ISO 15118 Plug & Charge: Procurement Guide for AFIR 2026 and 2027
What PnC is
X.509 contract certificate exchanged EV ↔ charger over PLC. Billing happens via eMSP backend without driver action.
-2 vs -20
-2 (2014): TLS 1.2, PLC, single contract, unidirectional. -20 (2022): TLS 1.3 mandatory, PLC+WLAN, multi-contract, bidirectional.
AFIR clock
2026-01-08: ISO 15118-2 on new EU public AC. 2027-01-01: ISO 15118-20 on new EU public + private.
HG Power lineup
Stellar / Genesis / Aurora Split: OCPP 2.0.1J + ISO 15118-2 configurable per order; -20 roadmap confirmed per quotation. V2G Bidirectional series: -20 as target architecture.
Direct answer: ISO 15118 Plug & Charge (PnC) lets an EV authenticate and bill itself via an X.509 contract certificate exchanged over the charging cable — no RFID, no app. ISO 15118-2 (2014) covers unidirectional PnC on TLS 1.2; ISO 15118-20 (2022) adds bidirectional (V2G), TLS 1.3 mutual auth, WLAN and multi-contract. The two are not backward compatible. EU AFIR mandates -2 on new public AC from 2026-01-08 and -20 on new public and private chargers from 2027-01-01. Procurement must confirm OCPP 2.0.1J + ISO 15118 version, V2G Root CA trust (Hubject / Eonti) and conformance evidence per RFQ Clauses 1-6 below.
1. What Plug & Charge actually is
Plug & Charge is a feature of the ISO 15118 standard that lets the vehicle and the charger authenticate each other and authorise a billing contract through the charging cable itself. The driver plugs in; the EV’s charging controller (EVCC) and the charger’s supply equipment controller (SECC) run an EXI-encoded handshake over Powerline Communication (PLC) using the HomePlug Green PHY physical layer. Inside the handshake, the vehicle presents an X.509 contract certificate issued by its eMSP; the charger validates the certificate chain back to a trusted V2G Root CA; if valid, the session starts and the eMSP settles the bill with the CPO.
Everything about PnC that is interesting sits in one of three places: the certificate chain (who signed what), the installation flow (how the contract certificate got into the vehicle), and the OCPP integration (how the charger talks to its backend about PnC events). The rest of this guide walks each layer with buyer-side decisions attached.
2. Plug & Charge vs Autocharge vs RFID: the three authentication paths
| Dimension | Plug & Charge (ISO 15118) | Autocharge | RFID / App |
|---|---|---|---|
| Identifier | X.509 contract certificate, cryptographically signed | EVCC MAC address, plain-text | RFID UID or app token |
| Trust anchor | V2G Root CA (Hubject, Eonti, OEM root) | CPO’s own database | CPO / eMSP backend |
| Driver action | None — plug in | None — plug in (after first-time pairing) | Tap card or open app |
| Spoof resistance | High (private key non-exportable from EV) | Low (MAC can be cloned) | Medium (depends on card tech) |
| Vehicle support | EVs with ISO 15118 EVCC — growing OEM list | Any EV with a readable EVCC MAC | Any vehicle |
| Charger support | ISO 15118-2 or -20 capable SECC + OCPP PnC | CPO firmware feature; non-standardised | Universal |
| Regulatory status (EU) | Mandated by AFIR 2026/2027 | Not standardised; no regulatory recognition | Baseline fallback |
Autocharge is the pragmatic bridge many CPOs have run through the late 2010s and the first half of the 2020s because it works on any ISO 15118-capable vehicle without the PKI build-out. It is not a long-term substitute: it has no cryptographic identity, no cross-CPO interoperability, and no path to the AFIR compliance tick. New procurement from 2026 onward should treat Autocharge as a transitional feature on PnC-capable hardware, not a target architecture.
