Digital Product Passport

What is the Digital Product Passport?

The Digital Product Passport (DPP) is a structured, machine-readable digital record of product information, linked to a physical product through a data carrier such as a QR code, which the European Union makes mandatory under the Ecodesign for Sustainable Products Regulation (ESPR). The passport tells you what a product is made of, what its environmental impact is and how it can be repaired, reused or recycled. For manufacturers the DPP is above all a data challenge: the information lives in ERP, PLM, MES and on the shop floor, and it has to remain available, trustworthy and secure for many years.

🧱 What is the legal basis of the Digital Product Passport?

The foundation is Regulation (EU) 2024/1781, the Ecodesign for Sustainable Products Regulation. It was published in the Official Journal on 28 June 2024 and entered into force on 18 July 2024. The ESPR is a framework law: for each product group the European Commission adopts a delegated act that sets the ecodesign requirements and specifies which data the passport must contain. Until such an act exists, a product group has no DPP obligation.

The key articles of the ESPR are:

• Article 9 — a product may only be placed on the market if the required passport is available, with a unique product identifier, a data carrier and machine-readable data
• Article 10 — technical requirements: open, interoperable standards, differentiated access rights and an up-to-date backup copy held by a DPP service provider, which the ESPR defines as an independent third party
• Article 13 — a central DPP registry run by the Commission and connected to the customs single window, so customs can check at import that a passport exists

Running in parallel is the Batteries Regulation (EU) 2023/1542. Its Article 77 requires a battery passport from 18 February 2027 for electric vehicle batteries, light means of transport batteries (e-bikes, e-scooters) and industrial batteries above 2 kWh. In practice, the battery passport is the first large-scale DPP.

🗓️ When does the Digital Product Passport become mandatory?

Note that the years for product groups are the expected adoption dates of the delegated acts, not the dates on which the obligation starts to apply. The exact application date follows from each act; as a rule the ESPR requires at least 18 months between an act’s entry into force and its application. The April 2025 working plan prioritises steel, aluminium, textiles (with apparel as the top priority), furniture, tyres and mattresses, plus horizontal requirements on the repairability and recyclability of electronics.

🧠 What does a Digital Product Passport contain?

The exact mandatory fields differ by product group, but Annex III of the ESPR and the Batteries Regulation follow a consistent pattern:

👥 Who can see which data?

The ESPR uses differentiated access rights. Part of the passport is public for consumers; sensitive information is reserved for parties with a legitimate interest, such as repairers, recyclers and market surveillance authorities. Trade secrets such as exact formulations or supplier names therefore do not have to be made public.

This turns the passport into a matter of access control and identity management: who counts as an accredited recycler, how does a market surveillance authority authenticate, and how are rights transferred when a product changes hands? The European standards EN 18239 (access rights, information security and business confidentiality) and EN 18246 (data authentication, reliability and integrity) address exactly these questions.

🔧 How do data carriers and standards work?

On or with the product sits a data carrier: usually a QR code, sometimes a Data Matrix code or an NFC tag. It points to a web address where the passport can be retrieved. GS1 Digital Link turns an existing GTIN into such a URL, so a single code serves both the checkout and the passport.

The joint technical committee CEN-CENELEC JTC 24, working under Commission standardisation request M/604, has drafted eight horizontal standards. Six of them were cited as harmonised standards on 15 July 2026 through Implementing Decision (EU) 2026/1736: EN 18216 (data exchange protocols), EN 18219 (unique identifiers), EN 18220 (data carriers: QR code, Data Matrix and RFID/NFC), EN 18221 (data storage, archiving and persistence), EN 18222 (APIs) and EN 18223 (system interoperability). The two security standards, EN 18239 and EN 18246, were approved in July 2026; their citation in the Official Journal is still to come.

🏭 How does the DPP connect to industrial data?

Manufacturers do not have to build the passport from scratch. The Asset Administration Shell (AAS) from Industry 4.0 is a standardised digital twin that captures product information in submodels. Together with Catena-X and members of the Battery Pass project, the Industrial Digital Twin Association (IDTA) developed the IDTA 02035 series: seven submodels for the battery passport, aligned with the German specification DIN DKE SPEC 99100. They include Digital Nameplate, Product Carbon Footprint, Material Composition and Circularity.

