EU Digital Product Passport Requirements

ESPR links Digital Product Passport obligations to information requirements in delegated acts. A covered product can be placed on the EU market or put into service only if the required passport is available under the applicable delegated act and the ESPR passport rules. The passport data must be accurate, complete, and up to date.

The delegated act for the product group is the controlling document for operational scope. It must specify the passport data, the data carrier, carrier layout and positioning, whether the passport is at model, batch, or item level, pre-contract access including distance selling, who can access which data, who can create or update data, how updates are made, and how long the passport remains available.

Regulation (EU) 2024/1781 entered into force on 18 July 2024, but that date did not make a passport mandatory for every product. Each final product-group act supplies its own application and transition terms; ESPR generally prevents an Article 4 delegated act from applying earlier than 18 months after entry into force unless an earlier date is duly justified. The Commission may also exempt a product group from a DPP where the required technical specifications are unavailable or another Union-law digital information system achieves the relevant access and authority-verification objectives.

Annex III gives the menu of passport elements that product-specific delegated acts can require. That menu includes the unique product identifier, GTIN or equivalent product identifiers, commodity codes, compliance documentation, user instructions, manufacturer and importer information, unique operator identifiers, unique facility identifiers, and the DPP service provider reference for the back-up copy.

ESPR also defines the carrier and identifier architecture. The passport must be connected through a data carrier to a persistent unique product identifier. The carrier must be physically present on the product, packaging, or accompanying documentation as the delegated act specifies. References to harmonised DPP standards were published by July 2026; check the cited standard's scope and the applicable product rule before selecting identifiers or carriers.

The Commission launched the DPP Registry and a testing environment on 20 July 2026. The Registry indexes DPPs and stores unique identifiers, registration data, and high-level metadata rather than the full passport. Commission Implementing Regulation (EU) 2026/1778 sets its operational framework and takes effect on 6 August 2026; registration is available through a secure user interface or API.

For imports, customs controls use the Registry to match the unique registration identifier and commodity code where the applicable Union legislation requires a DPP. Automatic customs matching begins only when the separate EU CSW-CERTEX interconnection is operational. Automated validation and proof of registration confirm registry processing, not the substantive correctness of the product data or overall compliance.

Access is not all-public. ESPR names broad actor categories, including customers, economic operators, repairers, refurbishers, remanufacturers, recyclers, market surveillance authorities, customs authorities, civil society organisations, trade unions, and other relevant actors, but the applicable delegated act determines who can access which product-group data and who can introduce or update it.

DPP teams need supplier evidence because many passport fields depend on upstream material, component, facility, process, durability, repairability, recycled-content, or substance data. ESPR allows delegated acts to require supply chain actors to provide relevant information free of charge to manufacturers, notified bodies, and competent national authorities.

Where supplier information is missing, ESPR can require supply chain actors to allow manufacturers to assess supplied products or services and access relevant documents or facilities. It can also require supply chain actors to enable notified bodies and competent national authorities to verify the accuracy of information related to their activities.

The Batteries Regulation is the clearest example of a product-specific passport already written into EU law. From 18 February 2027, it requires a battery passport for each LMT battery, each industrial battery with a capacity greater than 2 kWh, and each electric vehicle battery placed on the market or put into service.

The battery passport illustrates why DPP implementation cannot stop at the ESPR horizontal framework. Annex XIII of the Batteries Regulation splits battery passport information into public battery-model data, data for persons with a legitimate interest and the Commission, data for notified bodies, market surveillance authorities and the Commission, and individual-battery data for persons with a legitimate interest.

For most ESPR product groups, the decisive details are not final until the relevant delegated act is adopted. Teams should not publish fixed field lists, carrier choices, access tiers, or passport-level assumptions for a product group unless they can tie them to the applicable delegated act or another binding EU act such as the Batteries Regulation.

Several technical and governance pieces still depend on future or product-specific acts. ESPR empowers the Commission to set DPP service-provider requirements and, where appropriate, a certification scheme; to set procedures for digital credentials for actors with access rights; and to establish life-cycle rules for unique identifiers and data carriers. Product-group acts still control fields, carrier placement, granularity, access, update rights, and availability.

Registry implementation is no longer an entirely open point: Implementing Regulation (EU) 2026/1778 now sets the operational framework and takes effect on 6 August 2026. Service-provider certification and product-specific access rules should still be tracked separately rather than inferred from the Registry launch.