Digital Product Passport (DPP): EU rules, timeline and how to build one

The digital product passport (DPP) is the set of data on a product that you reach by scanning a data carrier, such as a QR code, and that the EU will require, product group by product group, for products covered by the Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781 (ESPR). The regulation has been in force since July 18, 2024, but the obligation for each product comes from the delegated act for its group, which cannot apply earlier than 18 months after it enters into force, except in duly justified cases (Art. 4(4)). Batteries already have a date: February 18, 2027. This guide explains what data the passport holds, which products come first, how the EU registry works and where blockchain fits even though the regulation does not require it.

What the digital product passport is

The ESPR defines the digital product passport as a set of data specific to a product that includes the information specified in the applicable delegated act and that is accessible by electronic means through a data carrier (Art. 2(28)). Once a delegated act requires it, the product can only be placed on the market or put into service if its passport is available, with accurate, complete and up-to-date data (Art. 9(1)).

Each delegated act decides, for its product group, which data are included, which data carrier is used and where it goes, whether the passport is set at model, batch or item level, who can see each piece of data and who can write it, and how long it must remain available: at least the expected lifetime of the product (Art. 9(2)). The regulation gives it three purposes: letting actors along the value chain reach the information they need, helping authorities verify compliance and improving the traceability of products along the supply chain (Art. 9(3)).

Which products and from when

On April 16, 2025, the Commission adopted the first ESPR working plan, for 2025-2030 (COM(2025) 187). According to that plan, every product for which ecodesign measures are adopted will have a digital product passport, unless another digital system provides equivalent information, such as the EPREL database for products with an energy label. The dates in the plan are indicative and refer to the adoption of the delegated act, not to the day the obligation starts:

As of October 15, 2026, none of the Commission acts published in EUR-Lex under the ESPR yet sets the passport for a specific product group: those published cover, among other things, the passport registry and the destruction of unsold consumer products. Footwear is not in the plan: the Commission will commission a study to be completed by the end of 2027.

Other EU rules already refer to the same passport registry: those on construction products (Regulation (EU) 2024/3110), toys (Regulation (EU) 2025/2509) and detergents and surfactants (Regulation (EU) 2026/405), according to recital 2 of Implementing Regulation (EU) 2026/1778. Each one sets its own deadlines.

Do not confuse the passport with another obligation in the same regulation: the ban on destroying unsold apparel, clothing accessories and footwear, which applies to large companies from July 19, 2026 and to medium-sized companies from July 19, 2030 (Art. 25 and Annex VII).

What data it contains and who can see it

Annex III of the ESPR lists the data from which each delegated act will choose:

• the unique product identifier and, where relevant, the Global Trade Item Number (GTIN, under ISO/IEC 15459-6) and commodity codes such as the TARIC code;
• compliance documentation (declaration of conformity, technical documentation or certificates) and instructions, warnings and safety information;
• information on the manufacturer, the importer (with its EORI number) and the economic operator responsible in the EU, with their unique operator identifiers, and unique facility identifiers;
• the reference of the service provider hosting the back-up copy of the passport;
• the sustainability information required by the delegated act for each group. According to the working plan, it will include material composition, substances of concern and how to use, recycle and dispose of the product safely.

Access is not the same for everyone. Customers, manufacturers, repairers, refurbishers, recyclers, market surveillance authorities, customs, civil society organizations and other actors will have free and easy access based on the rights set in each delegated act (Art. 11(b)). The rights to introduce or modify data are restricted too (Art. 11(f)), and customers' personal data are not stored in the passport without their explicit consent (Art. 10(1)(e)). The battery passport already separates public information, information reserved for notified bodies, market surveillance authorities and the Commission, and information for persons with a legitimate interest (Art. 77(2) of Regulation (EU) 2023/1542).

Data carrier: QR, NFC, RFID and GS1 Digital Link

The ESPR uses the term "data carrier": a linear barcode symbol, a two-dimensional symbol such as a QR code, or another automatic identification data capture medium that a device can read (Art. 2(29)). RFID and NFC tags fit that third category; the delegated act for each group decides which one is used (Art. 9(2)). The carrier must be physically present on the product, its packaging or the documentation accompanying it, and it links to a persistent unique product identifier (Art. 10(1)(a) and (b)), a string of characters that also enables a web link to the passport (Art. 2(30)).

The ESPR points to the ISO/IEC 15459 series of standards until harmonized standards are available (Art. 10(1)(c) and Annex III). On July 15, 2026, the references of six harmonized standards for the passport were published in the Official Journal (Implementing Decision (EU) 2026/1736): EN 18216 (data exchange protocols), EN 18219 (unique identifiers), EN 18220 (data carriers), EN 18221 (data storage, archiving and persistence), EN 18222 (APIs) and EN 18223 (system interoperability). Complying with them gives a presumption of conformity with the requirements of Articles 10 and 11 that they cover.

One option for the carrier is GS1 Digital Link, a GS1 standard that expresses GS1 identifiers (the GTIN, the batch or the serial number) as a web address inside a 2D code, so the same code works at the point of sale and to open the information online. It fits an identifier that must enable a web link, but the ESPR does not mandate it. If you sell through dealers or online marketplaces, you must give them a digital copy of the carrier or the identifier, free of charge and within five working days of their request (Art. 10(3)).

