eCoC Explained: The UK's Switch to Electronic Certificates of Conformity on 5 July 2026

From 5 July 2026, the paper Certificate of Conformity is finished for most UK vehicle manufacturers. If you build, convert or complete M, N or O category vehicles under a GB or UKNI type approval, every vehicle you manufacture from that date needs its CoC lodged with the Vehicle Certification Agency (VCA) as a digitally signed XML file. Submitted electronically and checked against an official schema, then stored on a government database that anyone will eventually be able to search by VIN.

That's a big change to be buried in a technical update, and the detail only landed recently. The VCA published its API guidance and an updated schema file at the end of May 2026, and its developer test environment opened on 27 May. So if this is the first you're properly hearing about it, you're not behind. The whole industry is working inside the same narrow window.

Here's how the new system works and what to do about it.

What's actually changing

The Certificate of Conformity is the document a manufacturer issues with each vehicle to confirm it was built in conformity with an approved type. It's what allows a new vehicle to be registered and put on the road. Until now it's been a piece of paper, printed and handed over with the vehicle.

From 5 July 2026 that flips. Under assimilated Regulation (EU) 2018/858, manufacturers must make the CoC for newly manufactured vehicles available to the VCA as structured electronic data. The VCA is building a digital service to receive it: a database to hold the records, a web portal where manufacturers can upload files by hand, and an API so production systems can submit automatically. A second phase adds a public webpage where anyone can look up a vehicle's eCoC using the VIN and download the original XML. Two details are worth pinning down straight away, because they answer the questions everyone asks first.

There's no back-fill. Vehicles manufactured before 5 July 2026 don't need an eCoC, even if they aren't registered until after that date. Those vehicles still need paper CoCs, exactly as they always have.

And paper doesn't vanish overnight. Pre-deadline vehicles keep their paper certificates, and the VCA can request a duplicate paper CoC in exceptional cases even for a vehicle covered by an electronic submission. But for in-scope vehicles built from 5 July onwards, the eCoC submission replaces the paper document. No printing required.

Who's in scope (and who isn't)

The requirement covers vehicles in categories M, N and O approved under either the GB or UKNI type approval schemes. That's passenger vehicles and goods vehicles, plus trailers. Crucially, it includes the medium series and national small series variants of those schemes, so this isn't a problem reserved for the volume OEMs. Bodybuilders and converters holding their own whole vehicle approvals are squarely in scope, and so are trailer manufacturers, including multistage builders completing someone else's chassis. Categories L, T, C, R and S (motorcycles and agricultural kit, broadly) are out for now. If that's you, keep issuing paper CoCs until the VCA says otherwise.

One caveat for the smallest manufacturers: the Department for Transport is reviewing a possible exemption for vehicles approved under national small series. Nothing has been decided. Until it is, NSSTA holders should assume they're in scope like everyone else, because right now they are.

The dates that matter (and the delay rumour)

Four dates to put in the diary:

1. 27 May 2026: the VCA's test API environment opened. Developers can request access now and start submitting test files.
2. Second half of June 2026: the live service launches, covering the eCoC portal and the production API.
3. 5 July 2026: the legal requirement begins. Newly manufactured in-scope vehicles must be covered by an eCoC submission from this date.
4. July 2026: target for the public VIN lookup service.

Now the delay question, because you'll hear about it. There's an EU proposal to push mandatory eCoC implementation back to the end of November 2026, and the VCA and DfT are aware of it. The DfT is considering whether it changes anything for the UK. As of today, no decision has been made.

It's also true that the VCA's own delivery dates have moved. Phase 1 started life with an end of March 2026 target and is now landing in the second half of June, so a bit of scepticism about timelines is fair enough.

Our advice is still blunt: plan for 5 July. A proposal under consideration is not a delay, and the cost of being ready early is a few weeks of comfortable testing. The cost of betting on a postponement that never comes is vehicles you can't register. If the date does slip to November, you've gained free contingency. That's the right way round to be wrong.

What you actually get out of it

It's not all stick. A certificate that exists as data can't be lost in the post, locked in a filing cabinet at the wrong depot, or mistyped at the registration desk. Once the public lookup is live, a dealer, buyer or insurer can pull a vehicle's certified data straight from the VIN instead of chasing paperwork. And the VCA is already talking to the DVLA and DVSA about future information sharing, which points towards certificate data eventually flowing into registration and enforcement processes by itself.

