Repair information access rights: what an independent workshop may demand

An independent workshop that takes in a five-year-old tractor unit needs three things before it can quote for the job: the data that says exactly what the vehicle is, a tool that can talk to it, and permission to write back what it has changed. None of that is settled by the contract between operator and dealer. It is settled by EU type-approval law, and the text is more specific than the summaries of it suggest.

Where the duty sits now

The right lives in Chapter XIV of Regulation (EU) 2018/858, headed “Access to vehicle OBD information and vehicle repair and maintenance information” and running from Article 61 to Article 66. The regulation applies from 1 September 2020 (Article 91), and Directive 2007/46/EC was repealed with effect from that same date (Article 88).

Older citations are the first trap. The heavy-vehicle version of this duty used to sit in Article 6 of Regulation (EC) No 595/2009; Article 87(1) of the 2018 regulation deleted that article outright, and the correlation table at Annex XI point 2 reads it across to Article 61. Chapter III of Regulation (EC) No 715/2007, the light-duty equivalent, went the same way under Article 86(1). A supplier still quoting the 2009 article number is quoting a provision no longer in the text.

Scope is wide. Article 2(1) applies the regulation to motor vehicles of categories M and N and their trailers of category O intended for use on public roads, so coaches, city buses, rigids, tractor units and semi-trailers sit under one chapter. Article 61(10) takes vehicles covered by individual vehicle approvals out of it entirely.

What Article 61(1) actually obliges

The first paragraph is worth reading in its own words rather than in paraphrase. Manufacturers shall provide independent operators with unrestricted, standardised and non-discriminatory access to vehicle OBD information, diagnostic and other equipment, tools including the complete references, and available downloads, of the applicable software and vehicle repair and maintenance information. It is to be presented in an easily accessible manner as machine-readable and electronically processable datasets, and independent operators are to have access to the remote diagnosis services used by manufacturers and their authorised dealers and repairers. A second subparagraph adds a standardised, secure and remote facility so that independent repairers can complete operations involving the vehicle security system. Two phrases there decide most arguments: tools including the complete references means identifiers, not descriptions; available downloads, of the applicable software means the software itself.

Training material goes to independent operators as well as to authorised dealers and repairers (61(5)). The information must be always accessible except for maintenance of the information system, and amendments and supplements must appear on the manufacturer’s websites at the same time they reach authorised repairers (61(6)) — not afterwards. Component, diagnostic-tool and test-equipment makers get the relevant information on a non-discriminatory basis (61(7)).

Article 61(9) is the one used-vehicle buyers should know about. Where repair and maintenance records are held in a central database of the manufacturer or on its behalf, independent repairers have access to them free of charge and can enter the work they have done — the manufacturer-side service history behind what to check before buying a used truck. The definition at Article 3(48) also covers information required for preparing a vehicle for roadworthiness testing.

When the standard format gives way

The default is publication on the manufacturer’s website in a standardised format (61(2)). Two different mechanisms cut into it, and they are not the same thing. Under Article 61(3) four categories of vehicle are relieved of the format altogether: for them it is sufficient that the manufacturer provides the required information promptly in an easily accessible manner when an independent operator so requests. Annex X points 4 and 5 are derogations from point 2 of the annex, and neither is conditioned on a request being made at all.

Those derogations reduce the form of access, not the fact of it. Points 4.1 and 5.1 both require the information to be provided in a readily accessible and prompt manner, and in a manner non-discriminatory compared with what authorised dealers and repairers are given; 4.1 adds that the proprietary specialist diagnostic tool or test equipment for servicing and reprogramming the adapted control units must reach independent operators as it reaches authorised repairers, and 4.2 requires that tool or equipment to be offered by sale and rent. Nor is either derogation taken silently: customer adaptations and the control units related to them are listed on the manufacturer’s information website and named in the certificate at type-approval (4.1 and 4.3), and small-volume types are listed on the website (5.2).

The two 250s in the table are not the same threshold. Point 5.1 measures the manufacturer — worldwide annual production of a type of vehicle, system, component or separate technical unit, under 1 000 vehicles for M1 and N1 and under 250 units for M2, M3, N2, N3 and O. Point 4.1 measures the batch: fewer than 250 units of one specific customer adaptation produced worldwide. It sets no annual period and names no vehicle type. On our reading the count therefore runs cumulatively, so an adaptation would sit inside the derogation only until its 250th unit is built, whenever that falls; the annex does not say so in terms, and the contrast with the express “worldwide annual production” of point 5.1 is the whole of the basis for it.

Multi-stage vehicles get their own rule on money. Under Annex X 3.7 a manufacturer, the final one included, may charge under Article 63 only for the stage or stages it is responsible for, and may not charge at all for supplying another manufacturer’s website address or contact details.

