Is the Digital Product Passport mandatory?

Yes — but progressively, not universally. The DPP is mandatory for products covered by a delegated act adopted under the ESPR, or by sector-specific legislation that mandates a passport (such as the Battery Regulation). Once a delegated act applies to a product group, placing that product on the EU market without a compliant DPP is unlawful — the same legal status as missing CE marking. Products not yet covered by any delegated act have no DPP obligation.

When does the Digital Product Passport become mandatory?

The first binding deadline is 18 February 2027, when the battery passport becomes mandatory under the EU Battery Regulation (2023/1542) for EV batteries, industrial batteries over 2 kWh, and LMT batteries. Under the ESPR, the first delegated acts are expected to cover iron and steel (2026), followed by textiles, tyres and aluminium (2027), furniture (2028), and mattresses and ICT products (2029). Exact application dates are set in each delegated act, typically 18 months after adoption.

Does the DPP apply to products made outside the EU?

Yes. DPP obligations attach to products "placed on the market" in the EU, regardless of where they are manufactured. A product manufactured in China, Vietnam, Turkey or the United States and sold in the EU must carry a compliant DPP once its product group is covered. For imports, the importer is the economic operator responsible for the DPP, and customs authorities can automatically verify DPP registration at the border through the DPP Registry.

Who is responsible for creating the Digital Product Passport?

The manufacturer — or, for imports, the importer placing the product on the EU market — is the economic operator responsible for creating the DPP, registering it in the DPP Registry, and ensuring the required data is available and accurate. They may host the data themselves or use a DPP service provider. Distributors and dealers must verify that a data carrier is present before making the product available, but they do not create the passport.

Is a Digital Product Passport just a QR code?

No. The data carrier (a QR code, Data Matrix, NFC tag or RFID chip) is only the physical link to the passport — the equivalent of a passport cover. The DPP itself is the underlying data system: a unique product identifier, structured product data hosted by the manufacturer or a service provider, a registration record in the EU DPP Registry, and APIs that control who can read which data. Scanning the carrier resolves the identifier to the data; the data is the passport.

Who can see the data in a Digital Product Passport?

Not all DPP data is public. The ESPR establishes a tiered access model: consumers and the general public see a defined set of sustainability and product information; market surveillance authorities, customs and notified bodies see the full dataset; and certain commercially sensitive data may be restricted to specific actors with access rights defined in the delegated act. The prEN 18239 and prEN 18246 standards specify the access-rights and authentication mechanisms.

What is the difference between a DPP and CE marking?

CE marking is a conformity mark affixed to a product declaring that it meets applicable EU requirements — a static claim. The DPP is a dynamic digital data system that carries the actual evidence: the technical documentation, test reports, material composition, sustainability data and lifecycle events behind the claim. In practice, the DPP will hold or reference the compliance information that CE marking asserts, making conformity machine-verifiable rather than trust-based.

What data standards does the DPP use?

The technical foundation is the EN 182xx family developed by CEN-CENELEC JTC 24 and cited in the Official Journal through Implementing Decision (EU) 2026/1736: EN 18216 (data exchange protocols), EN 18219 (unique identifiers), EN 18220 (data carriers), EN 18221 (storage and persistence), EN 18222 (APIs and searchability) and EN 18223 (interoperability). Two further standards — prEN 18239 (access rights and security) and prEN 18246 (authentication and integrity) — are in finalisation. In practice, identifiers build on established systems such as GS1 GTINs and GS1 Digital Link, and data models draw on the CIRPASS-2 eudpp ontology.

Is the DPP stored in one central EU database?

No — this is a deliberate architectural decision. The EU operates a central DPP Registry, but it stores only the identifier and mandatory registration metadata for each passport. The passport data itself is decentralised: it is hosted by the economic operator that created the passport, or by a DPP service provider on their behalf. The Registry acts as an index and verification layer — customs and authorities use it to confirm a passport exists and to locate its authoritative record — while the data lives wherever the responsible operator holds it.