For manufacturers who get the plumbing right, the day-to-day result is less admin, not more. The same action that produces a certificate today will quietly generate, sign, submit and confirm one tomorrow.

The new file: what a UK eCoC actually is

The UK eCoC is an XML file based on a format called Initial Vehicle Information (IVI) 2.0, which was developed for the EU's eCoC system. The VCA has taken the EU structure wholesale and added UK-specific options, so the UK file follows the same layout and carries all the same content as its EU counterpart.

Inside, the file has a header section (a reference ID for the submission, schema version details, the intended country of registration and the approval country) followed by the certificate data itself: the vehicle's type, variant and version identifiers, the type approval number and its issue date, the VIN, and then the rest of the technical data that used to live on the paper certificate, all as individually structured fields.

One thing the VCA says plainly, and it matters more than it sounds: the structure and content of UK eCoCs differs from what GB type approval legislation prescribes for paper CoCs. The electronic file is not a digitised photocopy of your current certificate. Fields are organised differently, some values must come from restricted lists rather than free text, and the mapping from "what we print today" to "what the schema wants" is where the real work in any eCoC project lives.

The VCA publishes the UK XML Schema Definition (XSD) and a version control document on its eCoC page. Because the UK schema is adapted from the EU one, the EU guidance documents (EUCARIS publishes a "messagebook" and an "IVI setup manual") remain relevant reading alongside the UK material. If you're briefing a developer, those documents plus the UK XSD are the starting pack.

The UK twists on the EU format

The first release of the UK IVI template keeps the changes minimal. The UK-specific elements are extra options in fields that have restricted lists:

1. Approval authority codes: 'g11' and 'n11' join the existing list of e-style codes, identifying GB and UKNI approvals.
2. Scheme codes: new options cover the UK approval routes, namely 'GB' (GB unlimited series), 'GBMED' (GB medium series), 'GBNSS' (GB national small series), 'UKNI' (UKNI unlimited series), 'UKNIESS' (UKNI European small series) and 'UKNINSS' (UKNI national small series).
3. Eco-innovation code '99': added for a GB-approved eco-innovation that doesn't appear on the EU list. Other GB eco-innovations use the same codes as their EU equivalents.

Because the UK kept the EU structure, a few field names look odd in a UK context, and the VCA has issued guidance on filling them. The "EU representative" fields should hold the relevant GB-based representative for GB approvals (or the EU or NI based representative for UKNI approvals). The country code field already includes 'UK' as an option, and that's what UK eCoCs should use. The language code should be 'en'.

None of this is difficult. It's exactly the kind of detail that gets a file rejected when nobody reads the guidance, though.

Digital signatures aren't optional

Every UK eCoC must carry a digital signature, applied using the same method as EU eCoC files. The VCA is explicit about the consequence: unsigned files fail validation and are rejected at the upload stage.

Be clear about what this means, because the word "signature" misleads people. This is a cryptographic XML signature applied to the file itself, the kind a developer builds into the file generation step. It is nothing like pasting a scanned signature into a PDF. If your team hasn't dealt with signed XML before, flag it early. It's a solved problem with standard tooling, but it's the part of the build most likely to trip up a developer who treats this as a simple export job.

Two ways to submit

The VCA gives manufacturers two routes into the system.

The first is manual: log into the new VCA eCoC Portal and upload files by hand. The second is an API, meaning your own system talks directly to the VCA's system and submits files automatically, with no human in the loop.

Both routes are open to everyone, and the VCA leaves the choice to you. Its own steer is that the portal suits small volume manufacturers and the API suits high volume ones, which matches common sense. Ours is a bit firmer: if you're producing more than a handful of vehicles a week, build the API route. Manual uploads are fine for the occasional vehicle. As a routine process they eat someone's time every single day, and every manual step is a chance to upload the wrong file against the wrong VIN.

Either way you need a VCA account. If you already have one for the VCA's Type Approval Portal, the same account will get you into the eCoC Portal when it launches, and you'll be able to add extra users and manage their permissions from there. That last point matters if a software partner handles submissions for you, because you can give them access without handing over your own credentials.

Once a file arrives, the VCA validates it against the UK schema to confirm the format is correct, and you get feedback on any errors so the file can be corrected and resubmitted.

How the API works, in plain English

You don't need to be a developer to follow this, and it's worth understanding even if someone else builds it, because it shapes what your internal process looks like.