What it is allowed to cost

Article 63 is the part most often argued about. Under 63(1) the manufacturer may charge reasonable and proportionate fees for access to vehicle repair and maintenance information other than the records referred to in Article 61(10), and those fees shall not discourage access to such information by failing to take into account the extent to which the independent operator uses it. Access is free of charge to national authorities, the Commission and technical services. That internal cross-reference repays a second look, because Article 61 holds only one set of records: the central-database repair and maintenance records at 61(9), which independent repairers already have free of charge, while 61(10) is the paragraph that excludes individually approved vehicles from the chapter. The wording is identical in the text as published in OJ L 151 and in the consolidation of 2 August 2026.

Article 63(2) sets the shape of the price list rather than its level. The manufacturer shall make repair and maintenance information available — including transactional services such as reprogramming or technical assistance — on an hourly, daily, monthly and yearly basis, with the fee varying according to the period of access granted. Transaction-based access, charged per transaction rather than by duration, may be offered in addition. Where a manufacturer offers both systems, independent repairers shall choose. The choice belongs to the workshop, not to the brand.

No figure is fixed anywhere, but “reasonable and proportionate” is not the whole of the price control either. Annex X 3.7, met above on multi-stage vehicles, bars any charge at all for another manufacturer’s website address or contact details. Point 3.8 of Appendix 4 sets a zero: no fee may be required for enabling access under Annex X point 2.9, the single exception being the remote facility at 2.9(c), for which justified and proportionate fees are allowed — a different formula from the one in Article 63(1). Annex X 6.4 carries its own reasonable-and-proportionate rule for validating an independently developed vehicle communication interface. What none of them supplies is a number, which is why the dispute route in Article 65 matters more than the drafting does.

Every brand’s website, one shape

Annex X 2.1 presumes compliance with the standardised-format duty where a manufacturer conforms to Parts 1 to 4 of EN ISO 18541–2021 and Part 5, “Heavy duty specific provision”, of EN ISO 18541–2018. Three practical points sit alongside it: the type-approval number must be shown by model on the site (6.8); registration outside the secure areas may require only what confirms how payment will be made (6.7); and since the 2026 amendment the information must reach independent operators at the latest on the date the vehicle is placed on the market (Annex X point 7.5).

Security information has its own scheme

Access to vehicle security features — the features built into a vehicle by the manufacturer to prevent it being stolen or driven away and to enable it to be tracked and recovered, which is how Annex X, Appendix 3, point 2.1.3 defines the security-related information at stake — is fenced off. The third limb matters to a fleet: telematics tracking and recovery functions sit inside the fence, not outside it. Annex X 6.2 requires confidentiality, integrity and replay protection, mutual authentication by security certificates and a private key held in secure hardware; 6.3 routes approval through the SERMI scheme in Appendix 3, which covers heavy duty vehicles as well as light ones and applies from 30 July 2023 under Commission Delegated Regulation (EU) 2021/1244.

The mechanics are administrative rather than technical. A conformity assessment body approves the operator and authorises named employees; approval and authorisation last 60 months from the date of the inspection certificates; the body notifies both six months before expiry, makes at least one random unannounced on-site inspection over that period, and retains its records for five years. An operator given a negative result has 15 working days to correct minor deficiencies. Approval turns on documents showing a legitimate business activity and no relevant criminal conviction, and 6.3 disqualifies operators who advertise or offer work that would damage emissions performance — removing pollution control systems, fitting defeat devices, tampering with consumption monitoring or odometer readings, or tampering with the engine control unit including rated power. Every grant of access is logged by the manufacturer with the VIN and date and kept for five years. The Commission’s notice 2022/C 288/02 explains how the scheme is meant to run; it is guidance, not a further obligation.

Tools, reprogramming and the 2026 rewrite

Annex X 6.4 requires reprogramming of control units, variant coding and activation of replacement parts to work on non-proprietary hardware, without dependency on manufacturer hardware, under ISO 22900-2, SAE J2534-1, SAE J2534-2, TMC RP1210B or SOVD standard ISO/DIS 17978-1, RP1210B being the heavy-duty entry on that list. Point 6.5 carves two things out: the requirement does not apply to reprogramming of speed limitation devices or of recording equipment, so tachograph work is not opened up by it.

Commission Delegated Regulation (EU) 2026/699, adopted on 23 March 2026 and published in the Official Journal on 3 June 2026, rewrote much of the annex around cybersecurity. Point 2.9 is its spine. For accessing vehicle OBD information, diagnostics, repair and maintenance, monitoring and inspection, the manufacturer must enable bi-directional access to the in-vehicle data stream through all three of the following: the serial data port on the standardised data link connector (paragraph 4.7.3 of Annex 9B to UN Regulation No 49 for heavy vehicles, Annex C5 to UN Regulation No 154 for light ones); any other in-vehicle means of access that the manufacturer either provides to its authorised partners, dealers and repairers or uses itself for repair and maintenance — Ethernet connectors, non-standardised pins on the standardised OBD port, application programming interfaces used for aftermarket service integration, wireless local area networks; and any facility that it either provides to those same partners, dealers and repairers or uses itself to enable remote access. The word carrying the weight in the last two limbs is or. A remote facility a manufacturer hands its dealers but never operates itself is inside the duty, and so is an in-vehicle route it uses itself but has given to nobody.