What happens if a product has no DPP when one is required?

The product cannot legally be placed on the EU market. For imports, customs can automatically check registration status at the border and block non-registered products. In the market, surveillance authorities can order corrective action, withdrawal or recall, and Member States apply penalties that must be effective, proportionate and dissuasive. Because the DPP is tied to the CE conformity regime for covered products, a missing or non-conforming passport undermines the product's entire legal basis for sale.

EU RegulationPillar GuideUpdated 2026

What is a Digital Product Passport? The Complete Guide to the EU DPP

Everything manufacturers, importers, compliance teams and builders need to know about the Digital Product Passport — the legal basis, the standards, the Registry, the deadlines, and what it takes to comply.

The DPP in 30 seconds

A Digital Product Passport (DPP) is a digital record that travels with a product through its lifecycle, carrying verifiable information about its identity, materials, sustainability performance, compliance status and circularity — accessible by scanning a data carrier such as a QR code on the product.

•Legal basis: the Ecodesign for Sustainable Products Regulation (ESPR, EU 2024/1781), plus sector laws like the Battery Regulation
•First deadline: 18 February 2027 — battery passports become mandatory
•Standards: the EN 182xx family (identifiers, carriers, APIs, storage, interoperability) — cited in the EU Official Journal
•Scope: nearly every physical product sold in the EU will eventually need one — including imports

What is a Digital Product Passport?

Legal definition — ESPR Article 2(28)

A 'digital product passport' is a set of data specific to a product that includes the information specified in the applicable delegated act and that is accessible via electronic means through a data carrier.

In plain terms: the DPP is a digital identity card for physical products. Just as a person's passport proves who they are and carries endorsements accumulated over a lifetime of travel, a product's DPP proves what it is — where it was made, what it contains, how it performs on sustainability metrics, and what should happen to it at end of life.

But the passport analogy understates the engineering. A DPP is not a document, a PDF, a label or a QR code. It is a distributed data system: a unique product identifier, a physical data carrier that binds the identifier to the item, structured product data hosted by the manufacturer or a service provider, a registration record in an EU-level Registry, and APIs that govern who may read and write each data element.

This distinction matters commercially. Organisations that treat the DPP as "a QR code project" will build a sticker. Organisations that treat it as a data-infrastructure project will build something that survives audits, delegated-act changes and a decade of product lifecycle events.

Where the DPP came from

The DPP did not arrive from nowhere — it is the product of a decade of EU product-policy evolution. The European Green Deal (2019) established the strategic frame: decouple growth from resource use and make sustainable products the norm. The Circular Economy Action Plan (2020) then named the instrument — a "digital product passport" — as the mechanism to carry product information through the value chain.

The concept was then battle-tested. The CIRPASS consortium (2022–2024) ran the first large cross-sector pilots — batteries, electronics, textiles — producing the initial reference architecture and proving the model worked across industries. CIRPASS-2 carried this forward into the deployable eudpp core ontology and lighthouse pilots. In parallel, the Battery Regulation (2023) became the first law to mandate a sectoral passport — proving the concept in binding law before the horizontal framework existed.

The ESPR (2024/1781) then made it horizontal: one framework law covering nearly all physical goods, with the DPP as its general information mechanism. The EN 182xx standards (cited in the OJ in 2026) turned the legal shell into an implementable system. What began as a policy idea is now a published legal-technical stack.

Why the DPP exists

The DPP is the data backbone of the EU's circular-economy agenda. It solves three concrete failures of today's product-information ecosystem:

1. The market-surveillance gap

Hundreds of millions of products enter the EU each year, and customs and market surveillance authorities cannot physically verify a meaningful fraction of them. Compliance today is largely honour-based. The DPP gives authorities a machine-readable way to check, at the border and in the market, whether a product's claimed conformity is backed by real registered data — automatically, at scale.

