We passed verification in the DPP Registry test environment. Enrol a sole trader as a natural person and copy your certificate letter for letter

On 12 October 2026 we completed organisation verification in the test environment of the EU Digital Product Passport Registry (acceptance, version 1.0.12). The registry answered "Verification Request Successful" and switched on DPP registration for our organisation. In August the same path ended in a rejection, which we described screen by screen. This is the follow-up: what changed, what actually works for a sole trader in Poland, and the traps that cost us the first attempt. One thing first: this is the test environment, not production. The Commission user guide says verification there is the same as in production and requires valid organisation data and real signatures, which is why the result is worth reporting. It is not a production account and we do not claim one.

What changed since August

• Enrolment works. In August, creating and editing the organisation kept ending in a generic system error, a server-side fault the helpdesk confirmed. In version 1.0.12 the organisation form saves and the whole path can be walked.
• There is a new user guide. Version 1.03 of the DPP Registry User Guide for Economic Operators was published on 16 September 2026 and has 63 pages. Version 1.01 of 28 July had 56. The Commission links it from its DPP Registry page.
• The address limit went up. The unique product identifier (UPI) you register may now be up to 2000 characters long instead of 50. We tested it, see below.
• Passport registration is still not possible. For anyone. More on that below too.

Why we were rejected the first time

Our application of 21 August was rejected for two reasons, and both were ours. We uploaded the declaration without any signature of our own, and we had set the organisation type to Legal Person, although DPPera is run as a sole proprietorship, in Poland called a JDG.

The rejection report listed seven errors. Read with hindsight, every one of them follows from the missing signature: an empty signature format where PAdES was expected, an untrusted certificate, a missing countersignature, one signature instead of exactly two, a data mismatch, and the line "Legal persons must use a qualified electronic seal". As we wrote then, the report is a list of everything that can go wrong, not a diagnosis. Find the one cause before you act on seven symptoms.

Step one: a sole trader is a natural person

This is the decision that shapes everything else, and the form does not explain it. The registry has two organisation types, and each comes with its own kind of qualified credential.

• Natural Person is an individual acting in their own name. A sole trader is exactly that: the business has no legal personality separate from its owner. A natural person signs the declaration with a qualified electronic signature (QES), and the registry compares the given name, surname, country and identifier in the form with the certificate.
• Legal Person is an organisation with its own legal personality. It needs a qualified electronic seal (QSeal), and the organizationName and organizationIdentifier in the seal certificate must match what you typed in the form.

Guide 1.03 now says it in so many words: a qualified electronic signature where the economic operator "is a Natural Person acting as sole trader". Choose Legal Person as a sole trader and you need a seal certificate whose organisation data matches the form. Choose Natural Person and a personal qualified signature is enough. In August the helpdesk wrote to us that switching between the two types is meant to be possible at any stage of enrolment. In October it was: we changed the type in the same application (Organisation Information, Edit) without creating the organisation again. Our October application went in as a natural person.

Step two: get a qualified signature. In Poland there is a free one, with a catch

We signed with the free qualified signature built into mObywatel, the Polish government app. Since October 2025 it lets an adult holder of an electronic ID card sign five PDF documents a month with a qualified signature, as the Ministry of Digital Affairs describes it. You pick a provider from a list. We picked mSzafir, operated by KIR.

What it took in practice:

• an e-dowód, the Polish ID card with a chip, and the CAN number printed on it;
• a phone with NFC to read the card;
• a PDF file, because the service signs PDFs only, and it signs them in PAdES, the format the registry asks for;
• no PIN. In our run the identity check was done by reading the card.

The trap: mObywatel has two services with similar names. "Podpis kwalifikowany" (qualified signature) is the one you need. "Podpisz dokument" (sign a document) produces the personal signature, "podpis osobisty", which is not a qualified signature, and the registry requires a qualified one.

The catch: the government describes the free signatures as intended for private matters. A business declaration is not obviously a private matter, so before you use it for a production account, read the terms. Paid options are not expensive. On the vendors' sites in October 2026 we found a one-time mSzafir signature for 15 PLN net, a long-term mSzafir certificate from 238 PLN net, and Certum SimplySign for 299 PLN net plus 199 PLN net for video identity verification.

Step three: sign a dummy PDF first and read your certificate

This is the trick that made the second attempt pass, and it costs one of the five free signatures. Before you fill the organisation form, sign any throwaway PDF with the same service and look at the certificate inside it. The registry compares four attributes of the certificate subject with your form: givenName, surname, countryName and serialNumber.

Two details of our certificate would have tripped us if we had filled the form from memory:

• The names are in capitals, with Polish letters. Given name and surname appear in UPPERCASE, diacritics included. We typed them into the form exactly that way. We did not test whether the comparison ignores case, and a real application is not the place to find out.
• The identifier is not a bare number. The serialNumber attribute reads "PNOPL-" followed by the PESEL number. PNO is the code for a personal number, PL is the country, then comes the number itself.

In the form we chose the identifier type PNO and typed the full value, "PNOPL-" plus the PESEL, exactly as it stands in the certificate. It passed. The user guide says the identifier must match the certificate attribute fully, not partially, so we did not experiment with the bare PESEL.

To read the certificate, follow the guide: in the PDF reader open the Signature Panel, then Certificate Details, the Details tab and the Subject property. Or use the openssl command from our August walkthrough, which prints the whole subject line. In August we also wrote that a natural person in Poland would have to choose between TIN (the NIP tax number) and PNO (the PESEL) and that only one would match. For our signature it was PNO. Check yours with a dummy signature, because that is the whole point of the exercise.

