Who Needs a Digital Product Passport? Obligations by Actor

The ESPR does not obligate "companies" loosely — it obligates economic operators, a defined legal concept. An economic operator is any of: the manufacturer, the authorised representative, the importer, the distributor, the dealer, or a fulfilment service provider. Each carries distinct duties calibrated to how much control they exercise over the product.

Two roles deserve attention because they are frequently missed:

• Authorised representative — a person established in the EU appointed in writing by a (typically non-EU) manufacturer to perform tasks on their behalf, including DPP-related duties. A non-EU manufacturer selling under its own brand will usually need one.
• Fulfilment service provider — warehousing, packaging and shipping services that, by handling the product, can fall within scope of operator duties even though they never own it.

The obligations are role-specific, not transferable: the importer's duty to verify a passport exists does not disappear because the manufacturer created it. Each actor must independently perform its own check — which is why a single product can trigger duties in four or five separate organisations.

If you manufacture outside the EU and sell into it, your passport obligations do not disappear — they route through your EU presence. There are three typical structures:

• You have an EU entity that imports. It assumes importer obligations: ensure the DPP exists, is registered, and data is maintained.
• You sell through EU importers/distributors. Your importer is the responsible operator — but in practice they will demand compliant identifiers, data and carriers from you, contractually.
• You sell direct-to-consumer online. The product is still placed on the EU market; the ESPR's distance-sales provisions and marketplace rules apply, and customs can check registration on import.

The structural consequence: non-EU manufacturers must build DPP capability even with zero EU footprint — because their EU counterparties will be liable for the passport they cannot create without them.

The clean rule — whoever places a covered product on the market bears the duty — frays at the margins. These are the cases where the answer differs from intuition:

• Refurbished and remanufactured goods — placing a refurbished covered product on the market is itself an act of "placing on the market." The refurbisher, not the original manufacturer, may carry the DPP duty — and the passport must reflect the product's refurbished state.
• Second-hand sales — a second-hand product already placed on the EU market before its delegated act applied generally does not need a retroactive passport; DPP attaches to new placement, not continued circulation.
• Spare parts — whether a component requires its own passport depends on how the delegated act scopes the product group; many acts target finished goods, not every sub-component.
• Direct-to-consumer imports — a consumer importing a single product for personal use is not an economic operator; the obligation sits with the seller who placed it on the market, which is precisely why online marketplaces carry their own duties.
• Products never placed on the market — internal prototypes, trade-fair samples and goods in transit through (but not into) the EU are generally outside the "placing on the market" trigger.

The pattern: the obligation attaches to the act of making a covered product available on the EU market for the first time — not to the object's continued existence, and not to every organisation that touches it afterwards.

The ESPR creates a market for DPP service providers — firms that host passport data on behalf of economic operators. Because the ESPR decentralises storage (the EU holds only the registry index), someone has to hold the actual passport data for its required lifetime: EN 18221 sets persistence, backup and reliability requirements for exactly this role.

For most mid-market companies, a service provider will be the pragmatic route — hosting, access control and lifecycle updates as a service rather than an in-house build. But note the boundary: hosting can be outsourced; liability cannot.

There is no general SME exemption from the DPP — a covered product needs its passport regardless of the maker's size. The ESPR does require delegated acts to consider SME impact, phases some provisions in later for medium-sized companies, and directs Member States to provide support measures.

Practically, SMEs' mitigation is the service-provider model: the passport as a hosted service rather than a data-platform build. The obligation is real, but it does not have to mean building infrastructure.

The responsible operator is liable for passport accuracy, completeness and availability — enforced through market surveillance and the CE conformity regime. A missing, unreadable or materially false passport is a non-conformity: it can trigger corrective orders, withdrawal, recall and Member-State penalties.

Customs gets a new instrument too: automatic checks on registration for imports. The practical message for every actor in the table above is the same — the DPP is a legal obligation with a named responsible party, not a shared aspiration.