2. The information asymmetry problem

Consumers, repairers, recyclers and remanufacturers routinely cannot learn what a product is made of, whether it can be repaired, or how to recover its materials. Value is destroyed at end of life because the knowledge needed to preserve it never reached the actor who needed it. The DPP makes product information travel with the product.

3. The unverifiable-claims problem

Sustainability claims today live in marketing copy and static reports. Regulators (through the Green Claims agenda), buyers and auditors increasingly demand evidence. A DPP binds claims to structured, verifiable data records rather than assertions.

The legal basis: ESPR and sector legislation

The framework law is the Ecodesign for Sustainable Products Regulation (ESPR), Regulation (EU) 2024/1781, which entered into force on 18 July 2024. The ESPR does not itself impose a DPP on any product today. Instead, it establishes the DPP system and empowers the Commission to activate it product-group-by-product-group through delegated acts — product-specific legal acts that define which information each group's passport must contain.

In parallel, several sector-specific laws mandate their own passports using the same underlying system — most importantly the EU Battery Regulation (2023/1542), Article 77, which creates the battery passport, the first DPP with a hard compliance date. The Construction Products Regulation, the revised Toy Safety Regulation, the Packaging and Packaging Waste Regulation and the Detergents Regulation all follow the same pattern.

The rollout timeline (indicative, per the Commission's working plan)

Product group	Expected DPP obligation	Legal instrument
Batteries (EV, industrial >2 kWh, LMT)	18 February 2027 — first hard deadline	Battery Regulation 2023/1542, Art. 77
Iron and steel	2026 (first ESPR delegated acts)	ESPR delegated act
Textiles, tyres, aluminium	2027	ESPR delegated acts
Energy-related products	2026–2029 (rolling)	ESPR delegated acts
Furniture	2028	ESPR delegated act
Mattresses, ICT products	2029	ESPR delegated acts

Read the table correctly: these are dates by which the Commission intends to have delegated acts in place or applying. Each act typically grants a transition period (commonly ~18 months) before the obligation bites — but data plumbing, supplier onboarding and system integration take longer than that to build well. Organisations that start when the act publishes are already late.

How a Digital Product Passport actually works

Architecturally, every DPP — regardless of product group — combines four components defined by the ESPR and elaborated by the EN 182xx standards:

1. Unique product identifier

Every DPP is anchored to identifiers defined by EN 18219: a unique product identifier (UPI) at model, batch or unit level, plus a unique operator identifier (UOI) and unique facility identifier (UFI) for the responsible actors. In practice these build on GS1 keys — GTIN plus serial number for unit-level identity.

2. Data carrier

A physical carrier — QR code, Data Matrix, NFC tag or RFID, chosen per EN 18220 — affixed to the product, packaging or accompanying documents. It encodes the identifier, typically as a GS1 Digital Link URI that resolves to the passport data.

3. Decentralised data storage

The DPP data itself is not stored in a central EU database. It is held by the economic operator or a contracted DPP service provider, per EN 18221's persistence requirements. The EU holds only the registration index — not your product data.

4. The DPP Registry

An EU-level registry stores the identifier and mandatory registration metadata for each passport, and issues a unique registration identifier (URI). Customs can automatically verify a registration for imports; market surveillance uses it to locate the authoritative record.

The four technical components of a Digital Product Passport: a unique product identifier, a physical data carrier, decentralised data storage, and the EU DPP Registry. — The four components every DPP combines — identifier, carrier, decentralised storage, and the Registry.

The lifecycle in five steps

Identify and model

The manufacturer assigns identifiers (e.g. GTIN + serial), assembles the product data required by the applicable act, and structures it against the data model.

Create and register

The DPP is created, its data hosted by the operator or service provider, and a registration record with the identifier submitted to the EU DPP Registry, which issues the URI.

Bind to the product

The data carrier encoding the identifier is affixed to the product, packaging or documents. For imports, customs can check the URI automatically at the border.

Serve and control access

Actors resolve the identifier via APIs (EN 18222). Public data is open; restricted data requires authenticated access rights per prEN 18239/18246.

