Demystifying ISO 15118: How “Plug & Charge” Technology is Revolutionizing the B2B Charging Experience

Technical Deep Dive | ISO 15118 & Plug & Charge | Updated September 2026

What ISO 15118 Actually Is

The name is routinely used as shorthand for “Plug & Charge,” but the standard is broader. ISO 15118 “Road vehicles — Vehicle to grid communication interface” defines how the EV and the EVSE exchange data to negotiate charging parameters, identify each other, and — in newer parts — manage bidirectional energy flow. The communication physically rides on the same control-pilot conductor that carries the safety signal, using powerline communication (PLC, per part 3) so no separate data connection is needed. The family divides into several parts, and knowing which is which prevents expensive specification mistakes.

Part 2 (15118-2) is the legacy workhorse: it defines session setup, charge parameter discovery, and the certificate-based identification that enables Plug & Charge on CCS connectors, using the older TLS 1.2 and the original security profile. Part 20 (15118-20) is the modern replacement, ratified for production from 2022 onward: it strengthens cryptography (TLS 1.3, modern ECC), adds support for bidirectional power transfer (V2G), and extends the data model to megawatt-class charging and wireless. Part 3 specifies the PLC transport; part 8 extends the same session logic to wireless inductive charging. A practical rule: existing vehicles and chargers speak -2; new infrastructure should ship -20 and maintain backward compatibility with -2, because the installed vehicle base will speak -2 for years.

Plug & Charge: How the Digital Handshake Replaces Payment

The magic — and the complexity — of Plug & Charge is that payment authorization happens without any human action or external device. The chain works like this. Before a session, a certificate authority issues a signed contract certificate to each vehicle (or to a fleet’s pool of vehicles), bound to the vehicle’s identity and to a charging contract. When the driver plugs in, the EVSE and vehicle establish the 15118 session; the vehicle presents its contract certificate; the station forwards it to the charge point management system (CSMS), which validates the certificate against its PKI, checks the contract, and authorizes power. The entire exchange takes milliseconds, and the session, metering data, and certificate ID are stored together for billing and audit.

Three roles keep the system trustworthy. The certificate authority (CA) signs and manages the certificates. The contract holder — the OEM, the fleet operator, or a mobility service provider — provisions certificates onto vehicles and owns the charging contract. The charge point operator (CPO) runs the stations and the CSMS that validates certificates. The trust model is the same one that secures HTTPS: public-key cryptography with certificate chains, revocation lists, and hardware-backed storage. That is why security upgrades between -2 and -20 matter: the certificate infrastructure is the payment rail, and its integrity is the business’s integrity.

The B2B Value Proposition: What Operators Actually Gain

For fleets, Plug & Charge collapses the charging workflow into one motion: pull in, plug in, walk away. There is no driver card to manage, no app account to provision, no RFID tag to lose, and no risk of a driver charging a personal vehicle on the company account — the certificate binds the session to the vehicle, not the person. Fleet management systems receive per-vehicle energy and cost data directly from the CSMS, turning charging from a reimbursement headache into an automated cost-allocation feed.

For network operators, the gains are operational and financial. Unattended sites currently fail at the payment layer more often than at the power layer: card readers freeze, NFC modules die, apps break on phone OS updates. Plug & Charge removes the entire payment-terminal subsystem from the reliability chain. Roaming also simplifies: with standardized certificates, a vehicle from one network can authenticate and charge on another network’s station through the same trust framework — the digital equivalent of the fuel-card acceptance network, without the plastic.

The hardware ecosystem already supports the transition. Stations such as commercial-grade 80kW dual-gun wallbox DC fast chargers with a 150–1000V range and APP-monitored high-power 80kW dual-gun wallbox DC fast charging stations ship with the controllers and network integration that a certificate-enabled CSMS needs; the Plug & Charge capability arrives with the firmware and the CSMS configuration, not with a hardware swap. Operators who want a parallel access path for legacy vehicles can pair 15118 with RFID-controlled commercial DC fast charging stations so that older EVs still charge through card or tag while newer vehicles ride the certificate rail.

RFID/App Access vs. Plug & Charge

The table makes the fleet decision obvious: RFID and app flows are human-mediated and therefore slow, error-prone, and audit-weak; Plug & Charge is machine-mediated and therefore fast, repeatable, and auditable. The pragmatic reality is coexistence — the transition will last years because the installed vehicle base is heterogeneous. The correct station design accepts both rails: 15118 for the modern fleet, RFID or app as fallback, with the CSMS merging both into one billing record.

