Battery passport systems now have a certification mark. It is voluntary, and it does not take over your liability

On 7 October 2026 TÜV SÜD announced a certification mark for the Digital Battery Passport. It is a voluntary, private mark. No EU law requires a battery passport system to be certified, and a certificate does not move the obligation: under Article 77(4) of Regulation (EU) 2023/1542 the economic operator placing the battery on the market ensures that the information in the passport is accurate, complete and up to date. The law that does foresee certification of passport service providers is a different one, the ESPR, and the delegated act that could create such a scheme has not even been published as a draft. Here is what the new mark can tell you, what it cannot, and what to ask any provider, certified or not.

What TÜV SÜD announced

The press release, issued in Munich on 7 October 2026, introduces a certification mark for the Digital Battery Passport. According to the release, the assessment covers four areas:

• the requirements of the battery regulation, Regulation (EU) 2023/1542;
• technical requirements of the ESPR, Regulation (EU) 2024/1781;
• cybersecurity, data integrity and trust requirements;
• interoperability in line with harmonised DPP standards.

It is addressed to manufacturers, other market participants and authorities. TÜV SÜD's argument, in the words of its energy business line, is that the battery passport is a regulated system relevant to safety, not only an IT product. Industry coverage summed it up as an assurance gap: a software vendor cannot prove its own compliance, while the manufacturer carries the legal liability.

What the release does not say, at least in the text we could read, is against which version of which criteria the assessment runs, whether the mark covers a software platform or one manufacturer's implementation, and how long it remains valid. TÜV SÜD's own service pages did not open for us. If a provider shows you this mark, ask for the scope document behind it.

Who is responsible under the battery regulation

Article 77(4) is two sentences long. The economic operator placing the battery on the market shall ensure that the information in the battery passport is accurate, complete and up to date. It may give written authorisation to any other operator to act on its behalf.

So you can hand the work to someone else, with a written authorisation. The duty stays where the regulation put it. Article 78 then sets the essential requirements for whoever runs the passport:

• Storage, Article 78(c): by the responsible economic operator or by operators authorised to act on its behalf.
• No reuse of your data, Article 78(d): those operators may not sell, re-use or process the data beyond what the storing or processing service needs.
• Survival, Article 78(e): the passport remains available after the responsible operator ceases to exist or ceases its activity in the Union.
• Access control, Article 78(f): rights to access, introduce, modify or update information follow Annex XIII and the implementing act under Article 77(9), which the Commission has still not adopted.
• Authentication, reliability and integrity, Article 78(g), and security, privacy and fraud prevention, Article 78(h).

Two things are missing from the battery regulation. It has no role called a passport service provider: the phrase does not appear in the text, and the Commission's DPP helpdesk confirmed to us in August 2026 that the battery regulation does not have DPP service providers as an actor. And it has no certification of anyone who runs a passport for you. A mark like TÜV SÜD's is a way to show that a system meets requirements such as Article 78(g) and (h). It is not a legal status.

Where certification does appear in law: the ESPR

The ecodesign regulation, which will govern passports for textiles, steel, furniture and the other product groups, does name the role. Article 2(32) defines a digital product passport service provider as an independent third party authorised by the economic operator that places the product on the market. Article 10(4) requires that operator to make a back-up copy of the passport available through such a provider.

The last subparagraph of Article 11 empowers the Commission to adopt delegated acts setting out the requirements that service providers must meet to become such providers, and, where appropriate, a certification scheme to verify compliance with those requirements, as well as the requirements they must meet while providing the service. Recital 40 adds that the Commission could carry out an impact assessment on whether a certification scheme for service providers is appropriate at all.

That delegated act is initiative 14382 in the Commission's register. The call for evidence drew 178 responses and the public consultation 275. On 8 October 2026 the draft was still marked as upcoming. The register gives the fourth quarter of 2026 as the planned period for adoption; the Commission's helpdesk told us in August to expect it around the second quarter of 2027. Either way, today there are no legal criteria for becoming a service provider and no official certification scheme.