Update through life

Repairs, ownership transfers, refurbished components and end-of-life events update the passport — the record persists for the required retention period.

The Digital Product Passport lifecycle from creation and registration through in-life updates to end-of-life. — A DPP is a living record — created at placing on the market, updated through life, retained past end-of-life.

A worked example: anatomy of a passport

Abstract architecture becomes concrete quickly. Here is what a simplified passport for a hypothetical industrial battery actually looks like — first as the machine-readable payload, then decomposed:

{
  "@context": ["https://eudpp.eu/context/core.jsonld"],
  "@id": "https://dpp.acme-battery.example/01/09501234567890/21/SN-884211",
  "@type": "eudpp:BatteryPassport",
  "identifier": {
    "gtin": "09501234567890",
    "serialNumber": "SN-884211",
    "registrationId": "dpp-reg:7f3a9c1e-..."
  },
  "manufacturer": {
    "@type": "eudpp:EconomicOperator",
    "name": "Acme Battery GmbH",
    "operatorId": "GLN 0950123450000",
    "facilityId": "UFI-PLT-DRESDEN-01"
  },
  "product": {
    "category": "industrial-battery",
    "chemistry": "NMC",
    "ratedCapacityKwh": 45.2,
    "carbonFootprint": { "value": 62.4, "unit": "kgCO2e/kWh", "class": "B" },
    "recycledContent": { "cobalt": 0.12, "lithium": 0.04, "nickel": 0.08 }
  },
  "circularity": {
    "dismantlingInfo": "restricted",
    "endOfLifeInstructions": "..."
  }
}

The @id is the resolution key

@id is the GS1 Digital Link URI — GTIN + serial. Scanning the QR on the battery resolves to exactly this record. It is the same identifier the Registry indexes and customs checks.

Context makes it interoperable

The @context ties every field to the shared eudpp vocabulary — so carbonFootprint means the same thing to a German regulator and a Korean recycler.

Access control is in the data model

Fields like dismantlingInfo: "restricted" signal which slice is public versus restricted — the same record serves the consumer view and the recycler view differently.

It is a living record

This unit's passport will be updated — state of health for EV/industrial batteries, repairs, repurposing, end-of-life — through EN 18222 lifecycle APIs, not a static file.

The EN 182xx standards: the technical rulebook

The ESPR defines that a DPP must exist; the EN 182xx standards family, developed by CEN-CENELEC Joint Technical Committee 24, defines how it works. In 2026 the first six were cited in the Official Journal through Implementing Decision (EU) 2026/1736 — meaning systems built to them enjoy a presumption of conformity with the corresponding ESPR requirements.

Standard	Scope	Status
EN 18216:2026	Data exchange protocols — how systems transport DPP data	Cited in OJ
EN 18219:2026	Unique identifiers — UPI, UOI, UFI and resolution	Cited in OJ
EN 18220:2026	Data carriers — QR, Data Matrix, NFC, RFID selection	Cited in OJ
EN 18221:2026	Data storage, archiving and persistence	Cited in OJ
EN 18222:2026	APIs for lifecycle management and searchability	Cited in OJ
EN 18223:2026	System interoperability across providers and borders	Cited in OJ
prEN 18239	Access rights, security and confidentiality	In finalisation
prEN 18246	Authentication, reliability and integrity	In finalisation

Beneath the standards sit the data models: the CIRPASS-2 eudpp ontologyprovides the reference semantic model, expressed in JSON-LD for exchange and validated with JSON Schema and SHACL. Identifier and carrier practice builds on GS1 (GTIN, GLN, Digital Link). At the international layer, ISO/TC 154 is developing ISO 25534 to align DPP concepts globally.

What data goes inside a DPP

The precise dataset is defined per product group in each delegated act, anchored to the ecodesign parameters in ESPR Annex III. Across acts, six categories recur:

Identity & origin

Product identifiers, model/batch/serial, manufacturer and facility identifiers, country of manufacture.

Materials & substances

Material composition, recycled content, substances of concern and their location in the product.