What It Takes to Deploy Plug & Charge in 2026

Deployment decomposes into four workstreams, and the order matters. First, the PKI: an operator needs certificate provisioning for its vehicles — either through an OEM’s Plug & Charge program, a third-party mobility provider, or a private PKI for closed fleets. Fleet operators with telematics in place often find the private-PKI route fastest, because they control both the vehicles and the stations. Second, the CSMS: the charge point management platform must support certificate validation, revocation handling, and 15118 session records; this is a software capability that must be verified in the contract, not assumed. Third, the stations: chargers need 15118-capable controllers and firmware aligned with the chosen standard version, and the OCPP data model must expose the certificate-related session events. Fourth, the vehicles: the fleet’s trucks must have contract certificates installed and the 15118 stack enabled — a vehicle-side activation that OEMs roll out progressively.

For hardware procurement, the specification is short and decisive: “ISO 15118-20 compliant with backward compatibility to 15118-2, certificate-based Plug & Charge, and OCPP 2.0.1 data-model support.” Station controllers that meet this today include the modern dual-gun platforms used across commercial deployments, such as CCS2/GBT Type 2 dual-gun wall-mounted DC fast charging stations and mini dual-gun DC fast charging stations with OCPP and IP55 outdoor ratings. The key is to buy stations whose firmware and controllers can be upgraded to 15118-20 as certificate infrastructure matures, and to hold the vendor to a written firmware-upgrade commitment — the hardware is the long-lived asset, the standard is the moving target.

ISO 15118-20 and the Road Ahead

The -20 generation matters for more than security. It is the standard on which bidirectional charging (V2G) and bidirectional power control are built: a 15118-20 session can negotiate not only how much power flows to the vehicle but how much flows back to the site or grid, with the metering and safety semantics to make it a commercial transaction rather than a science project. For B2B fleets, that unlocks the depot as a grid asset — batteries that charge overnight and discharge during peak windows, under the same certificate-based identity and billing framework. It also extends cleanly to megawatt charging, because the -20 data model handles the higher voltage and current ranges of MCS. Operators who standardize on -20 today are buying the foundation for V2G, MCS, and whatever the next charging business model turns out to be, without re-platforming their stations.

A 2026 Procurement Checklist

• Specify ISO 15118-20 with -2 backward compatibility in every charger tender, plus a written firmware-upgrade commitment for future standard revisions.
• Verify OCPP 2.0.1 support with 15118 session data in the CSMS data model; OCPP 1.6J carries the load today but was not designed for certificate events.
• Decide the certificate model early: OEM program, mobility provider, or private fleet PKI — each changes the vehicle-provisioning workstream.
• Contract CSMS certificate capabilities: validation, revocation lists, and audit logging of Plug & Charge sessions.
• Keep RFID or app as fallback during the transition; the installed vehicle base will not be certificate-capable for years.
• Plan fleet telematics integration so per-vehicle energy and cost flow from the CSMS into the TMS without manual steps.
• Test with a real certificate-capable vehicle before site cutover; handshake issues surface at the protocol layer, not in the brochure.

Frequently Asked Questions

Q1. Is Plug & Charge the same as ISO 15118?

No. ISO 15118 is the full vehicle-to-grid communication standard family; Plug & Charge is the certificate-based authorization feature implemented through parts 2 and 20. A charger can be 15118-compliant for charging negotiation without enabling Plug & Charge billing.

Q2. What is the difference between ISO 15118-2 and ISO 15118-20?

Part 2 is the legacy generation (TLS 1.2, one-way charging). Part 20 is the modern one: stronger cryptography, bidirectional power (V2G), megawatt-class data model, and wireless-charging extensions. New equipment should ship -20 with -2 fallback.

Q3. Do I need new hardware for Plug & Charge?

Often not. Many current chargers already have 15118-capable controllers; the capability activates through firmware and CSMS software. The requirement to verify is the vendor’s firmware-upgrade commitment and the CSMS’s certificate support.

Q4. How does billing work for a fleet with Plug & Charge?

Each session is bound to the vehicle’s contract certificate, so the CSMS produces per-vehicle energy and cost records automatically. Fleet managers import those records into the TMS for cost allocation — no driver input, no expense reports.

Q5. What happens if a certificate expires or is revoked?

The CSMS rejects the session at validation time, exactly like a declined card. The operator or OEM provisions a new certificate; revocation lists propagate through the PKI so a stolen or compromised vehicle identity stops working network-wide.

Q6. Can Plug & Charge work offline?

Partially. The standard defines controlled offline behavior in some configurations, but full validation and roaming require the CSMS to reach the PKI. For critical sites, plan the network link as part of the payment rail, not as a convenience.

Q7. When should a B2B operator switch from RFID to Plug & Charge?

When a meaningful share of the fleet is certificate-capable and the CSMS supports validation. Most operators run both in parallel for years — RFID for legacy vehicles, Plug & Charge for the modern fleet — and migrate as the vehicle base turns over.