3. ISO 15118-2 vs ISO 15118-20: the version split that matters
| Feature | ISO 15118-2 (2014) | ISO 15118-20 (2022) |
|---|---|---|
| TLS version | TLS 1.2 (optional in some flows) | TLS 1.3 mandatory, mutual authentication |
| Bidirectional energy transfer | Not supported | AC-BPT and DC-BPT (V2G, V2H, V2L) |
| Transport layer | PLC only (HomePlug Green PHY) | PLC + WLAN (wireless) |
| Wireless power transfer | Not addressed | WPT supported |
| Automated connection device | Not addressed | ACD supported (robotic charging arms) |
| Contracts per session | Single contract | Multiple contracts (e.g. fleet + personal) |
| Scheduled charging | Basic | Dynamic + Scheduled + V2G control modes |
| Crypto-agility | Fixed cipher suites | Negotiable, replaceable without protocol revision |
| Backward compatible | — | No. Dual-stack firmware required for both |
The non-backward-compatibility is the single most consequential procurement fact in this standard. A charger that supports only ISO 15118-2 cannot serve a vehicle that implements only ISO 15118-20, and vice versa. Hardware shipping in 2026-2027 therefore typically runs both stacks in parallel and negotiates version at session start. That doubles the controller certification burden and increases firmware memory footprint; it is the main reason PnC-ready cabinets cost more than their non-PnC counterparts.
DIN SPEC 70121 (2012-2014) still lives alongside both as the DC-only, no-TLS fallback used by many 2018-2024 vehicles — chargers aimed at mixed fleets typically implement DIN 70121 + ISO 15118-2 + ISO 15118-20 as three concurrent paths selected per vehicle.
4. The PKI chain: V2G Root CA to leaf certificates
Plug & Charge security rests on a four-tier X.509 Public Key Infrastructure. Each tier signs the tier below it.
Figure 1 · ISO 15118 PKI chain · V2G Root → Sub-CA (OEM / eMSP / CPO) → Contract + Provisioning + EVSE Leaf → TLS session certificates (illustrative)
| Tier | Certificate | Issued by | Held in |
|---|---|---|---|
| 1 (Root) | V2G Root CA certificate | V2G Root Operator (Hubject, Eonti, OEM root) | HSM at root operator; public key distributed to all parties |
| 2 (Sub) | Sub-CA certificates for OEM / eMSP / CPO | V2G Root | HSM at eMSP / OEM / CPO |
| 3 (Provisioning) | Provisioning Certificate (OEM) & Contract Certificate (eMSP) | OEM Sub-CA / eMSP Sub-CA | Vehicle secure element |
| 3 (Infrastructure) | EVSE Leaf Certificate | CPO Sub-CA | Charger SECC secure element |
| 4 (Session) | TLS session certificates derived from leaves | Generated per session | Volatile — RAM only |
Hubject’s V2G Root CA has operated as the dominant European trust anchor since 2018 and now has reciprocal recognition from Eonti in North America and several OEM-owned roots. Hubject operates the OPCP (Open Plug & Charge Protocol) testing platform, while CharIN runs periodic Testival interoperability events; between them, chargers and vehicles can prove certificate-chain acceptance across commercial V2G Root operators.
Buyer-side implication: a charger must trust the V2G Root(s) your target eMSPs use, otherwise valid vehicles present certificates the charger rejects. “ISO 15118 supported” without a declared Root CA trust list is incomplete — see RFQ Clause 2.
5. Certificate installation: three legitimate flows
The contract certificate must arrive inside the vehicle before PnC can succeed on first use. Three flows are standardised and all three appear in production.
| Flow | Trigger | Transport | Typical use |
|---|---|---|---|
| 1. Online via charging station | Vehicle sends CertificateInstallationReq on first plug-in | EV ↔ SECC ↔ CPO backend ↔ Certificate Provisioning Service (CPS) ↔ eMSP backend | Driver signs eMSP contract online, drives to any PnC charger, first session installs cert |
| 2. OEM backend over-the-air | eMSP delivers signed contract data to OEM, OEM pushes to vehicle via OTA | Cellular / Wi-Fi to vehicle telematics | Pre-provisioning before delivery, or on-demand update post-sale |
| 3. Offline installation | Dealer / service action with signed data on USB or scan tool | Direct to vehicle secure element | Vehicles without reliable backend connectivity; dealership delivery |
Flow 1 is the ISO 15118-2 reference flow; it depends on both the charger and the CPO backend implementing CertificateInstallationReq / Res correctly. Flow 2 is becoming common because it removes the “first-plug-in-fails-mysteriously” driver experience when CPS routing is misconfigured. Flow 3 is a fallback for markets with partial backend coverage.