Your system authenticates first. The VCA's API uses a standard approach (OAuth 2.0 client credentials, for the technically minded) where your organisation is issued an ID and a secret, and your system exchanges them for an access token. The credentials are issued against your registered manufacturer account, which ties every submission to your organisation.

Your system then posts the signed XML file to the VCA's submission endpoint, along with identification headers. If the file is accepted, the VCA responds with an acknowledgement and a correlation ID, which is essentially a tracking number for that submission. There's a payload limit of 1MB per file, which is generous for an XML certificate.

Acceptance isn't the end. Processing happens asynchronously in the background, so your system checks back using the correlation ID and watches the submission move through a set of statuses: Received, then Processing, then either Succeeded or Failed. A failed submission gets corrected and goes back in as a fresh submission.

The API is also specific about failure modes, which is genuinely helpful. A file that's structurally valid XML but breaks the content rules comes back with field-level error details, so you know exactly what to fix. Duplicate submissions are rejected as conflicts rather than silently creating two records. And if your system sends too many requests too quickly, the service throttles it and expects sensible back-off and retry behaviour rather than hammering away.

For testing, the VCA opened a dedicated pre-production environment on 27 May 2026. Access tokens are requested by emailing ecocdataenquiries@vca.gov.uk with the subject line "Test API Token Request". Two quirks to know: the token is single-use, and the VCA asks that only the developer who'll actually be doing the work opens it. So have your developer or software partner lined up before you ask for it. The live API arrives alongside the portal in the second half of June.

If your production volume justifies the API, the sensible sequence is to get the test token now and prove a signed file can reach "Succeeded" in pre-production, so the live launch becomes a formality.

Multistage builds: who submits what

Plenty of in-scope manufacturers don't build vehicles from scratch. They complete them. A chassis arrives from a base manufacturer, a body or conversion goes on, and a completed vehicle leaves with its own approval. eCoC has rules for this.

The VCA strongly encourages manufacturers to share eCoC data with subsequent stage manufacturers, in line with the information sharing obligations that already exist in Regulation 2018/858. In other words, the base manufacturer should hand its eCoC down the chain, the same way base vehicle documentation flows today. Where that doesn't happen there's a safety net: once the public lookup service is live, the previous stage's eCoC will be retrievable from the public portal by VIN.

One wrinkle for early July, though. That public lookup is Phase 2, targeted for July rather than guaranteed for the 5th. If you'll be completing vehicles in the first weeks of the mandate, don't lean on a fallback that may not be live yet. Agree direct data sharing with your base manufacturers now, while everyone's setting their processes up anyway.

If the base vehicle in your multistage build carries an EU approval, that's the one situation where the VCA wants a copy of an EU eCoC. For dual-marked vehicles, only the GB eCoC needs to be provided.

One structural point worth knowing: the UK system is completely separate from the EU's. It has no link to EUCARIS and doesn't function as an EU National Access Point, so nothing you send the VCA flows into the EU system. If you place vehicles on the market in Northern Ireland or the EU under an EU approval, those eCoC records go to the relevant EU type approval authority, not to the VCA.

The questions everyone asks

Do we need to submit eCoCs for stock built before 5 July? No. There's no legal requirement to submit an eCoC for any vehicle manufactured before that date, even if it isn't registered until afterwards. Pre-deadline vehicles need paper CoCs as normal.

Can we still hand the customer a paper certificate? For in-scope vehicles built from 5 July, the eCoC submission is what the law requires and no paper CoC is needed. Nothing stops you printing a courtesy copy for the handover pack if customers expect one, but the electronic submission is the document that counts.

Does our type approval documentation need updating? No. The existing sample paper CoC in your whole vehicle documentation can stay as the primary reference. The VCA confirms no extension or revision is required as a consequence of moving to eCoCs.

Who can see the data? Once Phase 2 is live, anyone. The public service will let any user look up a vehicle's eCoC data by VIN and download the original XML. Worth knowing before you assume certificate data stays private.

What happens if we just don't do it? This is the one to take seriously. Providing CoCs, in whichever format applies, is a condition of holding whole vehicle type approval. Fail to supply them and the approval itself could be withdrawn, which means new vehicles can't be registered or placed on the market. This isn't a fine-and-move-on compliance item. It's the licence to sell what you build.

What building this looks like inside your business

The VCA provides no software for creating eCoC files and doesn't mandate any product. Generating valid, signed XML is entirely the manufacturer's problem, or their software partner's. There's a manual input tool on the EU's EUCARIS site that can generate an EU-format file, which you'd then edit to reflect UK values, but hand-editing XML per vehicle is nobody's idea of a production process. For anything beyond occasional volumes, this needs building into your systems properly.

