A digital product passport is a structured set of data about a specific product, available online at a permanent address, reached through a data carrier on the product itself. That sounds simple, and in practice it is six pieces that have to work together: the carrier, the identifier, an entry in the Commission registry, data split into access layers, hosting, and a machine-readable copy. This article takes them one at a time and separates what the regulation says from what the standards say. Sector deadlines we keep on the industries and deadlines page.
1. The data carrier, the QR code on the product
Article 10(1)(b) of the ESPR: the data carrier shall be physically present on the product, its packaging or the documentation accompanying it, and which of those applies is set by the delegated act for the product group. The same act, under Article 9(2)(b) and (c), picks the type of carrier along with its layout and positioning.
In practice that means a QR code, sometimes an NFC tag, sometimes both. The standard describing carriers is EN 18220. What matters more is what the carrier does not do: it does not store data. A QR code on a label is only a route to an address. The data sits wherever you host it, which is why replacing a label is not the same as replacing a passport.
There is a practical consequence that saves money: if you already have a QR code or a barcode on the product, you probably do not need to print new labels to start. We worked through it in you do not need new labels.
2. An identifier that never changes
Article 10(1)(a): the passport shall be connected through the data carrier to a persistent unique product identifier. The word "persistent" is the important one. An identifier that goes onto a product stays with it, even if the company changes owner, the software vendor changes, or the composition changes.
The identifier scheme is described by EN 18219. It allows several families, and GS1 Digital Link is one option, not a condition. We checked that against the standard in EN 18219 explained and do you need GS1. The choice does carry hard technical rules from the registry side: the identifier given to the Commission must use https, may be up to 2000 characters (since version 1.03 of the registry user guide; it was 50 at launch) and must lead straight to the passport, with no redirects. A short-link style address is out.
The second decision is the level. Article 9(2)(d) and Article 10(1)(f) say the delegated act specifies whether the passport is established at model, batch or item level. This one cannot be undone without new codes on new products, so it deserves a deliberate answer. Our short level test helps, and so does model, batch or item. Besides the product identifier, Article 12 of the ESPR also requires operator and facility identifiers that comply with the standards.
3. The Commission registry, a catalogue rather than a store
Article 13(1) of the ESPR required the Commission to build a digital registry by 19 July 2026. It went live on 20 July 2026, and its operating rules come from Implementing Regulation (EU) 2026/1778, applicable since 6 August 2026.
The registry holds three things: unique identifiers, the commodity code for products entering release for free circulation, and the battery identifiers from Article 77(3) of the battery regulation. It does not hold your passport data. It is a catalogue saying "this identifier exists and it points there", not a cloud holding the composition of your jacket.
Two things follow. First, the registry going live is not an obligation for companies; we wrote about that on launch day. Second, registering an operator needs a qualified electronic seal, and registering a passport is not yet possible at all, which we found out by walking through the procedure.
4. Data and access layers
A passport is not one page for everyone. Article 9(2)(f) requires the delegated act to specify which actors have access to which data, and Article 10(1)(g) repeats it as an essential requirement. Article 11(f) adds the other half of the same rule: the right to introduce and modify data is restricted too.
In practice this is designed as layers.
| Who | What they see | Example fields |
|---|---|---|
| Consumer | Public layer, no login | Composition, care, origin, durability and repair, documents, identification |
| Market surveillance authority | Public layer plus compliance data | Declaration of conformity, notified body, technical documentation, compliance contact |
| Recycler and treatment operator | Public layer plus technical data | Detailed composition with disassembly, hazardous substances and their location, material separation |
| Repair and service | Public layer plus instructions | Repair instructions, spare parts, disassembly sequence |
Two caveats, without which that table misleads. First, the final split of fields is set by the delegated act for the product group, and the first public field-by-field map only arrived with the iron and steel study, which we covered in the steel access map. Second, the standards on access rights and data authenticity, EN 18239 and EN 18246, were published by CEN on 16 September 2026 but are not yet cited in the Official Journal. The layers can be built technically today, but the legal roles of the readers come later.
There is also a hard boundary that is easy to forget while designing: Article 10(1)(e) forbids storing customer personal data in the passport without explicit consent under Article 6 of the GDPR. A passport describes the product, not the buyer.