6. AFIR deadlines: when ISO 15118 stops being optional in the EU
Figure 2 · AFIR ISO 15118 deadlines (illustrative)
| Deadline | Scope | Standard | What it means for buyers |
|---|---|---|---|
| 2026-01-08 | All new public AC charging points in EU | ISO 15118-2 | AC wallbox procurement from this date must present ISO 15118-2 evidence |
| 2027-01-01 | All new public and private charging points, AC and DC | ISO 15118-20 | Any new charger order after this date must support ISO 15118-20 (dual-stack with -2 in practice) |
| Member-state variants | Some states accelerate (e.g. Germany, Netherlands) via national incentives | -2 and/or -20 | Check national AFIR implementing act before closing procurement |
Non-EU markets have no equivalent hard mandate as of 2026, but US NEVI-funded sites require ISO 15118-capable hardware with Plug & Charge roadmap; UK and Australia follow EU conformance in practice through import patterns. For export-oriented hardware (which is what HG Power ships), ISO 15118 support is already a procurement filter in most developed markets, with or without a national mandate.
7. OCPP 2.0.1J touchpoints: where PnC and the backend meet
ISO 15118 is the EV-to-charger protocol; OCPP is the charger-to-backend protocol. PnC only works end-to-end if the two cooperate at four points:
| # | OCPP 2.0.1J message / flow | Role in PnC |
|---|---|---|
| 1 | Authorize (idToken type = eMAID) | Charger forwards vehicle eMAID extracted from contract certificate to CSMS for billing authorisation |
| 2 | Get15118EVCertificate / Get15118EVCertificate Response | Charger relays CertificateInstallationReq from vehicle, CSMS returns signed response via Certificate Provisioning Service |
| 3 | SignCertificate / CertificateSigned | Charger requests its own EVSE leaf-certificate renewal from CSMS |
| 4 | DeleteCertificate / InstallCertificate / GetInstalledCertificateIds | CSMS lifecycle control of charger’s trust store (V2G Root CAs, CPO Sub-CAs) |
If the charger’s OCPP implementation is 1.6 (JSON), none of this exists — OCPP 1.6 has no native PnC messages, and PnC on a 1.6 charger requires non-standard extensions. OCPP 2.0.1J (now adopted as IEC 63584) is the minimum backend protocol for standards-compliant PnC. OCPP 2.1 adds V2X-specific extensions aligned to ISO 15118-20 bidirectional modes.
8. Conformance testing reality: labs, timelines, cost
Marketing claims of “ISO 15118 ready” without conformance evidence are a frequent source of procurement disputes in this standard. The industry-side reality in 2026:
- Fewer than 10 laboratories worldwide are accredited for full ISO 15118-20 conformance testing (DEKRA, TÜV SÜD, TÜV Rheinland, Keysight, and a handful of OEM-adjacent labs are the commonly cited names).
- Lead time for a conformance test slot is typically 6-9 months.
- CharIN testivals provide interoperability evidence but are not a substitute for lab conformance certificates.
- Hardware design cycle from ISO 15118-2-only to dual-stack -2+-20 typically runs 8-14 months including conformance.
What this means in practice: a vendor claiming “ISO 15118-20 supported” on hardware that first shipped in 2026 must be able to show either (a) a lab conformance certificate, (b) a CharIN testival report plus declared conformance plan with timeline, or (c) a signed path-to-conformance commitment in the sales contract. See RFQ Clause 5.
9. HG Power ISO 15118 readiness matrix
HG Power manufactures 30–720 kW DC fast chargers and AC wallboxes with CE, TUV CB, UKCA, Australia RCM, ETL and ENERGY STAR certifications for regional distributors, fleet integrators and OEM buyers in developed markets. ISO 15118 version support is engineered on a common controller base and the specific version (DIN 70121 / ISO 15118-2 / ISO 15118-20) is confirmed per order within each series’ supported envelope.
| Series | Power range | Current ISO 15118 support | -20 roadmap | OCPP |
|---|---|---|---|---|
| Galaxy AC wallbox | 7.4–22 kW | ISO 15118-2 configurable per order (AFIR 2026-01-08 ready) | Confirmed per order | OCPP 2.0.1J |
| Stellar AC/DC | 7.4–40 kW | ISO 15118-2 configurable per order; DIN 70121 for DC fallback | Confirmed per order | OCPP 2.0.1J |
| Genesis DC Integrated | 40–480 kW | ISO 15118-2 + DIN 70121 configurable per order | Confirmed per order within production window | OCPP 2.0.1J |
| Aurora Split (standard) | 180–2,000 kW | ISO 15118-2 + DIN 70121 configurable per order | Confirmed per order | OCPP 2.0.1J |
| Aurora Split (heavy-duty) | 2,000–2,600 kW | ISO 15118-2 + DIN 70121 configurable per order | Confirmed per order | OCPP 2.0.1J |
| Glacier & Deepsea Liquid-Cooled | 160 kW–2 MW | ISO 15118-2 + DIN 70121 configurable per order | Confirmed per order | OCPP 2.0.1J |
| V2G Bidirectional | 15–240 kW | ISO 15118-2 + V2G control extensions configurable per order | ISO 15118-20 target architecture, timeline per order | OCPP 2.0.1J / 2.1 roadmap |
Trusted V2G Root CAs supported out of the box: Hubject (Europe + reciprocal), Eonti (North America). Additional OEM roots can be added to the charger trust store via OCPP 2.0.1J InstallCertificate on request.