While the vehicle is in motion the manufacturer may make the data stream read-only, but only if it applies the same restriction to its own authorised partners, dealers and repairers. The same point lets it impose conditions on access to the data stream to the extent that is necessary and proportionate for compliance with Article 4(5)(d) and Annex II line D4 of Regulation (EU) 2019/2144 and Articles 4(7), 4(8) and 6(3) of Regulation (EU) 2024/1257. Appendix 4 caps those conditions — but its own point 1.1 confines the cap to the two in-vehicle routes at 2.9(a) and (b), and remote access under 2.9(c) sits outside it. This is a conditional right, capped for two of three routes, not an unconditional one.

Within the cap the list is tight. Authentication of the diagnostic tool and its manufacturer may not be made a condition of issuing access credentials for reading diagnostic trouble codes, reading the VIN, or reading data and clearing diagnostic trouble codes where unrestricted access by means of a generic or OBD scan-tool is either required under Regulation (EU) 2017/1151 or Regulation (EU) 2024/1257, or provided for in UN Regulation No 49, No 83, No 168 or No 154 (Appendix 4 point 3.1). Both branches of that last carve-out have to be read: UN Regulation No 49 is the heavy-vehicle entry on the list, so for a truck or bus it is the second branch that applies and not the first. Access credentials are valid for at least 30 days from the time of provision — except that whenever access to OBD information involves a change to the vehicle the manufacturer may limit them to 24 hours (Appendix 4 points 7.3 and 7.4), and Appendix 4 point 7.5 puts most of a workshop’s day in that class: activating actuators, clearing trouble codes, resetting service lights, replacing and initialising parts, calibration, variant coding and reprogramming. Where a manufacturer suspends access over suspected misuse or a cybersecurity incident it must notify the approval authority at the same time, and the authority has ten days from that notification to review the grounds and require access to be restored if the suspension is manifestly unjustified or disproportionate (Appendix 4 point 10.5). The annex also carries dated deadlines for opening software and interfaces to independent diagnostic tool makers, among them 23 September 2026, 23 December 2026, 23 June 2027 and 23 June 2028.

It also widened what counts as repair and maintenance information: calibration and repair data for driver assistance systems, what is needed to identify the correct software update or variant coding, and diagnosis data for traction battery systems and their exchangeable modules.

When a manufacturer does not comply

Article 64 gives the manufacturer six months from type-approval to hand the approval authority proof of compliance with the chapter. Article 65 lets that authority check compliance at any time, on its own initiative or on a complaint, and where an independent operator or a trade association representing independent operators complains, it must audit and communicate the results within three months of the request. Available measures include withdrawal or suspension of the type-approval, and fines.

That is a type-approval route, and it is not the only one. Whether a franchise agreement may stop a dealer selling parts to an independent workshop is a competition-law question, settled under the motor vehicle block exemption, Commission Regulation (EU) No 461/2010. Neither of the terms that argument turns on is defined there: Article 1 of that regulation runs from vertical agreement and vertical restraint through authorised and independent repairers and distributors to motor vehicle, spare parts and selective distribution, and stops. For “original” and “matching quality” parts the trails then part company. “Matching quality” has only a soft-law test, at paragraph 20 of the Commission’s Supplementary Guidelines, 2010/C 138/05: the part must be of a sufficiently high quality that its use does not endanger the reputation of the authorised network, and the manufacturer may bring evidence that a given part does not meet it. The phrase appears nowhere in Regulation (EU) 2018/858. “Original parts or equipment” is the other way round. Paragraph 19 of the same Guidelines supplies no free-standing meaning of its own; it states the definition and cross-refers to the second subparagraph of Article 55(5) of Regulation (EU) 2018/858 — the very regulation this article is about — where original parts or equipment are those manufactured according to the specifications and production standards provided by the vehicle manufacturer for the assembly of the vehicle in question. That is a binding definition in a directly applicable regulation, though it is expressed “for the purposes of this Article” and so binds within Article 55 rather than across the whole text. Two doors, two different authorities. The firms on the type-approval side are a short list — the European truck and bus builders — and each signs the certificate at Annex X Appendix 1 that names the website where its information is supposed to be.

The chapter grants access, not ownership: Annex X 6.1 leaves anyone wanting to duplicate or republish the information to negotiate directly with the manufacturer.