Catena-X is the data ecosystem of the European automotive industry, built as a data space: companies share data directly through connectors and keep control over who may see what. That principle of data sovereignty fits well with the access rights of the DPP.

The shop floor is often the source of the most valuable fields. The MES knows the batch, the raw materials consumed and the process parameters (tracking and tracing); energy meters and the OPC UA layer provide consumption per order for the carbon footprint. A Unified Namespace or DataOps layer makes this OT data available to the passport platform without external systems talking directly to PLCs.

🔐 How do you protect the integrity of the passport?

A passport with fake carbon figures or a forged origin undermines the entire system. Key measures:

• Digital signatures — sign passport records and changes with certificates so recipients can verify who recorded what (certificate management becomes critical)
• Versioning and audit trail — changes are recorded rather than overwritten, so authorities can trace the history
• Separated data flow — export OT data through a controlled DMZ or data diode, never through direct inbound access to the production network
• Secure components — software and connectors that deliver the passport often fall under the Cyber Resilience Act, which applies in full from 11 December 2027

🛠️ How should a Dutch manufacturer prepare?

1. Determine your product groups — are you covered by the Batteries Regulation or a priority group in the working plan? Follow the Commission’s draft acts and consultations.
2. Choose your identification level — model, batch or individual item. This determines how much data the MES has to record.
3. Map your data sources — which fields come from ERP, PLM, MES, energy metering and suppliers? Close the gaps, especially for carbon and material data.
4. Choose a data model — use the IDTA AAS submodels or the Catena-X models instead of a proprietary format.
5. Sort out identification and data carriers — GS1 membership, GTINs, GS1 Digital Link and a process for printing QR codes on the line.
6. Design access and security — roles, signatures, a backup with a DPP service provider and a secure link to the OT environment.
7. Register your organisation — the DPP registry has been operational since 20 July 2026, and you can already sign up as a verified economic operator (via eIDAS).

❓ Frequently asked questions

Which products need a Digital Product Passport?

A Digital Product Passport is mandatory once a delegated act under the ESPR requires it for a product group. The first mandatory passport is the battery passport from 18 February 2027. The acts for steel, aluminium, textiles, tyres and furniture are expected between late 2026 and 2028, and the passport obligation normally applies only at least 18 months after that.

What is the difference between the battery passport and the Digital Product Passport?

The battery passport comes from the Batteries Regulation (EU) 2023/1542 and is a specific form of the Digital Product Passport. The ESPR is the general framework for other product groups; both rely on the same principles of unique identification, a QR code and tiered access rights.

Who is responsible for the Digital Product Passport?

The economic operator placing the product on the EU market, usually the manufacturer or importer, is responsible for a correct and up-to-date Digital Product Passport. That party must also have an up-to-date backup copy kept by an independent DPP service provider and register the passport in the European Commission’s DPP registry.

Do trade secrets have to be shared in the Digital Product Passport?

No, the Digital Product Passport has several access levels. Consumers only see public data, while sensitive information is available only to parties with a legitimate interest, such as recyclers and market surveillance authorities.

What role does the Asset Administration Shell play in the Digital Product Passport?

The Asset Administration Shell provides a standardised data model in which Digital Product Passport data can be captured and exchanged as submodels. The IDTA has already published such submodels for the battery passport, giving manufacturers that use the AAS a head start.

Is a QR code mandatory for the Digital Product Passport?

The ESPR requires a data carrier but not necessarily a QR code; the EN 18220 standard covers Data Matrix and RFID/NFC alongside the QR code. In practice the QR code is the most common carrier for the Digital Product Passport, and the battery passport must be accessible through a QR code.

📌 In summary

The Digital Product Passport makes data on origin, materials, carbon footprint and repair digitally available by law, starting with batteries on 18 February 2027. Manufacturers that already capture MES, ERP and OT data in a standard such as the Asset Administration Shell, and protect its integrity with signatures and access control, will be ready for every product group that follows.