Most lists of digital product passport challenges talk about blockchain, interoperability and “data silos”. Small brands hit something more ordinary: the rules for their product are not written yet, the data sits with suppliers, two early choices are permanent, the standards cost money, the EU registry does not take passports, and the law expects the passport to outlive the company that made it. Below are ten challenges, the provision behind each, and what to do now.
1. The rules for your product do not exist yet
Outside batteries, a passport becomes mandatory only through a delegated act under the ESPR, Regulation (EU) 2024/1781. By 20 October 2026 no act requiring a passport for a product group had been adopted. The textiles initiative had not moved since December 2025 and none of its consultation stages had opened. For iron and steel the consultations closed on 12 August 2026, but the draft act had not been published. Once an act exists, Article 4(4) gives at least 18 months before it applies, except in duly justified cases.
What to do now: prepare the parts that do not depend on the act. Annex III of the ESPR already lists the building blocks an act chooses from: identifiers, commodity codes, compliance documents, manuals, manufacturer and importer details. Keep the date of your own category in view on the industries and deadlines page, and avoid multi-year contracts priced for requirements nobody has written.
2. Your data sits with your suppliers
Composition, origin, recycled content and certificates usually come from the supply chain, not from your own systems. The law does not accept approximations: Article 9(1) ESPR and Article 77(4) of the battery regulation require passport data to be accurate, complete and up to date, and the responsibility stays with the operator placing the product on the market.
What to do now: add a data clause to your next purchase orders. Ask for composition, country of origin and certificates in a structured file, with the document that proves each value. Suppliers answer faster when the request is part of the order, not a separate project.
3. Two choices you cannot undo
The first is the level: a passport describes a model, a batch or a single item (Article 9(2)(d) ESPR). Once a product is sold under one level, you cannot switch it. The second is the identifier: Article 10(1)(a) requires a persistent unique product identifier, so the code you print must keep working for the lifetime of the product, whatever happens to your domain, your shop system or your provider.
What to do now: answer the eight questions on model, batch or item, and read why you do not need GS1 before anyone sells you barcodes as a precondition.
4. The standards are new, partly cited and paid
On 15 July 2026 Implementing Decision (EU) 2026/1736 cited six passport standards under the ESPR: EN 18216, EN 18219, EN 18220, EN 18221, EN 18222 and EN 18223. Two more, EN 18239 on access rights, security and confidentiality and EN 18246 on data authenticity, were published by CEN on 16 September 2026 but had not been cited in the Official Journal by 17 October 2026. All of them are sold by standards bodies, so a small brand rarely reads them.
What to do now: you do not have to buy the standards, but your provider should know them. Ask which standards and which editions their system follows, and how they will handle the two that are not cited yet. Our six standards in plain language and fourteen questions for a provider help.
5. The EU registry does not accept passports yet
The registry has been live since July 2026, and organisations can enrol and verify. Verification under Implementing Regulation (EU) 2026/1778 needs a qualified electronic seal for a company, or a qualified signature or high-level eID for a natural person, and it expires after three years or with the credential. Passports themselves cannot be registered: on 12 October 2026 every attempt ended with SEMANTIC_VALIDATION_UNAVAILABLE. The Commission helpdesk expects the registry API in the fourth quarter of 2026.
What to do now: enrol early, because a rejected declaration starts over. Our verification walkthrough and the guide for sole traders with a qualified signature show the traps.
6. Nobody has decided who may see what
A passport has a public part and restricted parts. For batteries, Article 77(2) sets three tiers, but the rules on who has a legitimate interest come from an implementing act under Article 77(9), and its draft had not been published by 17 October 2026. Under the ESPR, Article 9(2)(f) leaves access to each delegated act.
What to do now: tag every field with its tier today and choose a system where tiers are configuration, not code. Background in the battery access rights deadline.
7. The passport must outlive you, and needs a backup
Under Article 9(2)(i) ESPR a passport must stay available for at least the expected lifetime of the product, and under Article 11(e) also after your insolvency or liquidation. Article 10(4) requires a backup copy made available through a passport service provider, which Article 2(32) defines as an independent third party, and Annex III(l) puts the reference of that provider in the passport itself. A backup on your own server does not meet that rule. The battery regulation has no backup article, but Article 78(e) still requires the battery passport to remain available after the responsible operator ceases to exist.
What to do now: ask any provider for its exit plan. What keeps your passports online if they close, and what if you do? The delegated act on passport service providers (initiative 14382) has no draft yet, so there is no official list of recognised providers to lean on.
8. A passport changes after the sale
Data must stay up to date, and the delegated act decides who may update what (Article 9(2)(g) and (h) ESPR). Some events create a new passport: a repurposed or remanufactured battery gets a new one linked to the original (Article 77(7) battery regulation), and Article 11(d) ESPR has the same linking rule.
What to do now: name one person who owns updates and keep a version history. When an inspector asks what the passport said on the day of sale, you need an answer, not a guess.
9. Every market wants its own language
Article 7(8) ESPR requires information in a language easily understood by customers, as decided by the Member State where the product is sold. The delegated act will also say how customers reach the passport before they buy, including online (Article 9(2)(e)), and dealers and marketplaces can ask you for a digital copy of the code, which you must send within five working days (Article 10(3)).
What to do now: keep text fields separate from values. Numbers, codes and percentages need no translation; care instructions and safety texts do. A passport built that way adds a language as one more column, not as a copy of the whole passport.
10. The bill is mostly data work
Software is usually the smaller part of the cost. Collecting, checking and documenting supplier data takes weeks of somebody’s time, and quotes from vendors rarely include it. We broke the budget down in what a DPP really costs a small brand.
What to do now: run one product end to end before you buy anything big. It shows where your data gaps are, which is the number that drives the real cost.
What is not a challenge
You do not need new labels in most cases: the code can go on the existing label or packaging, as we showed in you do not need new labels to start. You do not need a developer to begin. And there is no SME exemption to wait for, as who the DPP applies to explains.
If you want to work through the steps in order, our nine steps to create a passport follow the sequence that saves rework. To test one product without commitment, you can create two passports for free in DPPera.
FAQ
What is the biggest challenge of the digital product passport?
For a small brand, data. The technology is available; the composition, origin and certificate data has to come from suppliers, and it must be accurate and provable.
Should I wait until the delegated act for my product is adopted?
Not with everything. The level, the identifier, supplier data clauses and registry enrolment do not depend on the act and take the longest.
Is the digital product passport mandatory in 2026?
No. The first certain obligation is the battery passport from 18 February 2027. Other groups follow their delegated acts, each applying at least 18 months after entry into force.
Can a small company build a passport without a big platform?
Yes. The law requires open standards, a persistent identifier, access rules, availability and a backup, not a particular size of software.
Do I have to buy the DPP standards?
No law makes you buy them. Your passport has to meet the requirements; in practice you rely on a provider that follows the cited standards and can tell you which editions.
Łukasz Głuch
Builds DPPera, a digital product passport tool for small and medium-sized companies. Reads the delegated acts so you do not have to. Writes about what he checked in the registry, not about what vendors promise.
LinkedIn