The registry regulation, (EU) 2026/1778, already has a place for them. Article 3(f) lists, among the components of the registry, a list of verified digital product passport service providers registered in the registry. The verification it describes is about identity, confirmed with a qualified electronic seal, and the regulation is explicit that checking whether the registered data is substantively correct remains a task for market surveillance authorities.

What "harmonised standards" means right now

The release mentions harmonised DPP standards, so it is worth being precise about which ones exist.

• Under the ESPR, Implementing Decision (EU) 2026/1736 of 15 July 2026 cited six standards: EN 18216, EN 18219, EN 18220, EN 18221, EN 18222 and EN 18223.
• EN 18239 on access rights, security and business confidentiality and EN 18246 on data authentication, reliability and integrity were published by CEN on 16 September 2026, but on 8 October 2026 neither was cited in the Official Journal. These are exactly the topics of Article 78(f) to (h).
• Under the battery regulation, Article 15(3) says that harmonised standards can give a presumption of conformity with Article 78, the technical design of the passport. The only reference published so far under that regulation is EN 18060:2025, cited on 16 September 2026, and it covers the performance and durability of electric vehicle batteries, not the passport.

So no harmonised standard today gives a battery passport system a presumption of conformity with Article 78. A third-party check of security and integrity is a check against criteria the certifier has chosen. That can be valuable. It is not the same as a presumption of conformity, which only a cited harmonised standard, or common specifications adopted by the Commission under Article 16, can give.

What a mark can and cannot do for you

It can:

• give you independent evidence that someone qualified looked at the security, integrity and interoperability of a system at a point in time;
• shorten your own due diligence on a provider, and give you something to show a customer or an auditor who asks how you chose it.

It cannot:

• move the obligation in Article 77(4) away from you;
• prove that your data is correct, because the data comes from you, and checking it is the job of market surveillance authorities;
• create a presumption of conformity, which only cited standards or common specifications do;
• fill in rules that do not exist yet, such as who counts as a person with a legitimate interest under Article 77(9);
• guarantee that the version of the system you use today is the version that was assessed.

What to ask any provider, certified or not

• The authorisation. Is there a written authorisation under Article 77(4), and what exactly does it cover?
• Export. Can you take every passport out, in a machine-readable and open format, without the provider's help? Article 77(5) asks for data transferable without vendor lock-in.
• The address in the QR code. Whose domain is it, and what happens to the code printed on your batteries if you change provider?
• Survival. What keeps your passports online if the provider closes, and what if your own company does? Article 78(e) requires the passport to outlive the responsible operator.
• Your data. Does the contract repeat the limit from Article 78(d): no selling, re-using or processing beyond the service?
• Access layers. How are the public part, the part for authorities and notified bodies, and the part for persons with a legitimate interest separated today, while the Article 77(9) act is missing?
• Integrity. How are changes recorded, and can you show an inspector what the passport said on a given date?
• If they are certified: what exactly was assessed, against which criteria, by whom, when, for which version, and until when is it valid? Ask for the report or the scope, not only the logo.

If you want to go deeper into the standards themselves, we published fourteen questions that test a provider against the DPP standards.

For transparency: DPPera is a passport provider too. We do not hold TÜV SÜD's mark or any other certification of our system, and no law requires us or anyone else to have one. The questions above are the ones we expect to be asked.

What this is not

This is not a legal requirement. Neither the battery regulation nor the ESPR requires a certified passport system today.

This is not the certification scheme from the ESPR. That scheme may or may not come with the delegated act on service providers, and its criteria are not known.

This is not a criticism of TÜV SÜD. Independent testing of systems that hold regulated data is useful, and a mark with a published scope is better than a vendor's own promise. It just does not change who is responsible.

FAQ

Łukasz Głuch

Builds DPPera, a digital product passport tool for small and medium-sized companies. Reads the delegated acts so you do not have to. Writes about what he checked in the registry, not about what vendors promise.

LinkedIn