Step four: sign the declaration and check the file before you upload it

The order from August still holds: get the organisation record right first, then request the sealed declaration, because the request locks the data. Then:

1. Download the declaration sealed by the Commission and do not open and re-save it in any editor. The only change allowed is adding your signature.
2. Sign it with the qualified signature. Our file came back in PAdES: SubFilter ETSI.CAdES.detached, baseline B, without a timestamp. The registry accepted it. The guide accepts PAdES Baseline B, T, LT and LTA.
3. Check the signed file in the Commission's free DSS validation tool, which the user guide itself recommends. The signature format has to be one of the PAdES-BASELINE levels, and the Qualification field has to show QESig for a natural person. If it shows AdESig-QC, the signature was made with a software certificate and verification will fail.
4. Upload the file, submit it, and watch the status in the Activity Dashboard.

The guide also warns that Adobe Acrobat may by default embed a signature format that is not PAdES, and tells you to set the Default Signing Format to CAdES-Equivalent in the signature preferences. If you sign in Acrobat with a certificate from another provider, do that first and check the result in DSS.

The Commission still cannot print Ł

The defect we reported in August is still there in version 1.0.12. The declaration PDF generated by the Commission prints the Polish letter Ł as a hash, so the name in our declaration reads "#UKASZ G#UCH". The web form shows the name correctly.

The good news is that it does not block verification. Ours passed with hash marks in the document, because the registry compares the data in the form with the attributes of the certificate, not with the text printed in the PDF. It is still a document a person signs with a qualified signature, so keep a copy of what it says.

The result, and what it switches on

After upload and submission the dashboard showed "Verification Request Successful" and the registry announced "DPP registration is now available". The account that submitted the application became the Administrator of the organisation. That is the whole verification path, completed, in the test environment.

Then we tried to register a passport

Verification switches on the DPP Registration tab. There are two ways in: an online form for a single passport and a file upload for many.

• The online form asks for the granularity (for batteries only Item is offered), the UPI, and optionally a batch identifier and a model identifier.
• The file upload uses a template in JSON or XML, schemaVersion 1.0.0. It is minimal: productGroup BATTERIES and a list of items, each with a uniqueProductIdentifier. The XML root element is dppRegistrationBatch in the namespace urn:eu:europa:ec:dpp:registry:batch:v1. One file holds up to 100 UPIs, and one bad UPI rejects the whole file.

What happened:

• A real DPPera passport address, https://dppera.com/p/ followed by the passport identifier, ended in FAILURE with the errorCode SEMANTIC_VALIDATION_UNAVAILABLE, both in the form and in a file. That is the expected answer while the semantic catalogue is missing.
• The example addresses from the template itself, on eo.example.eu, ended differently: "The UPI is not resolvable", errorCode VALIDATION_RETRY_EXHAUSTED, after about four minutes. So the registry really fetches each UPI before it gets to semantic validation. Our address passed that check; the made-up ones did not.
• A 98-character UPI and an https://www. address with one 301 redirect to the bare domain both passed the address check and stopped only at the semantic error. The 2000-character limit from guide 1.03 is real.

Our advice has not changed: register the https address on the bare domain that answers directly. A single redirect got through in our test, but the guide still rejects excessive redirects without saying where "excessive" starts, and the final validation is not running yet.

What nobody can do yet

• Register a passport. The Commission has not published the semantic catalogue for batteries, the only product group on offer, so every registration ends at semantic validation. Verified or not, nobody gets further.
• Register through an API. System-to-system registration is not described in guide 1.03. The helpdesk told us in August that it was planned for the fourth quarter of 2026.
• Manage Unique Operator Identifiers. The registry home page lists "Register and Manage Unique Operator Identifiers (UOIs)" among the available operations. There is no such menu item, and guide 1.03 does not mention it. We are watching it.

What we changed in DPPera

Two small things, because the template turned out simpler than we expected. Battery passports at item level can now be exported from the passport list as a "DPP Registry file", in JSON or XML following the Commission template and split into files of at most 100 UPIs. And the editor now counts the passport address against the 2000-character limit instead of 50. Neither registers anything for you. Registration is done by your organisation, in your own account, once the Commission makes it possible.

Checklist for a sole trader

1. Create an EU Login account and start enrolment with the organisation type Natural Person.
2. Decide which qualified signature you will use. In mObywatel it is "Podpis kwalifikowany", not "Podpisz dokument". For business use, read the terms or buy a paid certificate.
3. Sign a dummy PDF and read the certificate subject: givenName, surname, countryName, serialNumber.
4. Fill the form exactly as the certificate says: the names in the same letters and case, identifier type PNO, and the value in full, "PNOPL-" plus the number.
5. Only then request the sealed declaration, because it locks the data.
6. Sign the downloaded PDF without re-saving it, check it in DSS, upload it and submit.

What we do not know yet

• How the free mObywatel signature fits a production account. Technically it passed in the test environment. Whether a business declaration fits the service terms is a question for the terms, not for the registry.
• How renewal works. The guide says the success report gives the expiry date of the signature or seal, and the verification status ends with it. Implementing Regulation (EU) 2026/1778 also caps it at three years, whichever comes first. Read that date in your report and put it in the calendar. We will describe renewal when we get there.
• What semantic validation will check once the catalogue exists. Until then nobody knows the final list of reasons a passport can be refused.

FAQ

Łukasz Głuch

Builds DPPera, a digital product passport tool for small and medium-sized companies. Reads the delegated acts so you do not have to. Writes about what he checked in the registry, not about what vendors promise.

LinkedIn