Related buyer guides: OCPP 2.0.1 vs 1.6 procurement guide for the backend protocol baseline; liquid-cooled vs air-cooled for thermal architecture; dual-gun power allocation for multi-connector sites; EV charger manufacturer vetting for broader supplier context.
10. Six RFQ clauses for Plug & Charge procurement
| # | Clause | Verifies |
|---|---|---|
| 1 | “Vendor shall declare per model: supported ISO 15118 version(s) (-2, -20, or both), supported DIN SPEC 70121 fallback, and TLS version(s) implemented.” | Prevents version ambiguity |
| 2 | “Vendor shall list the V2G Root CA(s) in the charger’s factory trust store and confirm the mechanism (OCPP 2.0.1J InstallCertificate) for adding further roots.” | eMSP interoperability |
| 3 | “Vendor shall support OCPP 2.0.1J messages Authorize (eMAID), Get15118EVCertificate, SignCertificate, DeleteCertificate, InstallCertificate, and GetInstalledCertificateIds, with CSMS test logs supplied.” | Backend integration evidence |
| 4 | “Vendor shall supply conformance evidence: either (a) ISO 15118 conformance test report from an accredited lab, (b) CharIN testival report with declared conformance plan, or (c) signed path-to-conformance with completion date.” | Compliance substantiation |
| 5 | “For orders delivered after 2026-01-08 (public AC) or 2027-01-01 (public and private, AC and DC), vendor shall certify AFIR (Regulation (EU) 2023/1804) conformance in the market of delivery.” | EU regulatory compliance |
| 6 | “Vendor shall document the certificate installation flows supported (online CertificateInstallationReq / OEM OTA / offline), with EXI schema version.” | First-use driver experience |
11. References
| Reference A — Standards & regulations | Publisher | Edition / Date | Scope cited |
|---|---|---|---|
| ISO 15118-2 | ISO | 2014 | Vehicle-to-grid communication, unidirectional, TLS 1.2, single contract |
| ISO 15118-20 | ISO | 2022 | Second-generation protocol, bidirectional, TLS 1.3, WLAN, multi-contract |
| DIN SPEC 70121 | DIN | 2012-2014 | DC fast charging, no TLS, pre-ISO fallback path |
| IEC 63584 (OCPP 2.0.1) | IEC | Approved 2024 | Backend protocol with PnC message set |
| Regulation (EU) 2023/1804 — AFIR | European Union | Entered into force 2023-10-13 | ISO 15118-2 (2026-01-08) and -20 (2027-01-01) deadlines for public and private chargers |
| CharIN Plug & Charge Implementation Guide v1.2 | CharIN e.V. | 2022 | PKI model, certificate installation flows, OPCP |
| Reference B — HG Power sources | Document | Version / Date | Scope cited |
|---|---|---|---|
| HG Power 2026 Product Selection Manual (EN) | Galaxy / Stellar / Genesis / Aurora / Glacier / Deepsea / V2G sections | 2026-06-01 | Power ranges, ISO 15118 version per series, OCPP version |
| HG Power Company Profile (EN) | 2026-09 edition | 2026-09 | Manufacturing lines and certification baseline |
| HG Power Certification Register | CE 3N240131.SHN0W49 · TUV CB R 50695913 0001 · UKCA CN25G3TM 001 · Australia RCM RCMC26013005D · ETL 2408B2314SHA-001 · ENERGY STAR C2506171 | Active | Baseline cited in Brand Formula |
12. FAQ
What is ISO 15118 Plug & Charge in simple terms?
It is a feature that lets your EV authenticate and bill itself to a charging station over the charging cable, with no RFID card and no app. The vehicle presents a digital certificate issued by your charging contract provider; the charger verifies it against a trusted root; charging starts and the bill settles automatically.
