On 8 January 2026, Plug&Charge stopped being a feature and became a legal requirement. Every newly installed public charge point in the EU must now implement ISO 15118-2. From 1 January 2027, ISO 15118-20 joins it, private chargers included.
Germany's federal charge point registry lists 31 865 public charging sites. 1 018 of them declare Plug&Charge. That is 3.2%.
Before you conclude that Europe is ignoring its own law: it is not quite that. It is worse. Nobody can tell you where Plug&Charge actually works — not the regulator, not the operators, not us. And the reason why is the whole story.
The pitch is Tesla's, and it is a good one
Plug the cable in. Walk away. The car and the charger settle who you are and who pays, and nobody opens an app, taps a card or photographs a QR code.
Tesla has done this since 2012, with a proprietary handshake on a network it owns end to end. Two parties, one company, no negotiation. Everyone else has to reproduce that experience across hundreds of operators and dozens of carmakers who have no particular reason to trust each other.
That is what ISO 15118 is for. It is also where the trouble starts.
The regulation mandates implementation. It does not mandate use.
AFIR, as amended by Commission Delegated Regulation (EU) 2025/656, requires new or upgraded public chargers to implement ISO 15118-1/2/3/4/5 from 2026, and ISO 15118-20 from 2027.
Note the verb. A charger can be fully compliant and never complete a single Plug&Charge session. AFIR's payment obligations sit in Article 5, and they are satisfied by card readers and QR codes — the Commission's own guidance confirms Plug&Charge is not relevant to ad hoc payment.
So the law guarantees the plumbing is installed. It guarantees nothing about the water.
The same paper notes there is no AC EVSE certification scheme at all, and expects legacy protocols to coexist “until at least 2028”.
CharIN — the body that owns the CCS connector, and not an organisation given to drama — published a position paper on 28 April 2026 that reads like a polite emergency flare.
Its findings: the regulation mandates the standard but never defines how compliance is proven. Fully compliant hardware is not available at scale. Fewer than ten labs worldwide are accredited for full ISO 15118-20 conformance, with 6 to 9 month lead times. Formal AC conformance test cases are not expected before late 2027 — a year after the mandate bites.
CharIN's recommendation to the Commission is to postpone the 2027 deadline until market-ready solutions exist. That is the industry's own standards body asking for a delay on a rule written to help it.
Seven parties and a cable
2. The carmaker installs an OEM provisioning certificate in the car at the factory.
3. The driver signs with a mobility provider, which issues a contract certificate.
4. A certificate provisioning service encrypts it and hands it to a pool.
5. The car collects it at the next compatible charger.
6. The CPO and its management system must trust the same root, and hold a valid SECC leaf certificate.
Every certificate has to be issued, distributed, installed, renewed and revoked. Across all of them.
Autocharge needs two parties and one identifier. Plug&Charge needs a carmaker, a mobility service provider, a certificate provisioning service, a root certificate authority, a certificate pool, a charge point operator and its management platform — all holding valid, current, mutually-trusted credentials at the moment the driver plugs in.
When it works, it is invisible. When any one link is stale, the driver gets a charger that will not start and no explanation.
Who gets to be the root of trust?
This is the commercially interesting question, and it is the one Hubject built a business on.
Hubject is a joint venture of BMW, Bosch, Mercedes-Benz, EnBW, innogy, Siemens and Volkswagen. It runs a V2G root CA and the platform that connects the parties who need it. ChargePoint's engineering SVP Eric Sidle has called ISO 15118 “very biased toward a small group of organizations that hand out and control those certificates”, arguing the middleman ends up controlling pricing. Marc Mültin, a co-author of the standard, has conceded that stakeholders find Hubject “not independent enough”.
Europe is less monopolar than it was. Gireve — the French roaming operator, with Thales behind the cryptography — now offers root CA and pool services. CharIN operates its own V2G root, run for it by Irdeto. Penta Security cross-certifies with Hubject. That is healthier. It also means a charger now has to trust several roots, and a driver's certificate has to be reachable through whichever pool their carmaker happened to pick.
North America went at it from the other end. SAE ITC's EVPKI consortium has launched a production Certificate Trust List carrying six root certificates, with the stated aim of creating “a competitive PKI supply market that does not meaningfully exist today”.
Read that line again. It is a standards consortium saying the quiet part into a microphone.
And Korea picked a third answer entirely: Hyundai Motor Group is handing its Plug&Charge technology and the certification authority to the government, free of charge, alongside an open alliance of 12 domestic operators. The state becomes the root.
Three continents, three answers to “who do you trust”: a carmaker-owned joint venture, a competitive market with a shared trust list, and a ministry. Only one of them is a business model.
What the German registry knows, and what it doesn't
Germany is the only large European market whose official charge point registry asks operators, explicitly, whether a site supports Plug&Charge. We pulled the answers.
