Data, access and durability
Who can see what in a digital product passport
A passport is not one public page. The EU battery law sets three access tiers, and the general public reaches only one of them.
A digital product passport does not show every reader the same data. The European Union battery law sets three access tiers. The general public reaches only one of them.
This decides what you publish and what you keep restricted. If you publish too much, a competitor reads your detailed composition. If you keep too much restricted, you withhold data that a market surveillance authority may read.
Only the battery passport has access tiers written in law today
The battery regulation is in force. The passport duty starts later, and it covers three categories of battery only.
| Item | Detail |
|---|---|
| Instrument | Regulation (EU) 2023/1542, in force |
| Passport duty | Article 77 |
| Date the duty starts | 18 February 2027 |
The three categories are:
- each light means of transport (LMT) battery, such as an e-bike battery
- each industrial battery with a capacity greater than 2 kilowatt hours
- each electric vehicle battery
Other batteries do not get a passport. Every battery carries a QR code under Article 13(6). That code gives other information, and it is not a passport. See batteries for the scope, and the battery regulation for the instrument.
The Ecodesign for Sustainable Products Regulation (ESPR) entered into force on 18 July 2024. It requires a passport to give different actors different subsets of the data, free of charge. It names customers, repairers, refurbishers, remanufacturers, recyclers, market surveillance authorities and customs authorities.
That regulation sets no passport duty for a product group until a delegated act covers that group. As at August 2026 no delegated act is adopted for any group. So no ecodesign tier list exists yet, and the battery passport is the only access model you can read in law today.
The three tiers in Article 77(2)
Article 77(2) names three groups of readers. Annex XIII of the battery regulation holds the data, in four numbered points. See who reads a passport for what each reader wants.
| Tier | Who reads it | Annex XIII |
|---|---|---|
| (a) | The general public | Point 1 |
| (b) | Notified bodies, market surveillance authorities and the Commission | Points 2 and 3 |
| (c) | Any person with a legitimate interest | Points 2 and 4 |
That short phrase in the table leaves out a condition. Article 77(2)(c) reads:
(c) information accessible only to any natural or legal person with a legitimate interest in accessing and processing that information for the purposes referred to in points (a) and (b) of the third subparagraph in accordance with points 2 and 4 of Annex XIII.
So the interest is tied to a purpose. The third subparagraph of Article 77(2) names those purposes, and what is public in a passport, and what is not sets them out.
The tiers are not nested
The authorities and a person with a legitimate interest share point 2. Each one then reads a point that the other cannot read.
Article 77(2) does not give point 4 to the authorities. It does not give point 3 to a person with a legitimate interest.
Some summaries describe the battery passport as two parts, one public and one restricted. The regulation sets three tiers over four points.
Your battery chemistry is public, and your detailed composition is not
| Annex XIII | What it holds | Who reads it |
|---|---|---|
| Point 1 | The battery label information, the material composition, the carbon footprint information, the share of renewable content, the rated capacity, the voltages, the expected lifetime in cycles, the recycled shares of cobalt, lithium, nickel and lead, the EU declaration of conformity, the responsible sourcing information, and the waste prevention and management information | Everybody |
| Point 2 | The detailed composition, the part numbers for components, the contact details for sources of replacement spares, the dismantling information, and the safety measures | The authorities, and a person with a legitimate interest |
| Point 3 | One item only. The results of the test reports that prove the battery meets the regulation | Notified bodies, market surveillance authorities and the Commission |
| Point 4 | Item-level values for performance and durability, the state of health, the status of the battery, and the data from its use | A person with a legitimate interest |
Warning: the material composition in point 1 is public, and many summaries say the opposite. Point 1(b) reads:
(b) the material composition of the battery, including its chemistry, hazardous substances present in the battery, other than mercury, cadmium or lead, and critical raw materials present in the battery;
Point 2(a) restricts a narrower thing:
(a) detailed composition, including materials used in the cathode, anode and electrolyte;
Take an e-bike battery. A competitor scans the QR code on the pack and reads point 1. That competitor reads your battery chemistry, and lithium iron phosphate is an example of it. The competitor does not read which materials you use in the cathode, the anode and the electrolyte, because that sits in point 2.
The boundary falls between the chemistry and the detailed composition. A market surveillance authority reads the detailed composition, and so does a person with a legitimate interest.
This split protects part of your commercial data. Read what a passport holds for the data itself, and commercially sensitive data for the fields exporters worry about most.
The third tier is the one you cannot build yet
Warning: no adopted rule says who counts as a person with a legitimate interest. Article 77(9) of the battery regulation required the Commission to adopt implementing acts by 18 August 2026.
This site searched three sources on 15 August 2026. It searched the Official Journal, the Commission comitology register and the Commission planning register. It found no adopted act. It also found no draft act before the committee that must vote on one, and Article 90 requires that vote first.
Two limits sit on that search. The Official Journal database reached 13 August 2026 on that day, and the comitology register reached 14 August 2026. So the search says nothing about the three days that follow it.
Build the first two tiers now. Wait for that rule before you build the third. See what is public in a passport, and what is not for the search, the criteria in the law and the draft standard.
Free of charge does not mean public
Article 78 point (b) of the battery regulation requires free-of-charge access to a battery passport. It ties that right to two things, and one of them does not exist yet:
(b) consumers, economic operators and other relevant actors shall have access to the battery passport free of charge and based on their respective access rights set out in Annex XIII and the implementing act adopted pursuant to Article 77(9);
Read the last clause again. Part of the free access right points at an act that this site could not find on 15 August 2026.
Two limits apply at the same time. You cannot charge a reader who is entitled to the point 2 data. You also do not have to show that data to the public. Free access is in the law, and no text this site has read bans an app or a login. See what free access does and does not require.
Sensitive data does not have to be public
Many exporters see the word passport and expect to publish everything, which is the expensive mistake in this subject.
Each field needs one answer to one question: who may read that field. For a battery today there are three answers: everybody, the authorities, and a person with a legitimate interest. Some fields carry two of those answers at once.
Do that work on the data, not on the web page. A passport is a data set with access rules attached, and a page is one way to show part of it. See what a digital product passport is if that distinction is new.
The three tiers are a disclosure rule inside product law. They answer no question about personal data. See personal data in a passport.
Tag every field with the tier that may read it
Warning: do not publish point 2 data on your public product page to look transparent. You cannot take it back, and the law does not ask for it.
- Tag every field in your product data with the tier that may read it.
- Ask your EU importer who answers a request from a person with a legitimate interest.
- Write that answer into the supply agreement, with a named person on each side.
- Wait for the implementing act before you build the third tier of access control.
Steps 1 to 3 cost only time, and they keep their value whatever the implementing act says. See agreeing data duties for the contract work, and what this means for New Zealand exporters for the wider picture.