Trends and developments in vehicle access control

For most of the last decade the decision at the gate barely moved. You chose between a card at close range and a long-range tag, and the rest was installation work. That has changed, and the interesting part is where the change comes from. Not from the security department, but from European regulation, from the phone in the driver’s pocket, from the radio spectrum, and from building rules about charging cars. Six developments below, with what is settled and what is not.

Six developments that change how you specify a gate

• access control readers are named in EU product legislation, with dated obligations
• phone based access has one standard, and the perimeter was not designed into it
• passive UHF caught up on read range, so the choice turned into a security question
• plate recognition moved onto the camera and works best as a second factor
• charging points and yard check-in put new demands on the same entrance
• the driving licence itself is becoming a digital credential

Regulation reached the reader itself

The EU Cyber Resilience Act lists access control readers by name as important products, which puts them in a stricter conformity class than an ordinary connected device. Reporting duties for actively exploited vulnerabilities started on 11 September 2026, and the main obligations apply from 11 December 2027: a vulnerability handling process, a machine-readable software bill of materials, secure settings out of the box, and free security updates over a support period of normally at least five years.

On the user side, the Dutch implementation of NIS2 has been in force since 15 August 2026 and puts a risk analysis duty and a 24 hour incident reporting duty on more than 8.000 organisations. Two consequences at the gate. Firmware support becomes a purchasing criterion rather than a favour, and the cable between reader and controller has to be encrypted and supervised, which is what OSDP secure channel does. That protocol is stable at version 2.2.2, and the movement is in certification: the Security Industry Association passed 200 verified products in 2026 and opened up its Transparent Mode configuration in March of that year.

Phone based access finally has one standard, and the gate is not in it

In February 2026 the Connectivity Standards Alliance published Aliro 1.0, a standard for phone and card based access with a certification programme behind it, aligned with Apple, Google and Samsung. It covers NFC for tap, Bluetooth LE for user initiated long range, and Bluetooth LE with UWB for hands-free authentication. Those last two describe exactly the distances a barrier needs, and until now every supplier had its own Bluetooth implementation. The catch is that the Aliro documentation is written around doors and locks, says nothing about the reader to controller side, and mentions the outdoors only as an offline example.

So the standard is here and the perimeter has not been designed into it yet. One more thing worth knowing before anyone promises a phone at the barrier: a credential in Apple Wallet or Google Wallet is a tap credential, so at a gate it still means a window comes down. What does work at range is covered in our insight on mobile identification at the perimeter. In surveys of access control buyers, the large majority keep physical credentials alongside mobile ones, and at a gate that is likely to stay true for a while.

Passive UHF closed the range gap, so the question became security

Read range used to settle this argument. It no longer does. Passive UHF reaches up to 15 m with uPASS Target and up to 18 m with a heavy duty tag, while semi-active microwave reaches up to 20 m with a heavy duty ISO tag. Once the distances converge, what decides is tag security and whether the driver has to be identified as well. That is where the standards moved. An EPC number can be read by anyone and written into a blank tag, which is why tag authentication with AES matters, and the AES-128 crypto suite for RFID air interfaces was published in a third edition in March 2026.

Spectrum matters too, and here Europe is split. A harmonised upper UHF band at 915 to 921 MHz allows 4 W instead of the 2 W in the 865 to 868 MHz band, which is worth a meaningful amount of extra range. Most CEPT countries have adopted it, while the Netherlands, Germany and Greece have not, because that band is in military use. The same gate design has more margin in Antwerp than in Rotterdam.

Plate recognition moved onto the camera and became a second factor

Plate recognition now runs on the camera itself, so there is no separate recognition server behind it, and vehicle type, make, model and colour can be read alongside the plate. That makes a plausibility check possible at the gate: does this plate belong to the vehicle standing in front of it. The physical limits have not gone anywhere, because heavy rain, snow, fog, mud and a damaged plate all reduce accuracy. And there is a sobering number from the public side.

