Ride and battery data, off the manufacturer's app and into the rider's hands
Mid-drive and hub-motor e-bikes already log ride history, battery cycles and fault codes to a companion-app backend. The Data Act gives riders — and the independent repair shops they choose — a standing right to that same data, without needing manufacturer-specific diagnostic tools.
Ride and diagnostic data is the rider's. Assist tuning isn't.
EN 15194 defines what counts as an electrically power-assisted cycle (EPAC) under EU rules. Chapter II covers the operational data such a bike generates, not the proprietary logic that turns pedaling input into motor assist.
Usually in scope
- Ride history: distance, duration, route (where GPS-equipped)
- Battery state: charge cycles, state of health
- Motor-assist level and diagnostic/fault codes
- Maintenance and service events
Usually outside Chapter II
- The manufacturer's assist-tuning algorithm (torque-to-power mapping)
- Cross-rider aggregate analytics
- Firmware binaries and embedded control logic
- Data never captured or retained by the companion app
| Field group | Typical source | Delivery format |
|---|---|---|
| Ride history & distance | Motor controller / GPS module via app sync | Trip export, CSV/JSON or GPX for routes |
| Battery cycles & state of health | Battery management system (BMS) | Structured export per charge cycle |
| Motor-assist & fault codes | Motor controller diagnostic log | Structured export with code, timestamp and severity |
| Maintenance events | Dealer service record or app-logged event | Structured export linked to component |
The rider's right is live now
The Data Act has applied generally since 12 September 2025. The Article 3(1) by-design duty is separate and reaches bikes placed on the market after 12 September 2026.
Rider access-on-request
Provide an authenticated request path for ride, battery and diagnostic data already logged.
Rider-directed third-party sharing
Let a rider route their own bike data to an independent repair shop of their choice.
Pre-contract data transparency
Disclose what a new e-bike records and how it can be exported, before purchase.
Accessible by-design architecture
New companion-app platforms placed after 12 September 2026 should ship the access API built in.
From an app-locked feed to a rider-controlled export
The companion app already has the ride and battery data. The access layer decides whether that data stays trapped inside one app, or becomes something a rider can hand to any repair shop they trust.
Today: a closed loop
Product
E-bike / LEV
Backend
E-bike manufacturer app cloud
- Ride history & distance
- Battery cycles & state of health
- Motor-assist & fault codes
- Maintenance events
Only exit
Manufacturer's own app
- No user-facing export or API
- No route for the user to authorize a third party
- No permissions model, so every request is a one-off exception
- No audit trail if a user or regulator asks what was shared
With a Data Act access layer
Product
E-bike / LEV
Backend
E-bike manufacturer app cloud
- Ride history & distance
- Battery cycles & state of health
- Motor-assist & fault codes
- Maintenance events
New layer
Data Act access layer
- Field catalog
- User & device entitlements
- Consent & grant registry
Customer export & portal
CSV/JSON, self-service, same quality as the manufacturer sees
Third-party API (OAuth)
Purpose-bound grant to a repairer, analytics or energy provider
Audit & compliance log
Request, decision, recipient and delivery evidence for review
What we implement, concretely
A ride/battery/diagnostic data API, CSV/JSON export, third-party access for repair shops, and an audit layer.
| Capability | What it does |
|---|---|
| Ride & battery data API | Authenticated access to ride history, battery cycles and diagnostics per bike |
| CSV/JSON export | Self-service rider export sized for personal record-keeping or insurance claims |
| Third-party access for repair shops | Purpose-bound, revocable credentials for independent repair or warranty providers |
| Entitlement & audit layer | Rider/fleet-aware access control with a reviewable decision log |
Start with one bike platform and one repair partner
Prove the rider-export and third-party-sharing path on one motor/battery platform before extending it across your full model range.
Trace the companion-app pipeline
Map every field from motor controller and BMS through the app backend, and classify raw vs. derived.
Separate location data
Give GPS/route data its own minimization and retention rules, distinct from battery and motor diagnostics.
Design the rider API
Define catalog, request, third-party grant and delivery endpoints separate from the consumer app's internal API.
Build the decision engine
Turn catalog, entitlement and privacy checks into explainable allow, partial and refuse outcomes.
Ship export and sharing
Deliver a rider export and a repair-shop sharing flow with revocable, purpose-bound credentials.
Test the edge cases
Run through shared-fleet bikes, warranty disputes and disputed assist-tuning trade-secret claims.
E-bike Data Act FAQ
Does a shared or rental e-bike fleet work differently from a personally owned one?
The access relationship changes, not the underlying right. For an owned e-bike, the rider is the user under the Data Act. For a shared fleet, the operator running the bikes is typically the user for fleet-level maintenance data, while an individual rider's specific trip history carries its own GDPR considerations even though the operator, not the rider, usually holds the primary Data Act relationship with the manufacturer.
Can an independent repair shop get battery diagnostic data without going through the manufacturer's app?
Yes — that's a normal Article 5 third-party sharing request. The rider directs their battery cycle count, state-of-health and fault-code data to the repair shop of their choosing, and the shop uses it only for the agreed repair purpose. This is the practical alternative to a repair shop needing manufacturer-specific diagnostic hardware or app access it may not have.
Is GPS route history more sensitive than other e-bike data?
Yes. Route history can reveal home address, workplace and daily patterns, which makes it a stronger candidate for careful GDPR handling than battery or motor diagnostics. Treat location data as a distinct, higher-sensitivity field group in your catalog, with tighter minimization and retention defaults than device-health data.
Is the assist-tuning 'feel' of the bike a trade secret?
The algorithm that maps pedaling torque and cadence to motor assist level can be, through the Act's structured trade-secret process. The rider's own ride data — distance, assist level actually applied, battery draw — is not automatically covered just because it was produced by a proprietary system; the tuning logic and the resulting readings are different things.
Does sharing diagnostic data with a third party affect the warranty?
It shouldn't, as a matter of law — the Data Act doesn't let a manufacturer condition warranty coverage on refusing a rider's lawful data-sharing request. Warranty terms that discourage independent repair by threatening coverage over a Data Act-compliant data share sit awkwardly against the Act's purpose and are worth flagging in any warranty-language review.
Is firmware update history in scope?
The record of what updates were applied and when is reasonable product data a rider can request — it's operational history, similar to a maintenance log. The firmware binary and its internal logic are a different matter and sit outside Chapter II the same way other embedded control software does.
Primary sources and status
Reviewed 9 September 2026. The Data Act and GDPR are binding EU regulations. The Commission explainer is non-binding implementation guidance. EN 15194 is cited as technical context, not as a legal source. Yarify's API contract, entitlement model and delivery sequence are engineering recommendations, not legal advice.
- Regulation (EU) 2023/2854 — the EU Data ActBinding legal text covering connected-product data access, third-party sharing, fair terms and transitional dates
- Regulation (EU) 2016/679 — the General Data Protection RegulationBinding data-protection rules covering ride and route history tied to an identifiable rider
- European Commission — Data Act explainedNon-binding overview of in-scope IoT data, user and third-party flows, and safeguards