most was the one above: how roles are verified. Points worth making if you build or buy battery passports:

• a reference, even an indicative one, to how roles are verified, or an explicit statement that the economic operator chooses the method and documents it;
• a definition of the purchaser, and a rule for passing point 4 access to the next owner;
• a clear statement that the operator may put the safety measures of point 2(d) into the public part of the passport directly, instead of relying on others to publish them;
• a few months between publication and application, so that access systems built on Annex XIII alone can be adjusted.

What this is not

It is not adopted. It is a draft of the Commission services, stamped as not representing the Commission's position, and recital 6 shows it will go through the committee set up under Article 39 of the Waste Framework Directive before adoption. The lists can change.

It is not a delay. Nothing in it moves 18 February 2027.

It is not about portable batteries. Only LMT batteries, EV batteries and industrial batteries above 2 kWh have a passport.

How to check this yourself

The regulation is free at https://eur-lex.europa.eu/eli/reg/2023/1542/oj/eng; the provisions cited are Article 77(2), (7) and (9), Article 78(f) and Annex XIII points 2 to 4. The register entry with the draft, reference Ares(2026)9814179 of 19 October 2026, the feedback window and the count is at https://ec.europa.eu/info/law/better-regulation/brpapi/groupInitiatives/16473?language=EN. EUROBAT's comments of 27 May 2026 on the working document are published on eurobat.org. Everything above is the state on 23 October 2026.

What to do this week

• Tag every restricted field with its Annex point and letter: 2(a), 2(b), 2(c), 2(d), 3 or 4. That tag is what the act keys on.
• Decide who answers "I am the purchaser" for your batteries: the dealer network, the fleet customer, the leasing company. The draft leaves that to you in practice.
• Write the safety measures as a text you would be comfortable publishing, because under the draft anyone who receives it may.
• Ask your passport provider whether its access model can open point 4 to one named customer without opening it to every repairer.

FAQ

Łukasz Głuch

Builds DPPera, a digital product passport tool for small and medium-sized companies. Reads the delegated acts so you do not have to. Writes about what he checked in the registry, not about what vendors promise.

LinkedIn