5. Hosting, where this actually lives
This is where a passport differs most from an ordinary product page. Article 9(2)(i) requires the delegated act to set the period for which the passport remains available, with a floor: at least the expected lifetime of the product. For furniture or an industrial battery that is not a two-year campaign, it is a decade or more.
Article 10(4) goes further and requires the economic operator placing the product on the market to make available a back-up copy of the passport through a digital product passport service provider that is an independent third party. Article 11(e) closes the loop: the data must stay available despite the insolvency, liquidation or cessation of activity of the operator responsible for creating the passport. In plain words, the law assumes your provider can disappear and tells you to plan for it in advance.
The standard covering storage and persistence is EN 18221. The practical consequence for choosing a provider is one paragraph: ask about full data export, about how many years of hosting are written into the contract, and about what happens to the addresses when you move. With us a published passport is kept online for at least two years from publication, and the full data set downloads in one click at any time. The list of questions to put to any provider is in how to check your provider.
6. The machine-readable copy at the same address
Article 10(1)(d) requires passport data to be based on open standards, machine readable, structured, searchable and transferable through an open interoperable data exchange network, without vendor lock-in. Article 11(a) adds full interoperability with other passports.
In practice that means the same address has to answer twice: with a page for a human and a structure for a machine. One identifier, two representations. Exchange protocols are covered by EN 18216, application programming interfaces and lifecycle management by EN 18222, and system interoperability by EN 18223. The Commission cited six standards from that family in the Official Journal on 15 July 2026; what each one does we explain in the six EN standards.
The test for a provider is simple: ask for a passport address and check whether it answers with JSON when you ask for data and with a page when you open it in a browser. If the data cannot be pulled by a machine, it cannot be moved either.
The life of a passport, from creation to withdrawal
The pieces are static, but the passport lives alongside the product. Four stages worth thinking through before you print the first label.
- Creation. You collect the data, pick the identification level and reserve an identifier. Nothing is public yet.
- Publication. The passport gets its permanent address and starts answering under the QR code. From that moment the data has to be accurate, complete and up to date, because Article 9(1) says so.
- Updates and versions. Changing data does not create a new address, it creates a new version at the same one. Who may make that change is limited by the access rights in Article 11(f). Fixing an error is a different thing from a new production batch, which usually deserves its own passport.
- Withdrawal. The product leaves the market, but the address keeps answering, because the codes on sold items stay in circulation. The passport moves into a read-only state with a withdrawal notice instead of disappearing.
What a passport does not do
- It is not a sales page. It is a document about the product, usually read after purchase, during repair or during an inspection.
- It does not replace the declaration of conformity or CE marking. It can carry them as documents, it does not substitute for them.
- It does not collect customer data. Article 10(1)(e) rules that out directly.
- It is not a registry entry. The registry holds the identifier, the passport holds the data.
See it on your own product
The fastest way to understand the six pieces is to build one passport and see what your files are missing. Our example passports show the full set, and in a free account the first passport takes a few minutes and ends with a working address, a QR code and print-ready vector files. What such a page looks like from the reader's side is in what a product passport looks like, and the whole topic from a company's side is collected in the 2026 guide.
FAQ
Is a product passport just a QR code?
No. The QR code is the data carrier, the route to the passport, and the passport is the data at a permanent address. Article 10(1)(a) and (b) of the ESPR require them separately: the carrier leads to a persistent identifier, and that leads to the data.
Where is passport data stored?
With you or with the service provider you choose. The Commission registry stores identifiers, not passport content. Article 10(4) additionally requires a back-up copy with an independent third party, and Article 11(e) requires the data to stay available if the operator fails.
Do I need GS1?
Not always. EN 18219 allows several identifier schemes and GS1 Digital Link is one of them. If you sell through retail chains you usually have a GS1 code anyway, and then it is worth using rather than creating a second one.
What happens when I change the data?
A new version of the passport appears at the same address. The identifier is persistent by force of Article 10(1)(a), so codes already printed on products keep working. A new production batch is usually a separate passport, not a new version of the old one.
What does hosting cost?
It depends on the number of passports and the identification level, because item-level passports are a different scale from model-level ones. Market ranges and cost components are in what DPP costs. With us the first two published passports are free, and every published passport is kept online for at least two years from publication.
Łukasz Głuch
Builds DPPera, a digital product passport tool for small and medium-sized companies. Reads the delegated acts so you do not have to. Writes about what he checked in the registry, not about what vendors promise.
LinkedIn