Sustainability performance

Carbon footprint, durability, repairability scores, energy and resource efficiency — the metrics the delegated act mandates.

Compliance evidence

Declarations of conformity, test reports, certificates and references to notified-body assessments.

Circularity information

Repair instructions, spare-part availability, disassembly guidance, recycling and end-of-life handling.

Actors & events

Supply-chain actors and lifecycle events — ownership transfers, repairs, refurbishment — written to the passport over time.

Who must comply — and who is exposed

DPP obligations attach to products "placed on the market" in the EU — the first making available of a product, whether manufactured in the Union or imported. The ESPR distributes responsibility across the value chain:

Actor	Core DPP obligation
Manufacturer (EU or non-EU)	Create the DPP, populate required data, register it, issue the data carrier, keep data available for the retention period
Importer	For third-country products, ensure the DPP exists and is registered before placing on the market — effectively assumes the manufacturer role for imports
Distributor / dealer	Verify a data carrier is present before making the product available; act with due care
Online marketplaces & fulfilment providers	Cooperate with market surveillance; enable checks; covered explicitly by the ESPR's distance-sales provisions
DPP service providers	Host passport data on behalf of operators under EN 18221 persistence and backup requirements

The critical point for non-EU businesses: a product group covered by a delegated act cannot legally enter the EU market without its passport. "We're not a European company" is not an exemption — it is precisely the scenario the customs-integration is built for.

The decentralised DPP registry model — the EU registry holds only identifiers and registration metadata while passport data is held by economic operators and service providers. — Decentralised by design — the Registry indexes identifiers and metadata; the data itself lives with the responsible operator or their service provider.

Who sees what: the access-tier model

A DPP is not one document everyone reads the same way — it is a layered record with different audiences seeing different slices. Access control is built into the architecture (governed by prEN 18239/18246), because the same passport must satisfy a curious consumer and a market-surveillance inspector without exposing commercially sensitive data to the former:

Audience	Typical access	What they see
Consumer / public	Unrestricted scan	Identity, sustainability score, recycled content summary, repair info, recyclability
Dealer / distributor	Basic verification	Conformity status, data-carrier validity — enough to confirm the passport exists
Recycler / refurbisher	Restricted — role-gated	Material composition, disassembly instructions, substance-of-concentration flags
Market surveillance / customs	Authoritative — full	Complete record, compliance evidence, registration status, audit trail
Notified body / auditor	Assessment scope	Technical documentation, test evidence, conformity-assessment records

This tiering is why "the passport" is better understood as one record, many views. The consumer-facing QR resolves to the public slice; the same underlying data exposes richer fields to authenticated roles. Getting this access model right — what is public, what is restricted, and to whom — is one of the harder design problems in a real implementation.

Key terms worth knowing

Term	Meaning
Unique product identifier (UPI)	The string that identifies the individual product instance the passport belongs to
Data carrier	The physical tag (QR, Data Matrix, NFC) that carries the identifier and links to the passport
Economic operator	Manufacturer, importer, distributor, dealer, or fulfilment provider with a defined DPP duty
DPP Registry	The EU-run index storing identifiers and registration metadata — not the data itself
Delegated act	A product-group-specific legal act that activates DPP duties and defines required data
Presumption of conformity	The legal benefit of following a cited harmonised standard — conformity is assumed
Data space	The decentralised hosting model where each operator holds its own passport data
GTIN	GS1 Global Trade Item Number — the identifier most DPPs will build on

Data carriers: how the physical meets the digital

EN 18220 governs how the identifier is physically bound to the product. There is no single mandated carrier — the right choice depends on the product's environment, price point and lifecycle:

Carrier	Strengths	Best fit
QR code	Zero-cost, universally scannable by phones	Consumer goods, packaging, documents
Data Matrix	Compact, robust to damage and abrasion, industrial-printable	Batteries, small parts, harsh environments
NFC tag	Tap-to-read, harder to counterfeit, read without line of sight	Higher-value goods, textiles, luxury
RFID	Bulk scanning, no line of sight, warehouse-grade	Logistics, inventory, high-throughput operations

