The first step in the DPP registry has no deadline - and it is the one nobody is talking about

By Łukasz Głuch · 14 August 2026 · DPPera

Every DPP timeline you have seen is organised by product category: batteries February 2027, textiles later, furniture later still. There is one step that appears on none of those timelines, because it is not tied to a product at all. Before you can put a single passport into the EU registry, you have to prove who you are - with the same class of credential used for legally binding electronic signatures. Most brands have not started, because nothing told them to.

What the rulebook actually says

Commission Implementing Regulation (EU) 2026/1778 was adopted on 16 July 2026, published the next day, and has applied since 6 August 2026. It is the operating manual for the Digital Product Passport Registry that went live on 20 July.

Article 3 lists what the registry is made of: a web interface, an API, a verification platform that checks whether a passport exists and is complete, a generator of unique registration identifiers, storage for those identifiers and customs commodity codes, a list of verified DPP service providers, a semantic repository, a log system, and identification and authorisation schemes for every category of user.

Articles 4 and 5 are the ones that will surprise people. They define how you get in.

A qualified credential, not a password

The registry does not open accounts on the strength of an email address. To become a verified economic operator you have to present identity through eIDAS-grade means:

• If you are a company (a legal person): a qualified electronic seal supported by a qualified certificate for electronic seals, or a qualified electronic attestation of attributes issued under Union law.
• If you are a sole trader (a natural person): a qualified electronic signature supported by a qualified certificate, or electronic identification at eIDAS assurance level "high", or an electronic attestation of attributes issued under Union law.

These are not novelty items. A qualified seal or signature is bought from a trust service provider, tied to a verified legal identity, and priced accordingly. It is the same instrument used where a signature has to hold up in court.

The three-year clock nobody mentions

Here is the detail that turns this from a task into a recurring cost. Verified status expires after three years, or when the underlying credential expires - whichever comes first.

So this is not a one-off chore you tick off during setup. It is a renewal cycle that has to sit in a calendar and in a budget line, alongside domain renewals and certificate rotations. If you verify today and your first regulated product lands in 2028, you will have spent two of your three years before the obligation even started.

Can your software vendor do it for you? Partly

Article 8 allows a third party to act in the registry on behalf of an economic operator, where Union law provides for it. Two conditions come attached, and both matter:

• the third party must itself be verified under Article 5 - a platform cannot pass you through on its own say-so;
• the economic operator remains fully responsible for what is registered.

Read that as a division of labour, not a transfer of risk. A good vendor can carry the integration, the API calls, the data format and the renewal reminders. It cannot carry your accountability for whether the passport is true. Anyone selling "we handle compliance for you" as a complete sentence is describing something the regulation does not offer.

What has NOT changed

Nothing about this creates an obligation to publish a passport today. The registry being open is not the same as your product being in scope. The first hard product obligation is still the battery passport on 18 February 2027, and the delegated act for apparel textiles has not even opened for feedback - realistically 2027 for the act and 2028 or later for enforcement. Our deadline calendar keeps the certain dates apart from the expected ones precisely so this does not get muddled.

What has changed is that the door is now open, and the door has a lock on it that takes time and money to fit.

What to do with this

• Do not buy a certificate this week. A qualified seal is issued to a legal person. If there is any chance you will incorporate, or change legal form, buy after that - not before. Otherwise you pay twice.
• Decide the legal entity first. For anyone who will register passports on behalf of other brands, a company seal is operationally cleaner than a founder's personal signature under every third-party registration.
• Do not start the three-year clock early. Verify when a real product or a real customer needs it, not when you are still building.
• Test before you spend. The Commission opened a test environment alongside the registry on 20 July. Find out what it actually requires before assuming you need the full qualified credential to experiment.
• Put renewal in the calendar the same day you verify. Three years is exactly long enough to forget.

FAQ