DPPCustoms accessEU

EU Digital Product Passport customs access review workflow

A workflow for checking which DPP data is public, restricted, or available to customs authorities before an ESPR-covered product is imported or released.

Use it to align access rights, registry evidence, portal expectations, and customs release checks. The Commission launched the DPP Registry on 20 July 2026; product-specific registration duties still depend on the applicable EU legislation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 24, 2026

Overview

This workflow helps product, trade compliance, and DPP implementation teams review customs access for an EU Digital Product Passport under the Ecodesign for Sustainable Products Regulation. It covers the passport data carrier and unique product identifier, stakeholder access rights set in product-specific delegated acts, the Commission registry, the planned public search portal, and customs checks for . The Registry became operational on 20 July 2026, but a product must be registered only when the applicable ESPR delegated act or other Union legislation requires a DPP and registration.

Section 1

Classify DPP data by access route

Start by separating DPP data into three access routes. Public data is the information that stakeholders can search or compare through the Commission web portal when access rights allow it. Restricted data is DPP information available only to named actor types under product-specific access rights. Customs access is the authority route for customs duties, including risk management, customs controls, and .

Do not treat the passport as one public document. ESPR requires access to DPP data to be regulated by delegated-act access rights, and it requires free and easy access for listed actors, including customs authorities, based on those respective access rights.

Public: data intended for search or comparison through the web portal, without expanding beyond the access rights set for the product group.
Restricted: supplier, operator, service-provider, or lifecycle data that needs login, credentials, or role-based access because it is not meant for every stakeholder.
Customs: registry and DPP data customs authorities may retrieve and use for duties under Union law, including customs controls and .
Not classified yet: any data element whose access rule depends on a product-specific delegated act that is not yet available for the product group.

Sources for this answer

Regulation (EU) 2024/1781 (ESPR)

Supports the public, restricted, and customs access split because ESPR requires DPP access to follow product-group access rights and lists customs authorities among actors with access based on those rights.

CEN-CENELEC workshop on DPP design guidelines

Supports treating the DPP implementation as a design exercise covering data carriers, portal contents, information exchange, and applications.

Section 2

Check the registry and portal handoffs

The registry handoff is not the same as publishing the whole passport. The live Registry stores unique identifiers, registration data, and high-level metadata rather than the full DPP. Commission Implementing Regulation (EU) 2026/1778, published on 17 July 2026 and entering into force on 6 August 2026, sets rules for registration through a secure user interface or API, automated checks, and generation of a unique and persistent registration identifier.

The public search portal is a separate ESPR service. Article 14 requires the Commission to provide it for searching and comparing DPP data according to product-group access rights; the Commission's July 2026 DPP timeline says that portal is planned for a later launch. Do not record a successful Registry lookup as a public-portal test.

Confirm the passport is connected through a data carrier to a persistent unique product identifier.
Confirm the product, packaging, or accompanying documentation carries the data carrier location required by the applicable delegated act.
Confirm the registry submission covers the required identifier, the model, batch, or item granularity, higher-level identifiers where required by Implementing Regulation (EU) 2026/1778, and the commodity code for products intended for .
Keep the unique registration identifier and downloadable proof of registration. Proof of registration shows that the registration duty was fulfilled; it does not establish that the product or the substantive DPP data complies with Union law.
Treat public-portal readiness as a separate test until the portal is available, and limit search or comparison fields to the access rights set for the product group.

Sources for this answer

Regulation (EU) 2024/1781 (ESPR)

Supports the registry and portal handoff steps, including unique identifiers, commodity code storage for release for free circulation, and the public portal constrained by access rights.

European Commission ESPR overview

Supports the plain-language explanation that the DPP is a digital identity card storing product sustainability information, circularity information, and legal-compliance information.

Commission Implementing Regulation (EU) 2026/1778

Sets Registry verification, registration, versioning, logging, and proof-of-registration rules. It was published on 17 July 2026 and enters into force on 6 August 2026.

European Commission DPP Registry

Confirms that the Registry is live and explains that it stores identifiers, registration data, and high-level metadata rather than the complete passport.

Recommended next step

Test DPP customs access before import release

This workflow helps check access rights, registry identifiers, portal exposure, and customs handoff evidence before ESPR-covered products reach release-for-free-circulation review.

Research workflow

Open Research Copilot

Ask DPP customs and access-rights questions against cited ESPR source material.

Explore next step

Talk to Sorena

Discuss DPP implementation

Review registry handoffs, access controls, and import-release readiness with Sorena.

Explore next step

Section 3

Review customs release readiness without inventing customs fields

For customs release readiness, stay inside the ESPR mechanics. From the Registry's operational launch on 20 July 2026, a person placing a product covered by an ESPR delegated act under the customs procedure for must provide or make available its unique registration identifier. For other products, the same mechanism applies only where the applicable Union legislation requires that customs handoff.

