EN 18219 in plain language: the passport identifier standard you have to buy to read

By Łukasz Głuch · 20 August 2026 · DPPera

There is something odd about digital product passport compliance that nobody says out loud. The regulation is free to read in 24 languages. The standard that tells you how to satisfy it is not: it is copyrighted, sold per licence, watermarked with your company name and marked as not for resale. EN 18219 is the one that decides how your products are identified - the decision every other decision hangs off. Here is what you can work out without paying, and where the paywall genuinely starts to matter.

Where EN 18219 comes from

The chain is short. The Commission issued standardisation request M/604. CEN and CENELEC set up joint technical committee JTC 24, "Digital Product Passport, Framework and System". JTC 24 wrote a family of standards. On 15 July 2026 the Commission cited six of them in the Official Journal through Implementing Decision (EU) 2026/1736.

EN 18219:2026 is one of the six. Its full title is Digital product passport - Unique identifiers. It is a horizontal standard: it defines how the passport system works, not what data your specific product must carry. That second part stays in the product-specific delegated acts, which are still being written.

The practical consequence for a brand: EN 18219 tells your software vendor how to build. The textile delegated act, when it arrives, will tell you which fields to fill in.

Three identifiers, not one

The single most useful thing to understand about this area is that a passport carries three distinct identifiers, and people routinely collapse them into one:

• The product identifier - what is this thing? Depending on your product group and your commercial setup, a GTIN, a batch code, a heat number, a self-issued identifier.
• The economic operator identifier (EOID) - who is responsible for it? This is the legal entity that placed the product on the EU market, and it is a different question from "who made it".
• The facility identifier (FID) - where was it made or processed?

They are separate because they change independently. A brand can move production between facilities without the product changing. A product can be sold on years after its manufacturer stopped trading. Merging these into one field is the classic data-model mistake, and it is expensive to unpick later because printed codes do not change.

What "harmonised" actually buys you

Citation in the Official Journal is not decoration. Under Article 41(2) of Regulation (EU) 2024/1781, a passport conforming to a cited standard is presumed to conform with the requirements of Articles 10 and 11, to the extent those standards cover them.

That presumption reverses the burden of proof. Follow the standard and a market surveillance authority has to demonstrate you are non-compliant. Ignore it and you have to demonstrate your alternative is equivalent - a technical argument, at your cost, on someone else's timetable.

Standards remain formally voluntary. In practice, "voluntary" here means "voluntary in the way that having insurance is voluntary".

The part nobody writes about: it is behind a paywall

European standards bodies fund themselves by selling standards, not from the EU budget. CEN holds the copyright and national members - in Poland, PKN - sell under licence.

What you buy is a specific edition, permanently. EN 18219:2026 stays yours; the licence does not expire. But two things do age:

• The document gets revised. A new edition, or an amendment, is a new purchase. Corrections and errata are free to download; amendments are not, unless you hold a subscription to a collection, where they arrive automatically.
• The presumption of conformity has a date attached to it - eventually. Your right to rely on a standard comes from the Commission citing that edition, not from owning the PDF. When a newer edition is cited, the older one gets a date after which the presumption stops. You can hold a file that is legally inert.

Worth stating plainly, because the scare stories on this are ahead of the facts: the Annex to Decision 2026/1736 currently carries no cessation dates. None of the six standards is on a clock today. The risk is structural, not immediate.

One more practical detail. PKN licences are issued to a named company for a stated number of concurrent workstations, and every page carries a watermark naming the licence holder and stating that resale is not permitted. You cannot simply forward the PDF to a contractor.

How to read it without buying it

PKN runs standards reading rooms where the content can be consulted free of charge, on site, on weekdays: Warsaw (ul. Świętokrzyska 14, 07:30-15:30), Katowice (ul. J. Lompy 14, 09:00-15:00) and Łódź (ul. Narutowicza 75, 08:00-15:00). For a small brand trying to decide whether it needs the document at all, an afternoon in a reading room is a rational first step before spending anything.

What you can build for free

Here is the cost shortcut that matters. Standards of this kind point at underlying specifications, and several of those are free and public: GS1 Digital Link, EPCIS and W3C DID Core cost nothing to download. Much of the implementation detail lives there.

Be careful with the rest of the reading list, though, because "underlying specification" does not reliably mean "free". IEC 61406 and ISO/IEC 15459 are sold by IEC and ISO on the same commercial logic as the EN standards themselves. Check before you assume a reference is a free download - that assumption is the one most often repeated second-hand in this field, and it is wrong.

You buy the EN not to learn how to implement, but to know which combination to choose and which boundary conditions to satisfy. It is a compliance checklist, not a tutorial. That distinction is worth internalising before you assume you need all eight standards on your desk.

What has NOT changed

None of this obliges you to publish a passport today. The first hard product deadline is still the battery passport on 18 February 2027; apparel textiles are realistically 2027 for the act and 2028 or later for enforcement. And a standard titled "Unique identifiers" does not hand the market to any one issuing body - the neutrality is deliberate.

What to do with this

• Read the identifier standard first, whichever way you read it. Data carriers, storage and APIs all inherit from how you identify things.
• Keep the three identifiers in three fields. Product, operator, facility. Even if two of them are constant for you today.
• Make your identifier layer swappable. One interface, several implementations: a GS1 route for brands that have GTINs, a self-issued route for brands that do not. Both should reach the same passport.
• Do not buy all eight standards. Identifiers, data carriers and persistence carry most of the architectural weight. The two security standards are not published yet.

FAQ