Digital Product Passport requirements: what ESPR asks for and when

What a Digital Product Passport is under ESPR

Under Article 9 of ESPR, where a delegated act requires a DPP, a product may be placed on the market or put into service only if a passport is available for it. The data in it must be accurate, complete, and up to date. A DPP is therefore not a document you file once; it is a live record that has to stay correct for as long as the passport must remain available.

ESPR itself does not list a fixed data set for every product. Each delegated act decides the details for its product group:

• Which data the passport contains, chosen from the elements listed in Annex III of ESPR.
• The type of data carrier and where it is placed — on the product, its packaging, or accompanying documentation.
• Whether the passport is kept at model, batch, or item level.
• How the passport is made accessible to customers before purchase, including in distance selling.
• Who may access which data, and who may update it.
• How long the passport must stay available — at least the expected lifetime of the product.

The building blocks: identifier, data carrier, access, and storage

Articles 10 to 13 of ESPR set essential requirements that apply to every DPP, whatever the product group. They are what make a passport different from a PDF on a website: a persistent identifier, a physical link to it, open standards, and defined access rights.

DPP timeline: what is in force, what applies, what is indicative

The most common planning mistake is mixing up three kinds of date: when a law entered into force, when an obligation actually applies to products, and when the Commission merely plans to adopt a rule. The table separates them. Under Article 4(4) of ESPR, a delegated act normally applies no earlier than 18 months after it enters into force, so an indicative adoption year is not the year products must comply.

As of October 2026, no ESPR product-group delegated act requiring a passport appears to be in force: the Commission’s DPP page still lists iron and steel, the first group, for Q4 2026. That is an inference from official sources, so re-check the current position before relying on it.

Which products need a passport first

Batteries come first. Under Article 77 of the Batteries Regulation (EU) 2023/1542, from 18 February 2027 each light means of transport (LMT) battery, each industrial battery with a capacity above 2 kWh, and each electric vehicle battery placed on the market or put into service must have an electronic record, the battery passport. Its content is set in Annex XIII in three access tiers: information for the public; for notified bodies, market surveillance authorities, and the Commission; and for persons with a legitimate interest. Separately, a QR code is required on all batteries from the same date under Article 13(6).

Toys follow under the new Toy Safety Regulation (EU) 2025/2509, which applies from 1 August 2030. Before placing a toy on the market, the manufacturer must create a DPP for the toy model (Article 19). It must state that compliance has been demonstrated, be available for 10 years, and link through a data carrier to a persistent unique product identifier. Recital 54 explains that the toy DPP replaces the EU declaration of conformity used under the Toy Safety Directive.

ESPR product groups come through the working plan. The first priorities are iron and steel, textiles and apparel, tyres, aluminium, furniture, and mattresses, plus horizontal rules on repairability and on recycled content and recyclability of electrical and electronic equipment. All adoption years in the plan are indicative. For textiles, an adoption in 2027 plus the usual minimum of 18 months means passport obligations are unlikely to apply before 2028–2029 — an estimate, not a legal date.

Other sector laws can also require passports. The registry rules in Implementing Regulation (EU) 2026/1778 cover passports required under ESPR and under the rules on batteries, construction products, toys, detergents, and other Union law. The Commission’s DPP page shows a construction-products DPP act for Q2 2027 as an expected date.

The EU DPP registry and the harmonised standards

Article 13 of ESPR required the Commission to set up a digital registry by 19 July 2026, and the Commission reports it operational from 20 July 2026. Implementing Regulation (EU) 2026/1778, in force since 6 August 2026, sets how it works. Access is through a secure website or an API, and only verified economic operators may register (verification lasts at most three years). Products are registered at model, batch, or item level as the applicable law requires; where rules differ, the most granular level is used, and for item-level passports the batch and model identifiers are also registered where they exist. After automated checks, the registry issues a persistent unique registration identifier. Member States must appoint a national administrator by 18 February 2027, and where no other period is set, data is deleted after 10 years.