In practice an eCoC project has five parts, and knowing them helps you scope the work whether you build in-house or bring in a custom software team to do it for you.

A data audit comes first. Your certificate data already lives somewhere: a production database, a vehicle records system, or sometimes a spreadsheet that's grown unsupervised for a decade. The question is whether it holds everything the UK schema demands, in the form the schema demands it. Fields your current process handles as free text may need to come from the schema's restricted code lists. Fields your paper layout never included may need capturing for the first time. Finding those gaps in week one is cheap. Finding them on 6 July is not. And if the honest answer is that the data lives in a creaking spreadsheet, this is the natural moment to replace it with proper software rather than bolting a legal obligation onto something that's already fragile.

Then the mapping and generation layer. Each vehicle's data gets mapped into the IVI 2.0 structure, UK codes included, and written out as XML.

Then local validation. Files should be checked against the published UK XSD on your own side, before submission. Errors caught locally cost nothing and take seconds. Errors caught in the VCA's queue cost a round trip per attempt.

Then signing and submission. The cryptographic signature gets applied and the file goes to the VCA through the API, with sensible retry behaviour built in for the days when networks misbehave.

Finally, the ledger. Every submission should be tracked against its VIN: the correlation ID, the status history, the final outcome, and a record you can show an auditor or the VCA later. Failed submissions need a queue and a process, not a panicked email thread. Done well, the operator's experience is boring. The same button that produces a certificate today quietly produces, signs, submits and confirms one tomorrow.

How long does all that take? Less than you might fear. For a manufacturer whose vehicle data already sits in a system, this is days of focused development work, not months. The hard part isn't the VCA's side, which is well documented. It's fitting the new module cleanly into whatever you already run, and that's ordinary work for anyone who builds bespoke integrations for a living.

What to do this week

A realistic plan fits in the four weeks left, but only if it starts now: spend the first week on scope, access and the data audit, the second on mapping and generation against the schema, the third on signing and pre-production submissions until you see "Succeeded", and the last on the tracking ledger and a parallel run alongside your paper process. Compressed, certainly. Comfortable enough, if week one is this week. So, this week:

1. Confirm you're in scope. M, N or O category, GB or UKNI approval, including medium and small series? You're in.
2. Dig out your VCA Type Approval Portal account. It's your route into the eCoC Portal at launch, and where you'll add users for whoever handles submissions.
3. Request a test API token (if you're taking the API route) by emailing ecocdataenquiries@vca.gov.uk with the subject "Test API Token Request". Line up the developer first, because the token is single-use and meant for their eyes only.
4. Download the technical pack from the VCA's eCoC page: the UK XSD and version control document, plus the API guidance. Add the EUCARIS messagebook and IVI setup manual for the EU background.
5. Run the data audit. Compare what your systems hold against what the schema requires, and write down every gap.
6. Decide who's building it. In-house, or with a partner who's already across the documentation.

Do those six things and you've turned a vague compliance worry into a project with a scope and a deadline. That's most of the battle.

The short version

From 5 July 2026, newly built M, N and O category vehicles under GB and UKNI approvals need a digitally signed XML eCoC submitted to the VCA instead of a paper certificate. The test environment is open now, the live service lands in the second half of June, and the mooted delay to November remains nothing more than a proposal. The file format and the API are both published and documented, and the work is well within reach of any competent development team, provided it starts now rather than in the last week of June.

We've been through every line of the VCA's documentation and we build exactly this kind of integration for manufacturers who'd rather hand the whole thing over. If that's you, talk to us before July does the deciding for you.

Useful Links

• VCA eCoC page — https://www.vehicle-certification-agency.gov.uk/electronic-certificates-of-conformity-ecocs/ — the canonical hub; its Publications section holds the UK IVI XSD, version control document and API guide. Link this page rather than the deep download URLs: the XSD sits behind a ShareFile link that can rotate, and the uploads-path files get replaced when the page updates.
• EU eCoC system (EUCARIS) — https://ecoc.eucaris.net/ — where the VCA points readers for the messagebook and IVI setup manual, plus the manual file-generation tool.
• Assimilated Regulation (EU) 2018/858 — https://www.legislation.gov.uk/eur/2018/858 — the UK version on legislation.gov.uk, kept up to date with amendments made by the UK since EU exit, which is the right one to cite for a UK audience (not EUR-Lex).