DPP vs EPD, PCF, CE marking and traceability

The DPP is constantly confused with adjacent instruments. The distinctions matter for scoping your compliance work:

Instrument	What it is	Static or dynamic	Mandatory?
Digital Product Passport	A living data system carrying identity, materials, sustainability, compliance and lifecycle events	Dynamic — updated through life	Yes, progressively per product group
EPD (Environmental Product Declaration)	A standardised LCA-based document reporting environmental impact	Static document	Mostly voluntary / procurement-driven
PCF (Product Carbon Footprint)	A single-metric calculation of lifecycle GHG emissions	Static metric (one data point)	Context-dependent (e.g. batteries)
CE marking / DoC	A conformity mark and declaration that requirements are met	Static claim	Yes where harmonised law applies
Traceability system	Internal tracking of a product through the supply chain	Dynamic but private	Only in specific sectors

The practical relationship: an EPD or PCF is content a DPP may carry; CE marking is a claim the DPP substantiates with evidence; a traceability system is infrastructure you may already have that the DPP must interoperate with.

Six misconceptions to retire early

"The DPP is a QR code."

The QR code is the carrier. The passport is the data system behind it — identifiers, hosted data, registry record, APIs and access control.

"All our product data becomes public."

No — the ESPR defines tiered access. Public data is a defined subset; commercially sensitive data is restricted by role. Access control is a designed feature, not an afterthought.

"The EU stores all our data."

No — storage is decentralised. The Registry holds identifiers and registration metadata; the data itself stays with you or your service provider.

"It only applies to EU manufacturers."

It applies to products placed on the EU market — including everything imported. Importers carry the obligation for third-country goods.

"We can wait for our product group's delegated act."

You can, but you will be behind. Identifier strategy, data quality remediation and supplier onboarding take longer than typical transition periods.

"It's a compliance cost with no upside."

The same infrastructure enables repair services, resale, warranty automation, supply-chain intelligence and verified sustainability claims — commercial returns beyond compliance.

Static versus dynamic product information — a DPP is a living record that updates through the product's life, not a fixed label. — Static vs dynamic — a passport updates through life (repairs, transfers, end-of-life); a label or PDF does not.

How to prepare: five steps

Determine applicability

Map your product portfolio against the delegated-act pipeline. Which groups are you in? When do obligations bite? Use a structured assessment rather than intuition.

Fix your identifier strategy

Decide your granularity (model / batch / unit), align on GS1 keys, and resolve how identifiers will be issued, governed and resolved across your products.

Audit your data

Most organisations discover the required data exists but is scattered, unstructured or unverifiable across ERP, PLM, supplier documents and spreadsheets. Inventory it against Annex III-style requirements.

Pilot one product line

Build a real passport for one SKUs-worth of products: identifier, carrier, data model, hosting, API access. Learn on a bounded scope before scaling.

Build internal capability

DPP implementation spans legal, sustainability, IT and supply chain. Teams that understand the standards and architecture deliver materially better outcomes than teams learning under deadline pressure.

DPP Readiness Checker

Assess your organisation's DPP readiness in minutes — free, no signup required.

ESPR Applicability Checker

Check whether your products fall within ESPR scope and which obligations apply.

Frequently asked questions

Learn the foundations

The Certified Digital Product Passport Foundations (CDPF) course covers everything in this guide in structured depth — ESPR, the data model, APIs and circular-economy applications. ~4-5 hours, first two chapters free.

Explore CDPF

Build real DPP systems

The Certified Digital Product Passport Implementer (CDPI) certification is for the people who will actually implement this: EN 182xx standards, eudpp data model, identifiers, carriers, security and deployment — with hands-on labs.

Explore CDPI

Further reading: start with the free preview chapter What is a Digital Product Passport?, the implementer chapter on the EN 182xx standards family, or the open UPPS product passport framework.