Share of each operator's German DC sites (50 kW+) that declare Plug&Charge in the federal charge point registry. Operators with 40 or more DC sites. Source: Chargalytics, from Bundesnetzagentur data, August 2026.
Aral pulse declares 53 of its 87 German DC sites. Allego declares 11 of 68. Ionity — which has run ISO 15118-2 Plug&Charge across its entire network for years — declares one site out of 61. Tesla declares none of 268.
This chart does not measure Plug&Charge. It measures who filled in the form.
That is the finding. In the first year of a continental mandate, in the market with the most charge points and the most diligent registry in Europe, there is no reliable public record of where Plug&Charge works. Every other national registry we hold — France, the Nordics, Italy, the Netherlands — does not even ask the question.
Drivers find out by plugging in and waiting.
Meanwhile, the crude version keeps working
Autocharge does the same job with none of the machinery. The charger reads the identifier the car broadcasts during the DC handshake — usually its MAC address — looks it up against an account, and starts. One registration, no certificates, no root of trust, no pool, no clearinghouse.
It is also, on paper, insecure. A MAC address is an identifier, not a secret. Anyone who can read one can in principle present it, and the only defence available to an operator is to blacklist the ones that get abused. Marc Mültin, who co-wrote ISO 15118, has published an argument titled, with no great subtlety, “Autocharge: what it is and why it’s a bad idea”.
He is right about the security. He is also describing something that is quietly running across Europe while the secure version waits for its certificates.
In our database those six alone operate 5 789 DC sites and 32 677 DC bays across up to eight countries.
Treat that as a sample, not a census. There is no register of Autocharge deployments, so this is a floor discovered by reading announcements, not a market measurement.
Autocharge is live at EnBW, Mer, Electra, Fastned, Powerdot and GRIDSERVE, among others. Powerdot rolled it out with Miio and then with Chargemap across France, Belgium, Spain and Poland. It works on cars that will never receive a contract certificate, at sites that will never join a PKI.
Six is a sample, not a census. Nobody publishes a register of Autocharge deployments — which is, once again, the point. For scale, our database holds roughly 135 000 public DC sites across Europe. The true Autocharge figure is higher than our sample. Nobody can tell you how much higher.
Autocharge is not uniform either, and that matters
The catch, and operators will tell you this freely: enabling Autocharge on a network does not enable it on every charger in that network.
It only works on DC. The identifier rides on the digital handshake that DC charging requires, and ordinary AC charging has no such conversation — which is precisely the gap ISO 15118 was written to close. The charger also needs OCPP 1.5 or later and firmware that supports the feature, so older units in an otherwise Autocharge-enabled network simply do not do it. GRIDSERVE, for instance, brought it in with newer hardware rather than across the estate overnight.
Volkswagen Group is also a co-owner of Hubject.
CHAdeMO cars are out entirely. Several older VAG models and some Lucids never supported it.
Then there is the car. Volkswagen Group's MEB platform rotates its MAC address, which makes Autocharge structurally impossible on the ID.3, ID.4, ID.5, Skoda Enyaq, Audi Q4 e-tron and Cupra Born. CHAdeMO vehicles are excluded by design. A scattering of older models never supported it.
So the driver experience is: it works, until it doesn't, and you cannot tell in advance which charger or which car will be the exception. Which is, word for word, the same complaint we have just made about Plug&Charge.
That is the honest read. Autocharge is not a better system. It is a worse system that shipped, and shipping turns out to be worth a great deal.
The third way nobody put in the regulation
While the standards bodies argue, a quieter answer is emerging: identify the car through its own data connection and skip the cable conversation entirely.
Ford already does this, building its own telematics-based certificate delivery rather than using the standard provisioning flow. In spring 2026 Vattenfall InCharge and WirelessCar ran a pilot with more than 700 drivers in Sweden, the Netherlands and Germany, starting sessions with no card, no app, no certificate and no MAC address — just the car telling the cloud where it is plugged in.
Telematics has an obvious flaw: it needs the carmaker's cooperation, and it hands the carmaker the customer relationship. Which may be exactly why carmakers like it.
| Autocharge | Plug & Charge (ISO 15118-2) | |
|---|---|---|
| Identity | MAC address or VIN | X.509 contract certificate |
| Parties required | 2 (driver, operator) | 7+ across the trust chain |
| Standardised | No, operator-specific | Yes, ISO 15118-2 and -20 |
| Cross-network | Only where operators bilaterally agree | By design, via shared roots |
| Spoofable | Yes, in principle | Relay attack demonstrated 2025 |
| Governance cost | Zero | Root CA, pools, certificate lifecycle |
| AFIR status | Not recognised, not banned | Mandated implementation from 2026 |
| Works on AC | No, DC handshake only | Yes, that is the point of -2 |
| Vehicle gaps | VW Group MEB, CHAdeMO, some others | Broad and growing |
| Working today | 6+ networks we can confirm | Ionity, Allego, Aral and a patchy long tail |
The security argument, taken seriously
The case for all that machinery is real. Certificates give you revocation, non-repudiation and a defence against exactly the identifier-spoofing Autocharge invites. If Plug&Charge is going to carry payment for millions of unattended transactions, cryptography is the right answer.
