Digital product passport: EU rules, dates, and how to prepare

What is a digital product passport?

A digital product passport, or DPP, is a structured digital record linked to a product, component, or material through a unique identifier and a data carrier such as a QR code. A scan can open a human-readable page, while systems retrieve the same underlying data in a structured format.

The EU's main legal framework is the Ecodesign for Sustainable Products Regulation, known as ESPR. Separate EU laws also create DPP requirements for categories including batteries, construction products, toys, detergents, and surfactants.

Five parts work together:

A DPP is more than a label or a product page. It needs accurate source data, a defined update process, controlled access, long-term availability, and a portable technical design.

We approach DPP readiness as a product data problem first. We already help brands normalize, structure, and publish machine-readable commerce data. That foundation is useful, but it is only one layer of a compliant passport. Brands will also need category-specific compliance fields, supplier evidence, lifecycle processes, and registry integration.

How a digital product passport works

The exact workflow depends on the applicable product law, but the operating model is consistent:

1. The responsible economic operator collects the required data. Sources may include a product information management system, enterprise resource planning software, bills of materials, lifecycle assessments, supplier declarations, certificates, and service records.
2. The product receives an identifier at the required level. The relevant law decides whether the passport represents a model, a production batch, or one serialized item.
3. The operator creates the structured record and registers the required metadata. The passport data is decentralized and remains with the operator or its service provider. The EU registry indexes and verifies passports; it does not hold every passport field.
4. A data carrier links the product to the record. Its form and placement are set by the category rules. Online sellers also need to make the relevant carrier or identifier available before purchase.
5. Each user receives role-appropriate information. Consumers may see materials and care guidance, repairers may see disassembly details, and authorities may access compliance evidence.
6. Authorized parties maintain the record. Updates, access, retention, backup, and eventual replacement follow the rules for that product group.

The scan experience matters, but the structured record behind it is the passport. A static landing page with ungoverned claims does not meet the ESPR's requirements for interoperability, accuracy, persistence, and controlled access.

What information goes in a digital product passport?

There is no universal DPP field list. Each delegated act or sector law defines the required fields, granularity, access rights, and retention period for its products.

The likely data groups are already clear:

One field may have several layers. A consumer could see that a jacket contains recycled polyester, while an authority sees the declaration and evidence supporting that value. The data model therefore needs to track the value, unit, source, owner, evidence, access class, and update rule. A long text description cannot carry that governance reliably.

Which digital product passport requirements are fixed?

ESPR sets the system-level requirements. Product-specific acts fill in the operational details.

The framework does not require blockchain or make one commercial identifier scheme universal. A GTIN and GS1 Digital Link are useful choices where the category's rules and identifier standards allow them.

The EU digital product passport timeline

The EU DPP Registry became operational on 20 July 2026. Six harmonized standards now cover data exchange, identifiers, data carriers, storage and persistence, lifecycle APIs, and system interoperability. This is an infrastructure milestone, not a blanket deadline for every product sold in Europe.

The European Commission's current timetable separates fixed obligations from planned delegated acts:

For ESPR categories, the date shown in the working plan is usually the target for adopting a delegated act. The act normally starts applying no earlier than 18 months after it enters into force. Claims that every textile needs a DPP in 2027 or 2028 turn an indicative rulemaking date into a compliance deadline.

Who needs a digital product passport?

The obligation applies when a product falls within an applicable EU law and is placed on the EU market or put into service. Manufacturing location does not change that test.

The accountable party is the economic operator identified by the relevant law. Depending on the route to market, that may be a manufacturer, importer, authorized representative, or another EU-established operator. Distributors, dealers, and online marketplaces also have duties around making the passport accessible and avoiding the sale of non-compliant products.

This means a US or UK brand can be in scope when it sells covered goods into the EU. It also means an EU business does not need a DPP for every product immediately. Scope starts category by category as the relevant acts apply.

How to prepare your product data

Detailed schemas will continue to evolve, but the slowest work can start now.

1

Map products to laws and accountable entities

Create a scope register by product category, commodity code, destination market, legal entity, and route to market. Record the applicable EU law, delegated-act status, expected granularity, and the operator responsible for the passport. This prevents a company-wide deadline from replacing the real category-level rules.

2

Build a field-level data inventory

Start with identity, composition, origin, compliance, repair, and end-of-life data. For every field, record:

• the system of record;
• the data owner and approver;
• the evidence behind the value;
• its model, batch, or item scope;
• access classification;
• validation and refresh rules;
• translation requirements.

Our guides to product attributes and product data quality show how to define reusable fields and test accuracy, completeness, consistency, validity, and freshness.

3

Fix the identity hierarchy

Connect product families, models, variants, batches, and serialized units without losing their relationships. Define how a recall, component change, repair, or replacement creates a new record or links to an earlier one. Identifier mistakes become expensive once labels are printed and products move across the supply chain.

4

Collect evidence with supplier data

Do not treat a filled field as a verified field. Keep the supplier declaration, test report, calculation method, certificate, or lifecycle assessment that supports it. Track validity dates and the products or batches each document covers.

This is already the most common operational blocker. In KPMG's 2026 survey of more than 70 European organizations, 31% named supplier and value-chain data collection as their main DPP challenge. Technical requirements came next at 25%. The survey is directional rather than representative, but the gap is familiar: a QR implementation moves quickly, while evidence gathering does not.

DPP readiness challenge	Share of surveyed organizations
Collecting data	31%
Technical requirements	25%
Technology constraints	14%
Cross-functional alignment	14%
Budget constraints	11%
Senior-level support	3%
Other	2%

5

Separate source data, evidence, and published views

Keep one governed product record, then publish different views for consumers, repairers, recyclers, business partners, customs, and market-surveillance authorities. This protects confidential information and avoids maintaining several conflicting passports.

6

Pilot the full lifecycle

Test more than the first scan. A useful pilot covers identifier creation, registry submission, public and restricted access, data updates, supplier corrections, translations, backup, provider migration, record linking, and access after a product is discontinued. Include API and bulk workflows so the process can scale beyond a handful of showcase products.

Catalog can normalize and structure the commerce data that feeds this foundation, while keeping source provenance visible. A DPP program will still need legal ownership, supplier and sustainability inputs, category-specific validation, and an approved path to the EU registry.

Common digital product passport mistakes

Buying a QR generator before defining the record. The code only resolves an identifier. It cannot fix weak source data or missing evidence.

Treating an adoption target as a deadline. Working-plan dates often refer to delegated acts. Application usually follows after a transition period.

Waiting for every field to be final. Identity, source ownership, evidence, supplier workflows, access classification, and data quality take longer than schema mapping.

Copying the PIM into a passport. Commercial product data is useful, but it rarely includes every regulatory, environmental, supplier, and lifecycle field.

Locking the passport to one vendor. ESPR requires transferability and interoperability without vendor lock-in. Export, resolver, backup, and migration rights belong in procurement requirements.

Digital product passport FAQ

If fragmented product data is your first DPP blocker, book a demo to see how we turn product records into a structured, governed data layer.