The minimum customs match is the unique registration identifier and commodity code against Registry data. Article 15 makes the electronic and automatic verification obligation depend on the EU CSW-CERTEX interconnection becoming operational, so teams should confirm the current customs-system route instead of assuming that Registry availability alone proves the automated customs exchange is active. Customs release is not proof of compliance with ESPR or other Union law.

Ready: the product is covered by an applicable delegated act and has a DPP available under Articles 9 to 11.
Ready: the registry upload exists and the unique registration identifier is available to the importer, broker, or filing team that will provide it to customs.
Ready: the commodity code used for customs release is aligned with the commodity code stored in the registry for that product.
Blocked: no delegated-act basis identifies the required DPP data or access rights for the product group.
Blocked: the review asks for extra customs field mechanics not based on ESPR, such as unverified filing columns, broker scripts, or penalty thresholds.

Sources for this answer

Regulation (EU) 2024/1781 (ESPR)

Supports the customs release readiness criteria: provide the unique registration identifier, verify it with the commodity code against the registry, and avoid treating release as proof of compliance.

European Commission consultation on the Digital Product Passport

Supports the implementation context that the DPP is intended to be available to consumers, businesses, and relevant public authorities, and may host additional information such as instructions or conformity documents.

European Commission announcement: DPP Registry now live

Confirms the Registry's operational launch on 20 July 2026 and the availability of a production interface, testing environment, API integration, technical documentation, and registration support.

Section 4

Keep access-control evidence

Close the review with evidence that proves the access model is deliberate. The evidence should show which actor type can see, create, update, or retrieve each field; how public portal data differs from restricted data; and how customs receives the registry identifier needed for .

The evidence should also show that DPP data remains accurate, complete, up to date, reliable, and protected. ESPR requires data authentication, reliability, integrity, security, privacy, and fraud avoidance, and it restricts rights to introduce, modify, or update DPP data based on delegated-act access rights.

Access matrix: actor type, field group, action allowed, source of the access right, and whether the field is public, restricted, or customs-accessible.
Registry evidence: upload timestamp or record reference, unique product identifier, unique registration identifier, commodity code for release-for-free-circulation products, and owner of the record.
Portal evidence: public fields exposed for search or comparison, restricted fields suppressed from public view, and test results for an unauthenticated user.
Customs handoff evidence: who provides the unique registration identifier, where the identifier is stored for filing support, and how commodity-code alignment is checked.
Change-control evidence: who may introduce, modify, or update DPP data and how reliability, integrity, security, privacy, and fraud controls are tested.

Sources for this answer

Regulation (EU) 2024/1781 (ESPR)

Supports the access-control evidence list because ESPR restricts DPP update rights by access rights and requires data authentication, reliability, integrity, security, privacy, and fraud avoidance.

CEN-CENELEC workshop on DPP design guidelines

Supports using a DPP design record for implementation decisions involving data carriers, portal contents, and information exchanges.

Primary sources

References and citations

CEN-CENELEC workshop on DPP design guidelines

cencenelec.eu

Referenced sections

Supports using a DPP design record for implementation decisions involving data carriers, portal contents, and information exchanges.

"information exchanges and applications"

Commission Implementing Regulation (EU) 2026/1778

eur-lex.europa.eu

Referenced sections

Sets Registry verification, registration, versioning, logging, and proof-of-registration rules. It was published on 17 July 2026 and enters into force on 6 August 2026.

European Commission announcement: DPP Registry now live

single-market-economy.ec.europa.eu

Referenced sections

Confirms the Registry's operational launch on 20 July 2026 and the availability of a production interface, testing environment, API integration, technical documentation, and registration support.

European Commission consultation on the Digital Product Passport

single-market-economy.ec.europa.eu

Referenced sections

Supports the implementation context that the DPP is intended to be available to consumers, businesses, and relevant public authorities, and may host additional information such as instructions or conformity documents.

"consumers, businesses and relevant public authorities"

European Commission DPP Registry

single-market-economy.ec.europa.eu

Referenced sections

Confirms that the Registry is live and explains that it stores identifiers, registration data, and high-level metadata rather than the complete passport.

European Commission ESPR overview

commission.europa.eu

Referenced sections

Supports the plain-language explanation that the DPP is a digital identity card storing product sustainability information, circularity information, and legal-compliance information.

"digital identity card for products"

Regulation (EU) 2024/1781 (ESPR)

eur-lex.europa.eu

Referenced sections

Supports the access-control evidence list because ESPR restricts DPP update rights by access rights and requires data authentication, reliability, integrity, security, privacy, and fraud avoidance.