Then December 2025 happened.
Root cause: the Plug&Charge signature contains no station identity, combined with weaknesses in how ISO 15118 handles TLS certificates.
Researchers published a working relay attack on ISO 15118 Plug&Charge payment: a fake charger, a relayed handshake, and someone else's bill. Full proof-of-concept, accepted to USENIX VehicleSec 2026.
To Hubject's genuine credit, the lead author is presenting it at ICNC26 — on Hubject's own stage, in a session titled “Plug and Charge Payment Fraud and other ISO 15118 Vulnerabilities”. That is how a serious industry handles bad news.
But hold the two facts next to each other. Seven years of certificate infrastructure produced a system that was still relay-attackable. The thing it was built to replace — a MAC address in a lookup table — is quietly running in four countries. Complexity bought less safety than the sales deck implied.
The carmakers are ready. The chargers are not.
On the vehicle side, this is close to solved. Porsche Taycan and Mercedes EQS got there first. Today the list runs through the Volkswagen ID range, Skoda Enyaq, Audi Q4 e-tron and Cupra Born; BMW i4, i5, i7 and iX; Hyundai Ioniq 5 and 6, Kia EV6 and EV9, Genesis GV60; Volvo EX90 and EX60; Polestar from model year 2026.
Volvo switched Plug&Charge on across 35 000 US stations in June 2026. GM announced its rollout at Empower in the summer. The cars are, broadly, holding up their end.
Two details spoil the picture. Ford built its own telematics-based certificate delivery rather than use the standard provisioning flow, citing security. When a carmaker routes around your ecosystem to reach your standard, the ecosystem has a product problem.
And BMW's own service bulletin for 2025 model-year EVs enumerates the failure modes its dealers should expect: the Plug&Charge menu not appearing, contract installation failing, contracts vanishing after installation, providers simply not sending them. That is the friction, documented by the factory, in a workshop manual.
Lead times of 6 to 9 months.
Formal AC conformance test cases not expected before late 2027.
The mandate starts 1 January 2027.
Manufacturers must ship certified hardware roughly a year before the certification exists.
The charger manufacturers are where the 2027 deadline stops being a policy debate and starts being a supply chain problem. Alpitronic lists ISO 15118-20 support with an implementation date of “TBC”. It is not alone.
Hardware commissioned for European public use from 2026 needs PLC-capable communication controllers from day one — a firmware promise is not enough. That is a bill of materials decision, made two years before the software that uses it is finished.
We have done this before
In 2015, our founder Ole Henrik Hannisdahl stood on the ICNC stage in Berlin and told a room full of roaming people that roaming was the solution to a problem the industry had created for itself, by making it so hard to simply walk up to a charger and use it.
He has not been invited back.
The irritating thing about that argument is how well it has aged. Roaming worked, commercially. It also entrenched the fragmentation it was built to paper over. Eleven years on, European drivers still carry a wallet of RFID cards and a folder full of apps, and the clearing layer has become a permanent tax on a problem that was never the driver's fault.
The instinct is alive and well, incidentally. In December 2025, Atlante, Electra, Fastned and Ionity founded ChargeLeague, so that drivers from any member network can charge at any other. An alliance to fix the fragmentation created by the alliances. We have seen this film.
Plug&Charge has the same silhouette as roaming did. A genuinely excellent user experience, delivered through a trust layer that requires a middleman, is priced by a middleman, and — on the evidence of the German registry — is invisible to the public record. The user problem it solves is real. The governance structure it needs is the part nobody asked for.
The tell is that Autocharge, which is worse engineering, is currently a better product. Fewer parties, no certificates, works today, on more networks, in more countries. That should worry the people building the good engineering rather than reassure the people building the crude version.
None of which is an argument for abandoning ISO 15118. It is the right standard, and the security case will only get stronger as bidirectional charging turns every car into a grid asset. It is an argument for making the ecosystem boring.
Four things would do it: multiple competing roots, which Europe now has. A shared trust list anyone can join, which North America has and Europe does not. Certificate provisioning that never requires a support ticket. And a public register that actually says where the thing works — because a feature drivers cannot find is not a feature.
Europe mandated the protocol and skipped the other three.
Hubject gathers the industry at Tempelhof from 1 to 3 September. The agenda holds both “Plug&Charge: Expanding Possibilities” and the relay attack talk. Worth noting which room fills up.
The rulebook moves faster than the hardware, so we track that too. ChargiPedia covers AFIR and the rest of Europe's charging regulation, and our country statistics cover every market on the continent. Start a free trial and both open up.