A Floor Set at Three Layers, and Standards That Have Already Moved Past It
The rule sets its floor at three layers. Between vehicle and charger, chargers must conform to ISO 15118-3 and carry hardware capable of implementing both ISO 15118-2 and ISO 15118-20, with conformance testing following ISO 15118-4 and ISO 15118-5. Between the charger and the network, the Open Charge Point Protocol applies, with OCPP 1.6J as the entry level and OCPP 2.0.1 as the required level. Between networks, the Open Charge Point Interface governs roaming so that a driver can use a single method of identification across networks. Section 680.108 further requires chargers to switch network providers securely without hardware changes, and Section 680.114 requires remote monitoring, diagnostics, smart charge management, and secure reporting of energy dispensed, real-time port status, and historical port uptime.
The standards themselves have advanced since those dates were fixed. The Open Charge Alliance, the non-profit that develops and certifies the protocol, released OCPP 2.1 in 2025, adding alignment with ISO 15118-20, support for bidirectional charging, and deeper integration of distributed energy resources; both OCPP 2.0.1 and OCPP 2.1 have been approved as International Electrotechnical Commission standards in the IEC 63584 series. Buyers now face a question the federal rule does not answer: whether to specify the mandated level or a level that will continue to support managed and bidirectional charging throughout the equipment’s asset life.
From Protocol Conformance to a Working Chain of Trust
Protocol conformance alone has never been sufficient for Plug and Charge, because automatic authentication depends on a chain of certificates that both the vehicle and the network trust. SAE Industry Technologies Consortia and its Electric Vehicle Public Key Infrastructure Consortium have developed a common framework built around a Certificate Trust List, allowing vehicles, chargers and networks previously locked into proprietary authentication arrangements to authenticate against a shared root of trust. The commercial value of this initiative lies in two areas: it expands Plug and Charge from a proprietary network function into a market-wide capability, and it establishes the underlying certificate framework essential for securing bidirectional charging and utility-driven load management.
In urban portfolios, the practical stakes are reliability and switching cost. A curbside post or multi-family garage charger that cannot be diagnosed remotely generates truck rolls that quietly destroy site economics, and a software stack that cannot be changed without replacing hardware leaves property owners and municipal authorities captive at contract renewal. Cybersecurity obligations are built on the same foundation, with remote software updates, encryption, and authentication specified alongside the interoperability requirements rather than treated separately. Fleet operators and transit agencies running depot and public charging within one operation need roaming and settlement that reconcile cleanly across both, and investors underwriting portfolios increasingly treat protocol version and certificate readiness as diligence items rather than technical detail.
Urban EV Charging USA 2027 significantly emphasizes the software ecosystem, including protocol versioning, certificate trust frameworks, roaming settlement, uptime tracking, and associated cybersecurity requirements. This unites network software providers, site hosts, operators, and public agencies working to implement these solutions on the ground.