The registry stores identifiers, not the full passport. At a minimum ESPR names the unique identifiers, commodity codes for imported products, and battery identifiers. The passport data itself stays with the operator or its DPP service provider.

The technical standards were cited by Implementing Decision (EU) 2026/1736 on 14 July 2026. The Commission’s DPP page says a decision on two further standards is expected in November 2026.

What data a DPP typically holds

Because each delegated act chooses its own data set, there is no universal DPP template yet. The two most concrete references today are Annex III of ESPR, which lists the elements a delegated act may require, and Annex VI Part I of the Toy Safety Regulation, which sets the minimum content of a toy passport. Read together, they show the kind of data to collect now. The last column lists where that data usually lives in a supplier’s documents.

Who does what: economic operators and DPP service providers

Responsibility for a passport sits with the economic operator that places the product on the market — usually the manufacturer, or the importer for products made outside the EU. Others in the chain have narrower roles. Online sellers should note that the product law decides what a listing must show; for toys, for example, Article 14 of the Toy Safety Regulation requires online marketplaces to let sellers display the CE marking, warnings, and the DPP data carrier or a weblink.

How to prepare product data now

Most of the data a passport will need already exists — scattered across supplier PDFs, ERP records, and spreadsheets. The slow part is finding, structuring, and governing that data, whichever product group you are in.

1. Inventory your data sources: supplier data sheets, declarations of conformity, test reports, safety data sheets, labels, manuals, and bills of materials. Note which supplier owns each document and how current it is.
2. Fix your identifiers: decide what identifies a model, a batch, and an item in your catalog. Check that GTINs follow GS1 rules, that model numbers match packaging, and that importer details include an EORI number where you import.
3. Structure the data: one value per field, one field per attribute, units stored separately from values, and multi-model tables split so every value belongs to one model.
4. Link every value to its evidence: record which document and which version a value came from, so you can show where it came from and update it when the source changes.
5. Separate public from restricted data: passports grant different access to customers, authorities, and others, so tag fields by likely audience now.
6. Set governance: assign an owner per data group, define review and approval, and plan how long you keep data — at least the expected product lifetime under ESPR and 10 years for toy passports.
7. Update supplier requirements: ask suppliers for structured data and machine-readable documents, and for notice when materials, components, or certificates change.
8. Track your product group: follow the delegated act for your group and the remaining standards, and agree early who will host the passport — your own systems or a DPP service provider.

Common misconceptions about Digital Product Passports

Several claims circulate widely that do not match the legal texts:

• “Every product needs a DPP from 2027.” No. Only products covered by a delegated act or a sector law need one, and only from the date that act applies. The 2027 date is the battery passport.
• “Registering in the EU registry proves compliance.” No. Article 13 of ESPR states the registration identifier is not proof of compliance.
• “A DPP is a QR code.” The QR code or other carrier is only the link. The passport is the data behind it, plus the access, storage, and update rules.
• “Any software format will do.” ESPR requires open, interoperable, machine-readable standards without vendor lock-in, and harmonised standards now exist for identifiers, carriers, storage, APIs, and interoperability.
• “The DPP replaces the declaration of conformity everywhere.” That replacement is specific to toys under the new Toy Safety Regulation. Under ESPR, the declaration of conformity is one of the data elements a passport may contain.
• “The ban on destroying unsold clothes is part of the DPP.” It is a separate ESPR obligation (Article 25) that already applies to large enterprises from 19 July 2026.

Preparing DPP data from supplier documents at scale

For catalogs with hundreds of supplier PDFs, the bottleneck is extraction and review rather than the passport format. Doc2Shelf reads supplier documents, extracts identifiers, operator details, materials, standards, and warnings into structured fields — each extraction carries a confidence score and a completeness score — and exports DPP-oriented structured JSON from the reviewed product record for review and downstream implementation. It does not create, register, host, deploy, or validate a completed Digital Product Passport; that remains with your systems or a DPP service provider.