The last two passport standards are published. They decide who sees your data and whether a passport is genuine, and they are not harmonised yet

On 16 September 2026 CEN and CENELEC published the last two standards of the digital product passport family: EN 18239 on access rights management, information system security and business confidentiality, and EN 18246 on data authentication, reliability and integrity. All eight are now finished texts. Only six of them are in the Official Journal, cited by Commission Implementing Decision (EU) 2026/1736 on 15 July 2026, and only those six give a presumption of conformity with Articles 10 and 11 of the ecodesign regulation. The two that decide who may read your supplier list, and how a customs officer knows the page is not a fake, are published but do not yet count in the legal sense.

Eight published, six harmonised

The six cited standards cover the plumbing. EN 18216 is the exchange protocol, EN 18219 the identifiers for products, operators and facilities, EN 18220 the data carriers, EN 18221 storage and persistence, EN 18222 the APIs and lifecycle, EN 18223 interoperability. CEN issued them on 27 May 2026. We wrote about them in August, and the practical effect is unchanged: a passport built to those six numbers shifts the burden of argument to the authority.

The two newcomers close the family, and they are not marginal:

• EN 18239, Digital product passport, access rights management, information system security and business confidentiality. This is the standard for tiered access: who may read which part of a passport, how the system that serves it is secured, and how commercially sensitive data is protected.
• EN 18246, Digital product passport, data authentication, reliability and integrity. This is the standard for the question "is this passport genuine and unaltered": how data is authenticated and how a reader can check that nothing was changed.

The committee has not stopped at eight. Its work programme lists a ninth item, Digital Product Passport, Dictionary referencing: Concepts and principles, under drafting since 17 March 2026. It is at the earliest stage and has no vote date.

Where they stand, checked

We checked on 1 October 2026. The list of published standards of CEN/CLC/JTC 24, the joint technical committee for the passport, shows EN 18239:2026 and EN 18246:2026 with a publication date of 16 September 2026, next to the six from 27 May. The Commission page on harmonised standards for the passport lists one publication in the Official Journal: Decision 2026/1736, with the first six. That was still the case on 26 October. National editions are arriving one by one. The British BSI released BS EN 18246 on 18 September and BS EN 18239 on 21 September. The Spanish standards body UNE has endorsed both, and a standards shop lists them from 1 October. The Polish PKN shop had neither on the same day, and still had neither on 26 October.

Our August article said publication was expected later in 2026, with the citation to follow. Publication came on 16 September, two months after the formal vote that closed on 16 July. Some of our own September texts still called the two standards drafts after that date; we have corrected them.

The next step is the citation: a Commission decision that adds the two references to the Official Journal, by amending or supplementing Decision 2026/1736. There is no published date for it. Until it appears, EN 18239 and EN 18246 are voluntary technical documents like any other European standard: useful, citable, and without legal effect of their own.

What publication changes, and what it does not

• It ends the argument about drafts. A provider can now point to a final text, and you can ask which text they mean. Some shops still list the 2025 enquiry draft, prEN 18239:2025, which is not the same document.
• It does not give a presumption of conformity. Until the citation, following EN 18239 is good evidence of a sound design, not a legal shortcut. An authority can still ask you to justify your access design on its merits.
• It does not answer the legal questions the standards depend on. Who counts as a person with a legitimate interest in the battery passport is for an implementing act under Article 77(9) of the battery regulation, which was due on 18 August 2026. Initiative 16473 in the Commission register shows that a draft was published only on 19 October 2026, two months late, with feedback open until 16 November; it has not been adopted, and it lists roles without saying how anyone proves one. A standard can describe how a role is checked; it cannot decide who has the role.
• It does not set a deadline. Harmonised standards are voluntary even after citation. The dates that bind you come from the delegated acts and the battery regulation.

What is already settled, standards or not

Three sources had fixed the shape of access before either standard was published, and a passport built to that shape does not have to be rebuilt now.

• The Commission FAQ of December 2025 says access to the passport must be free of charge and easy, that general access is anonymous, and that no personal data of the customer may be stored in the passport. That settles the consumer layer: public, no login, nothing about the reader.
• The battery regulation, Article 77 and Annex XIII, already operates three circles: public, persons with a legitimate interest, and market surveillance authorities plus the Commission. It is in force and applies to battery passports from 18 February 2027 regardless of any standard.
• The JRC study for iron and steel, the basis of the first ESPR product delegated act, assigns every proposed field to one of the same three circles, and says in a footnote that it follows the battery precedent. The number is public, the method is restricted, the certificate belongs to the authorities.