Is ISO 15118 Plug & Charge the same as Autocharge?
No. Plug & Charge uses an X.509 contract certificate with cryptographic signatures — spoof-resistant and standardised. Autocharge uses the EV’s EVCC MAC address matched to a driver account in the CPO’s database — convenient but non-standardised and spoofable. Autocharge served as a bridge through the first half of the 2020s; AFIR effectively deprecates it from 2026 onward for new EU procurement.
What is the difference between ISO 15118-2 and ISO 15118-20?
-2 (2014) handles unidirectional PnC over TLS 1.2 and PLC with a single contract per session. -20 (2022) adds bidirectional energy transfer (V2G, V2H), mandatory TLS 1.3 with mutual authentication, PLC + WLAN transport, multiple contracts per session, wireless power transfer and automated connection devices. The two are not backward compatible — chargers aimed at both populations run dual-stack firmware.
Is ISO 15118 mandatory?
In the EU, yes, under AFIR (Regulation 2023/1804): new public AC chargers from 2026-01-08 must support ISO 15118-2, and new public and private chargers from 2027-01-01 must support ISO 15118-20. In the US, UK, Australia and most developed markets there is no identical hard mandate, but ISO 15118 is now a de facto procurement filter and NEVI-funded sites require it.
Which vehicles support Plug & Charge today?
Supported by many 2022-and-later EVs — commonly cited examples include Ford Mustang Mach-E, Lucid Air, Mercedes EQ range, Porsche Taycan, several Hyundai / Kia / Genesis models, and Audi e-tron; Tesla has moved toward PnC support in parallel with NACS rollout. OEM support widens with each model-year refresh — the CharIN member list and Hubject OPCP registry hold the current cross-reference.
What is the role of PKI in Plug & Charge?
The whole security model is PKI-based. A four-tier X.509 chain runs from a V2G Root CA (Hubject or Eonti) through OEM / eMSP / CPO Sub-CAs down to vehicle contract certificates and EVSE leaf certificates. Each party trusts the others only because the chain validates back to a mutually trusted root. Charger procurement must confirm which V2G Roots are in the factory trust store.
Does ISO 15118 enable V2G bidirectional charging?
Yes, but only ISO 15118-20. ISO 15118-2 defines unidirectional charging with early V2G control hooks; ISO 15118-20 adds first-class bidirectional messages for AC and DC bidirectional power transfer, dynamic grid-service control modes, and the mutual-authentication security needed to let utilities trust bidirectional energy transactions.
Will my OCPP 1.6 backend work with ISO 15118 Plug & Charge?
Not for standards-compliant PnC. OCPP 1.6 has no native messages for 15118 certificate exchange, EVSE leaf-cert renewal or trust-store management. Full PnC requires OCPP 2.0.1J (IEC 63584) at the backend; some vendors offer non-standard 1.6 extensions as a stopgap but these do not survive AFIR audits. See our OCPP 2.0.1 vs 1.6 procurement guide.
What conformance evidence should I ask for in an RFQ?
Either (a) a lab conformance test report from an accredited lab such as DEKRA, TÜV SÜD, TÜV Rheinland or Keysight; (b) a CharIN testival report plus declared conformance plan with timeline; or (c) a signed path-to-conformance commitment in the sales contract if the standard version is new. “ISO 15118 supported” without one of these is not procurement-grade.
Procuring Plug & Charge-ready hardware?
Send us your target market (EU AFIR, US NEVI, UK, AU), ISO 15118 version requirement (-2, -20, or dual-stack), target eMSP / V2G Root CA, and per-site power rating. We respond with cabinet selection (Galaxy / Stellar / Genesis / Aurora / Glacier / Deepsea / V2G), ISO 15118 + OCPP 2.0.1J version plan, conformance evidence package, and MOQ-indexed pricing within 24 hours (GMT+8 business days).
WhatsApp: +86 189 2467 8741 · Email: marketing@hjlcharger.com · Partner program: hongjialicharge.com/partner-with-hg-power
Reviewed by: Marvin Zhou, Head of International Marketing, Shenzhen Hongjiali New Energy Co., Ltd. · Last reviewed 2026-10-23 · References: ISO 15118-2:2014; ISO 15118-20:2022; DIN SPEC 70121; IEC 63584 (OCPP 2.0.1); Regulation (EU) 2023/1804 (AFIR); CharIN Plug & Charge Implementation Guide v1.2; HG Power 2026 Product Selection Manual and 2026-09 Company Profile.