EU Digital Product Passport Implementation Playbook and Vendor Selection

Shortlist vendors only after confirming which parts of the DPP system they will operate. The component map should separate the product identifier, physical data carrier, resolver or link layer, data repository, access-control services, backup or continuity arrangements, and interfaces to enterprise resource planning (ERP), product lifecycle management (PLM), product information management (PIM), supplier data, market-surveillance, and customs workflows.

ESPR uses a decentralised model: detailed passport data remains with the responsible economic operator or its DPP service provider, while the Commission Registry indexes identifiers, registration data, and high-level metadata. A vendor that proposes a closed central database should explain how it avoids vendor lock-in, preserves interoperability, and keeps the economic operator able to export, update, and transfer passport data.

If the vendor will act as the DPP service provider, verify that it is an independent third party authorised by the responsible economic operator. The contract should prevent sale, reuse, or processing of passport data beyond the service unless the economic operator specifically agrees, and it should preserve passport availability and a recoverable backup after insolvency, liquidation, or cessation of activity.

The first vendor gate is identifier discipline. ESPR defines the DPP around a unique product identifier that enables a web link to the passport, with operator and facility identifiers used where relevant. The applicable delegated act will determine the product granularity, so the system must support model, batch, and item-level choices without forcing a redesign.

The data carrier must be physically present on the product, packaging, or accompanying documentation as specified for the product group. Vendor demos should prove that the carrier resolves reliably to the right passport, supports native scanning where needed, and can handle updates to online data without requiring replacement of every physical carrier unless the carrier itself changes.

A DPP vendor must show how it will model product information, not just where it will store files. The platform should distinguish regulatory data, supplier-provided attributes, calculated sustainability metrics, certificates, conformity documents, lifecycle events, and links to external records. It should also preserve provenance: who supplied each value, when it was changed, and which method or evidence supports it.

Interoperability is a selection criterion because ESPR expects data transfer through an open interoperable exchange network without vendor lock-in. Ask vendors to demonstrate machine-readable exports, schema versioning, controlled vocabularies, validation rules, and mapping from existing ERP, PLM, PIM, and supplier systems into the passport data model.

The vendor must support different views for consumers, customers, repairers, recyclers, market-surveillance authorities, customs authorities, and other authorised actors. Public DPP data should be easy to access, while restricted data needs role-based access, authentication, and rules for who may introduce, modify, or update passport data.

ESPR also requires a publicly accessible Commission web portal for search and comparison in line with access rights. Because product-group delegated acts and implementation arrangements will add detail, vendors should prove that portal and registry integrations are configurable rather than hard-coded.

DPP implementation evidence should prove more than platform configuration. Keep a vendor due diligence package that shows why the selected system can maintain reliable passport data over the product lifecycle and respond to supplier corrections, product changes, authority questions, service-provider failure, and future delegated-act changes.

Require vendors to show how data assertions are verified, signed where appropriate, versioned, backed up, and linked to source evidence. Where a product group later requires particular information, calculation methods, or conformity evidence, the selected system should be able to attach the supporting documents and expose them only to the actors entitled to see them.