So the architecture is three layers, and it stays three layers. EN 18239 describes how the middle and upper layers are implemented, not whether they exist. A company that separates its data into public, restricted and authority-only today is making the decision that survives.

What still has to wait

Publication closes the technical gap on paper. Three practical gaps stay open, and it is worth being honest about them rather than pretending a vendor slide solves them.

• Who proves a role, and to whom. A recycler or a customs officer will have to authenticate somehow. Whether that is an EU wallet, a certificate issued by a Member State, a registry account or something else depends on decisions the Commission has not taken, starting with the battery act on legitimate interest. Until then every login to a restricted layer is a provider's own mechanism, whichever standard it follows.
• How a check of authenticity is anchored. Anyone can put a QR code on a garment that leads to a page. EN 18246 now exists as a text, but without a citation and without a defined link to the registry and to the qualified seal of the operator, the only legally anchored check remains the registry entry, and the registry does not hold passport data.
• Which fields are confidential. The steel study says composition, process data and sourcing may reveal know-how and should be restricted. A standard can give the method for marking and enforcing confidential fields; the list of fields belongs to the sector acts. Until they exist, it is a policy you write, not a mechanism you buy.

What this means for a vendor conversation

If a provider tells you their tiered access is compliant with EN 18239, that claim can now be checked in principle. Ask three things: which edition they built against, the 2026 publication or the 2025 draft; whether they have the final text; and whether they claim a presumption of conformity. Until a citation appears, the honest answer to the last question is no.

The other useful questions have not changed. Can the restricted layer be moved to a different authentication mechanism without republishing the passport? Is every read of a restricted field logged, so you can show an authority who saw what? Does the public JSON of the passport list which layers exist, so a future verifier can find them? Those are design choices that either were made or were not, and they matter more than the number on the slide.

For what it is worth, this is how we built it in September: a passport page on dppera.com has a consumer layer that anyone can read, and two further layers, for market surveillance and for recyclers, that open after a login on the site, with every read counted. The roles are not the roles the law will eventually define, and the page says so in plain words. We built against the law and the Commission FAQ, not against the text of EN 18239, which we have not yet read in its final form. When we have, the login mechanism is the part we expect to adjust; the fields and the split stay.

What this is not

This is not a reason to wait. Six standards are cited, two more are published, the registry has been running since July, the battery deadline is in February. The two new texts govern how the middle layer is opened, not whether the passport has to exist.

This is not a new obligation. Publication by CEN creates no duty for any company, and neither will the citation; it only changes what you can rely on when you choose to follow the standard.

This is not a statement about the content of the two standards. We have not read the final texts, and this article reports their status, not what they require.

How to check this yourself

On the CEN website at standards.cencenelec.eu, find the committee CEN/CLC/JTC 24. The Published Standards tab lists all eight with their publication dates; the Work programme tab shows the ninth item. Searching by number alone can mislead: EN ISO 18246 is an unrelated standard on electric mopeds and motorcycles that shares the digits. For the citation, the Commission page on harmonised standards for the digital product passport lists every decision published in the Official Journal. For the battery access act, initiative 16473 in the Commission register of initiatives shows whether a draft has been published.

What to do this week

• Sort your fields into three columns: public, restricted, authorities. Use the steel study as the template if you have no sector act. This is the part that will not change.
• Write down who should have restricted access today, by name or by role, and log every read. When a real role system arrives, you will migrate a list, not invent one.
• Buy the final text only if you write software against it, and buy the 2026 edition, not the 2025 draft. If you need the Polish edition, wait for PKN; the licence you buy covers one edition.
• Ask your provider which edition of EN 18239 they built against. A good answer names the 2026 edition and the component that implements it. A bad answer is the draft, or "all of them".

FAQ

Łukasz Głuch

Builds DPPera, a digital product passport tool for small and medium-sized companies. Reads the delegated acts so you do not have to. Writes about what he checked in the registry, not about what vendors promise.

LinkedIn