At a glance
- Article 77(9) set 18 August 2026 as the date for the implementing act.
- At the 29 October 2026 review, the Commission FAQs describe the restricted-access implementing act as still in preparation.
- The act must specify who has a legitimate interest, which information they can access and the extent to which they may download, share, publish or reuse it.
- Current projects should therefore use configurable policies rather than hard-coded permissions.
What the Regulation already establishes
Article 77 separates public information, information for notified bodies/market surveillance authorities/the Commission, and information available to natural or legal persons with a legitimate interest for the purposes specified by the Regulation.
Public and restricted data: start with Annex XIII
| Information | Access boundary |
|---|---|
| Point 1: public model information | Public access. |
| Point 3: compliance test reports | Notified bodies, market surveillance authorities and the Commission. |
| Points 2 and 4: restricted model and individual-battery information | Access follows Article 77, Annex XIII and the implementing act specifying legitimate-interest users and permitted use. |
What the implementing act must clarify
- which persons qualify as having a legitimate interest;
- which Annex XIII information they may access;
- the extent to which they may download, share, publish or reuse that information;
- how commercially sensitive information is limited to the minimum necessary.
Status of the implementing act
The Commission FAQs, sections 1.4 and 6.3, describe the act as pending and envisage draft feedback in October or November 2026. Check the adopted text before finalising permissions. A roadmap or draft does not establish the final access rules.
Architecture controls to implement now
| Control | Why it matters |
|---|---|
| Role- and purpose-based access | Separates public, authority, verifier and authorised-party views. |
| Versioned policies | Allows rules to change when the act is adopted. |
| Audit log | Records who viewed, changed or authorised information. |
| Data minimisation | Limits exposure of commercially sensitive information. |
| Separate permissions | Viewing does not automatically imply downloading, sharing or reuse. |
The NexusDpp approach
NexusDpp treats access rights as a policy layer separate from the data. The same field can exist in the passport while visibility and permitted use change by role, purpose and regulatory version, avoiding duplicated data sets.
Test access before publishing the passport
Agree these acceptance checks for the pilot. Record the user, permitted action and observed result for each test.
- Anonymous reader: check that the public page and its downloads do not expose restricted fields.
- Authorised user: verify identity, purpose and the exact permitted data scope.
- Separate permissions: test reading, updating and exporting independently.
- Revoked access: confirm that a revoked permission or expired link no longer grants access.
- Audit evidence: retain the tested policy version and relevant access or update records.
Official sources
- European Commission — Battery FAQs, sections 1.4 and 6.3–6.5; checked 29 October 2026
- Regulation (EU) 2023/1542 — Article 77
- European Commission — Digital Product Passport timeline
Connect access rules to the battery workflow
Review how NEXUSDPP Battery Passport software connects supplier data, approvals and individual batteries. Use the supplier data worksheet to record the source and proposed access level before the pilot.