What is public in a passport, and what is not

In the European Union (EU) battery passport, one part of the data is public. That part is Annex XIII point 1 of the battery regulation. Every other part needs a check on the reader.

Two mistakes cost money here. The first is to publish the detailed composition of your e-bike battery, because the word passport sounds public. The second is to buy access control for a term that no confirmed rule defines.

Public means no check on the reader

A battery passport is a digital product passport. The battery regulation, Regulation (EU) 2023/1542, is in force. It is the first EU law that makes one mandatory. Its Article 77 covers three categories of battery. The duty starts on 18 February 2027.

Article 77(2) names three groups of readers. Annex XIII holds the data in four numbered points. Only group (a), the general public, reads point 1 with no check at all. Points 2, 3 and 4 all need a check on the reader first.

So public is a property of a data field. A passport with a public part is still a restricted data set, and your detailed composition sits in the restricted part. See who can see what for the point-by-point table, and batteries for the scope.

The Ecodesign for Sustainable Products Regulation (ESPR) sets no access rule for any product group today. That duty arrives only in a delegated act, and none is adopted. So the battery passport carries the only access rule this site can confirm in law.

The law names group (b), and leaves group (c) to a later rule

Warning: do not treat the three groups as three levels of trust. Group (b) and group (c) each read a point that the other cannot read. So store the named group that may read each field, and never store an access level as a number.

Article 77(2)(b) names three kinds of reader: a notified body, a market surveillance authority and the Commission. That list is closed, and you can ask which body a request comes from.

Article 77(2)(c) gives a term instead of a list: any person with a legitimate interest. Article 77(9) then makes the Commission define that term. So the third group holds a right in law, and no adopted rule tests who holds it.

The law already names the purposes, and only the persons are open

The short phrase "a person with a legitimate interest" is not the full test. Article 77(2)(c) reads:

(c) information accessible only to any natural or legal person with a legitimate interest in accessing and processing that information for the purposes referred to in points (a) and (b) of the third subparagraph in accordance with points 2 and 4 of Annex XIII.

The third subparagraph of Article 77(2) sets out those purposes:

(a) concern dismantling of the battery, including safety measures to be taken during the dismantling, and the detailed composition of the battery model and be essential to allow repairers, remanufacturers, second-life operators and recyclers to conduct their respective economic activities in accordance with this Regulation; or

>

(b) in the case of individual batteries, be essential to the purchaser of the battery or parties acting on the purchaser's behalf, for the purpose of making the individual battery available to independent energy aggregators or energy market participants.

So the law already names four kinds of company: a repairer, a remanufacturer, a second-life operator and a recycler. It also names the purchaser of a battery, and the parties who act for that purchaser.

This narrows the open question, because the purposes are written down. What no adopted act gives is the test that decides if a company meets one.

Article 77(9) also fixes the criteria the Commission must use

The second subparagraph of Article 77(9) sets three criteria, and the list is closed:

(a) the necessity of having such information in order to evaluate the status and residual value of the battery and its capability for further use;

>

(b) the necessity of having such information for the purpose of preparation for re-use, preparation for repurposing, repurposing, remanufacturing or recycling of the battery, or for choosing between those operations;

>

(c) the need to ensure that the accessing and processing of information in the battery passport that is commercially sensitive is limited to the minimum necessary in accordance with applicable Union law.

Criterion (c) covers your commercially sensitive data. The law tells the Commission to limit access to that data to the minimum necessary. See what a passport does not publish.

No adopted act says what a recycler may publish and re-use

Article 77(9) requires the implementing acts to specify what a person with a legitimate interest may download, share, publish and re-use. So the open question covers onward use as well as the right to read.

The law already limits one type of onward use. Article 78 point (d) bars an authorised third-party host from resale and re-use.

Article 78 point (b) gives free-of-charge access. That access follows the Annex XIII rights, and it follows the implementing act under Article 77(9) as well. So part of the free access right points at the act that this site did not find. See who can see what.

Who counts as a person with a legitimate interest is not defined yet

This site searched four sources, and no adopted act came back

Nobody publishes an absence, so this section gives the search instead of a conclusion. You can then judge it yourself.

Warning: confirm the position yourself before you build access control for the third group. An implementing act is law, and a plan is not.

Article 90 of the battery regulation makes that committee step mandatory. The committee gives an opinion, and then the Commission may adopt. No opinion is recorded, so the Commission cannot adopt an act until the committee gives one.

Two limits sit on the search. The Official Journal database reached 13 August 2026 on that day, and the comitology register reached 14 August 2026. So the search cannot show what happens between the search and the deadline.

The Commission plans the act for after its own deadline

Two Commission records put adoption in the last quarter of 2026. One is the timeline on the Commission's digital product passport page. The other is the Commission's planning record for the act itself.

Both records come from the European Commission, so they are one source and not two. This site thus attributes the quarter rather than stating it. The Commission's timeline carries its own footnote: "This is an indicative timeline and subject to publication requirements".

Read the plan against the law. Article 77(9) sets 18 August 2026, and the planned quarter starts in October. A plan does not move a statutory date, and this site will report the outcome after the deadline passes.

The draft European standard on access rights does not answer the question either. prEN 18239 is not published, and the Official Journal does not cite it. See prEN 18239.

Build the first check today, and wait for the second

Your system needs two checks on every request.

The first check asks if a field is public. The law answers that check today, field by field. Who can see what lists the fields in each Annex XIII point.

The second check asks if this reader is a person with a legitimate interest. The law gives you the purposes, so you can read the four kinds of company it names. No adopted instrument gives the test, the evidence or the method of proof.

So a recycler holds a right that the law states, and waits for the rule that says how to prove it. See recyclers and repairers.

Ask a supplier which instrument defines the term

A supplier may tell you that its product implements legitimate interest access. That claim describes a term that no confirmed instrument defines.

Ask three questions before you sign.

1. Which instrument defines a person with a legitimate interest?
2. Which article or clause of that instrument?
3. Where can I read the text?

An answer of prEN 18239 names a draft. An answer of a vendor web page names no law. A correct answer names an implementing act under Article 77(9), and gives its number and its date.

In New Zealand the boundary arrives in a contract first

A New Zealand company usually has no office in the EU. The operator that places the battery on the EU market carries the duty, and that operator is usually your importer. See what a non-EU exporter must supply.

Your importer cannot answer a request for point 2 data without your composition data. So this boundary reaches you as a purchase condition before it reaches you as a law.

Warning: do not publish point 2 data on your public product page to look open. You cannot take it back later.

Tag each field in your product data as public or not public, and do that work before you sign anything. It costs only time, and it holds its value whatever the implementing acts say.

Who can see what gives the four steps to follow, and agreeing data duties covers the contract. See what this means for New Zealand exporters.