Architecture: the EU registry and the manufacturer's data

The passport is not one big Commission database. The ESPR bases it on a decentralized data system set up and managed by economic operators (recital 41): it is stored by the operator that creates it or by a digital product passport service provider (Art. 11(c)), and when the product is placed on the market a back-up copy must be made available through a service provider (Art. 10(4)). That provider may not sell or reuse the data beyond what is needed for its service, unless agreed with the operator (Art. 11).

What the Commission does centralize is a registry holding at least the unique identifiers, which it had to set up by July 19, 2026 (Art. 13(1)). How it works is laid down in Implementing Regulation (EU) 2026/1778, published on July 17, 2026: a website, an API to register passports, a verification platform, a scheme for unique registration identifiers, a list of verified service providers, a semantic repository and a log system, among other components (Art. 3). To register passports, the operator must be a "verified economic operator"; a company established in the EU proves it with a qualified electronic seal or a qualified electronic attestation of attributes (Art. 4(2)(a)).

For products covered by a delegated act, whoever releases them for free circulation in the EU will have to give customs their unique registration identifier, and customs will check that it matches the registry (Art. 15). The Commission will also run a public web portal to search and compare passport data according to access rights (Art. 14).

The data must be based on open standards and be interoperable, machine-readable and transferable without vendor lock-in (Art. 10(1)(d)). The passport must remain available even after the operator's insolvency or the end of its activity in the EU (Art. 11(e)), and data authentication, reliability and integrity must be ensured (Art. 11(g)).

Where blockchain helps and where it does not

The digital product passport does not require blockchain. The ESPR asks for open standards, interoperability, no vendor lock-in and rules on identifiers that remain, as far as possible, technologically neutral (Art. 12(6)(c)). A well-built passport can run on a conventional database, an API and a QR code.

Blockchain helps when several companies that do not share a system need to trust the same data, as in other blockchain use cases in the supply chain:

• Verifiable integrity. Recording on-chain the hash of each version of the passport lets anyone check that a piece of data was not changed after a given date. It is one way to meet the integrity requirement in Art. 11(g), not the only one.
• Traceability across companies. Suppliers, processors, repairers and recyclers can record events (certificates, status changes, repairs) without depending on any single company's database. The ESPR requires the new passport of a product that already had one, for example a remanufactured product, to be linked to the original (Art. 11(d)).
• Auditable writes. A shared ledger records who introduced or changed each piece of data, which helps show that the write rights in Art. 11(f) are respected.
• Credentials of the actors. The ESPR provides for implementing acts to issue and verify the digital credentials of those with access rights (Art. 11), an area where verifiable digital identity fits.

It does not help, or it gets in the way, when it is used for what the regulation solves in another way. Passport data change (they must be up to date, Art. 9(1)) and may include restricted information: they are not published on a public chain. Nor are customers' personal data. The identifier registry belongs to the Commission, and the back-up copy is hosted by a service provider. The architecture we propose keeps the data off-chain and puts only integrity proofs and events on-chain.

How we implement it

We start from the delegated act for your product group, or its draft if it has not been adopted yet, and from the data you already hold in your ERP or PLM. We build the passport data model, the issuance of identifiers and data carriers, storage and the API with its access rights, the integration with suppliers and, where it adds value, integrity anchoring on blockchain. It is the work behind a product traceability system, with the ESPR regulatory layer on top. The manufacturer declares the product's conformity; we build the system that documents it.

Frequently asked questions

Is the digital product passport already mandatory?

Not across the board yet. It becomes mandatory for each product group when its delegated act says so, and that act will apply no earlier than 18 months after it enters into force, except in duly justified cases (Art. 4(4) ESPR). For electric vehicle batteries, industrial batteries above 2 kWh and light means of transport batteries, the passport is mandatory from February 18, 2027 (Art. 77 of Regulation (EU) 2023/1542).

Does the DPP require blockchain?

No. The ESPR requires open standards, interoperability, data integrity and access control, without imposing a technology. Blockchain is an option for integrity and traceability across companies, not a requirement.

Does it affect companies outside the EU?

Yes. According to the Commission's working plan, the requirements apply to all goods placed on the EU market, including imports. For covered products, customs will check the unique registration identifier before release for free circulation (Art. 15 ESPR). A manufacturer in Latin America or the US that exports affected products will need their passport to be available when they enter the European market.

How is the battery passport different?

It is governed by another regulation, Regulation (EU) 2023/1542, with its own date (February 18, 2027) and access through a QR code (Art. 77(3)). It follows the same approach as the ESPR, and the unique identifiers of batteries are stored in the same Commission registry (Art. 13(1) ESPR).

Official sources

• Regulation (EU) 2024/1781 on ecodesign for sustainable products (ESPR), EUR-Lex
• Regulation (EU) 2023/1542 on batteries, Art. 77, EUR-Lex
• Ecodesign working plan 2025-2030, COM(2025) 187, EUR-Lex
• Implementing Regulation (EU) 2026/1778, passport registry, EUR-Lex
• Implementing Decision (EU) 2026/1736, harmonized standards for the passport, EUR-Lex
• GS1 Digital Link, GS1

Framework verified as of October 15, 2026. The working plan dates are indicative; each delegated act sets the obligation. Do you need to prepare the passport for your products? Talk to us.