The standards
prEN 18246, the draft standard on data authentication
The Official Journal does not cite the draft, so it gives no presumption of conformity. The battery duty on data authentication arrives first.
prEN 18246 is a draft European standard on data authentication for a digital product passport. The formal vote closed on 16 July 2026, but the standard is still under approval, so it gives no presumption of conformity.
Ignore that status and you can buy an authentication product on a claim that no cited standard supports. A draft can also change, so the design you pay for can change with it.
The status: the vote closed, and the standard is still under approval
CEN and CENELEC are the European standards bodies. Their joint technical committee, CEN/CLC/JTC 24, wrote the passport standards under Standardisation Request M/604.
The committee produced eight European standards. Six are published and cited. prEN 18246 is one of the other two.
| Item | Status |
|---|---|
| The formal vote on prEN 18246 | Closed on 16 July 2026 |
| The document | Draft, under approval as at 14 August 2026 |
| Publication | None |
| Citation in the Official Journal | None |
| Presumption of conformity | None |
Monitor the designation on any document a supplier sends you. The six published standards carry the letters EN. The two drafts carry the letters prEN.
The other draft is prEN 18239, on access rights. The six published standards are on the six standards page.
Data authentication shows if the data came from the operator
Authentication answers one question about a passport. The question is if the data on screen is the data that the economic operator put there.
Two claims sit inside that answer. The first claim names the source of the data. The second claim shows that nobody changed the data afterwards.
Take an e-bike battery. A recycler in Germany opens its passport and reads the cathode composition. The recycler must decide if they can trust that figure. Authentication gives the recycler a way to test the data, without a telephone call to New Zealand.
Authentication is not access control. Access control decides who may read a field, and prEN 18239 covers that subject.
Article 78(g) of the battery law requires data authentication
The battery regulation is Regulation (EU) 2023/1542, and it is in force.
Article 78 sets the technical requirements for the battery passport alone. Its point (g) requires data authentication, reliability and integrity.
Article 77(4) of the same regulation sets a separate duty:
The economic operator placing the battery on the market shall ensure that the information in the battery passport is accurate, complete and up to date.
The two duties are not the same. Article 78(g) is about authentication. Article 77(4) is about accuracy, and it names who answers for it.
Article 77(1) sets the start date. The battery passport applies from 18 February 2027. The article names three categories of battery, and no others.
| Battery category | Which ones |
|---|---|
| LMT battery, for light means of transport such as an e-bike | Every one. There is no size threshold. |
| Industrial battery | Only a capacity greater than 2 kilowatt hours |
| Electric vehicle battery | Every one |
A portable battery is not in that list. The page on batteries covers the categories in full.
The gap: the legal duty arrives before the standard
Article 78(g) binds the battery passport. The date is 18 February 2027. The standard written on data authentication is still a draft.
A cited standard gives a product built to it a presumption of conformity, which is the easy route. prEN 18246 is not cited, so it gives nobody that route today.
None of the six published standards carries data authentication in its title. This site has not read the six texts, because they are paywalled. So this site does not state what the six cover. The economic operator must meet Article 78(g) and hold its own evidence.
One further limit is worth reading before you plan any work. The Decision that cited the six standards gives a presumption of conformity, and that presumption has a fixed reach.
Warning: this site has not confirmed that a future citation of prEN 18246 would reach Article 78(g) of the battery regulation. The two regulations are separate instruments. Do not assume that a standard cited under one law settles a duty written in the other.
| Item | Detail |
|---|---|
| The Decision | Commission Implementing Decision (EU) 2026/1736 |
| The presumption of conformity | Article 41(2) of the ecodesign regulation |
| The requirements it covers | Articles 10 and 11 of the ecodesign regulation |
| The ecodesign regulation | Regulation (EU) 2024/1781, the Ecodesign for Sustainable Products Regulation |
The Decision text sits in the Official Journal. See the Decision for what it does and does not do.
Commentary reports that the draft covers data authentication, and this site has not read it
Commentary describes prEN 18246 as a standard on data authentication and integrity. The same commentary names candidate mechanisms:
- verifiable credentials
- an ISO 22376 seal
- ISO/IEC 20248
- a full audit log
Warning: nobody here has read the draft, and its text is not public. Treat that list as reported, not as confirmed. A draft can change before publication.
The published standards are paywalled at 190 to 370 euros each on the distributor listings, and this site has not bought them. See why the texts are paywalled. The page on verifiable credentials covers the technology on its own terms.
What to ask a supplier who sells standards-based authentication
Warning: do not accept the phrase "standards-based authentication" on its own. The Official Journal cites six passport standards. None of them carries data authentication in its title. The draft on the subject is not cited.
Ask four questions, and write down the answers.
- Ask which document the supplier means. Ask for the number.
- Ask if that document is published, or is still a draft.
- Ask if the Official Journal cites it.
- Ask which article of which regulation the scheme meets.
If a supplier names prEN 18246, the document is a draft. The Official Journal does not cite it. That does not make the product useless, but it does mean the product meets no cited standard.
Your work is a contract with your EU importer, not a cryptography purchase
A New Zealand manufacturer with no establishment in the EU does not place a battery on the EU market. The EU importer does that. So the importer carries the Article 77(4) duty. See who is the economic operator.
Warning: do not buy a signing product this year because of prEN 18246. Buy a signing product only if your EU importer needs the evidence for 18 February 2027.
You still supply the data behind the passport. So the practical work is a contract, not a cryptography purchase.
- Name the person in your company who approves each data field.
- Record the date and the source of each figure you send.
- Keep every version of the data you send, and do not overwrite it.
- Agree with your EU importer who answers a challenge to a figure.
Steps one to four cost time. They do not cost a licence fee. They keep their value whatever prEN 18246 says. See agreeing data duties with your EU importer and who is liable for data accuracy.