The Dutch data protection authority calculated in April 2026 that around 10% of parking fines issued by scan cars are wrong, and that 40 to 62% of objections succeed. That is road enforcement rather than site access, but the lesson transfers: an automated read without context or a second factor produces wrong decisions. Plate plus tag, not plate instead of tag.

The gate is no longer only about access

Two developments outside security are reshaping the entrance. The revised Energy Performance of Buildings Directive had to be transposed by 29 May 2026 and pushes charging points onto company car parks, with existing non-residential buildings above twenty parking spaces following from 1 January 2027. Every charging point raises the question the gate already raises: who is this, and on whose account. In logistics the pressure sits on check-in instead.

Gartner’s 2025 market guide for yard management lists plate recognition and driver self-service check-in as standard capabilities and reports rising interest in speeding that process up. Meanwhile parking operators run thousands of barrier-free sites on cloud based plate recognition, and hospitals have started taking their barriers out altogether. In all three cases the load comes from visiting vehicles, not from the fixed fleet.

From a rack of readers to one vehicle management controller

Most perimeters end up mixed. A plate camera on the visitor lane, long-range readers on the truck gate, a card reader at the staff entrance, sensors on the barriers. Each addition brought its own controller, wiring and configuration screen, and the result works but cannot be handed over to a colleague. Purpose built vehicle management controllers gather those reader and sensor inputs, drive the gates, barriers and bollards, and connect once to the access control or parking management system. Fewer boxes, and one place to look when a lane misbehaves.

Looking further ahead: the licence joins the credential

One shift is close enough to plan for and far enough away to prepare calmly. The revised EU driving licence directive was published in November 2025 and makes a digital licence, valid across the EU and held in a digital identity wallet, the intended format by 2030, while member states have to offer those wallets from December 2026. That is the first time “may this person drive” and “may this vehicle enter” can sit on the same credential. For sites with contractors, hired equipment and heavy goods traffic, that is a different question from the one a tag answers today. There are no documented deployments at gates yet, so treat it as a direction with a deadline attached rather than something to specify this year.

Five questions to put to a supplier this year

None of the above changes what a gate has to do, but all of it changes what you should ask before buying one. How long is the security update support period for this reader and this controller, and is that in writing? Is the link between reader and controller encrypted and supervised, or is it still one-way Wiegand? Does the tag authenticate itself cryptographically, or does it simply hand over a number anyone could copy? If plate recognition carries decisions with consequences, what is the second factor behind it? And can one credential serve the gate, the door and the charging point, so you administer people once instead of three times? If you would rather work through that with a shortlist in front of you, our product advisor asks these questions and comes back with options.

Choosing between the technologies

This article is about what changed. If the question is which technology belongs on your gate in the first place, our comparison of vehicle access control technologies sets prox, semi-active microwave, passive UHF and plate recognition side by side on read range, security, cost and typical use. For the solutions built on them, start at our vehicle access control pages, or take the brochure with you.

Frequently asked questions

What is changing in vehicle access control in 2026?

Four things at once: EU product legislation now names access control readers, phone based access has a single standard in Aliro 1.0, passive UHF has caught up with microwave on read range, and plate recognition runs on the camera itself. Together they shift the decision from read range towards security and credential management.

Does EU cybersecurity legislation apply to access control readers?

Yes. The Cyber Resilience Act names access control readers as important products. Reporting duties for actively exploited vulnerabilities started on 11 September 2026 and the main obligations, including a software bill of materials and a support period for security updates, apply from 11 December 2027.

Will phones replace tags at the gate?

Not soon, and not everywhere. Wallet credentials work by tapping, which suits a door better than a barrier, and most organisations keep physical credentials alongside mobile ones. The Bluetooth and UWB modes in Aliro 1.0 make hands-free access at range realistic, but the standard has not yet been written with the perimeter in mind.