How to create a digital product passport: nine steps, in the order that saves you rework

A digital product passport is a set of data about one product, reachable through a code on the product, kept online for years and updated when something changes. Building one takes nine steps: confirm your deadline, pick the identification level, choose an identifier, collect the data, split it by access, decide where it lives and where its backup sits, put the code on the product, register it with the EU, and keep it current. Two of these choices are fixed once the product is sold, so it pays to make them in this order.

Step 1. Confirm that you need a passport, and from when

Two laws create passports today, and they run on different clocks.

• Batteries. Under Article 77(1) of Regulation (EU) 2023/1542, from 18 February 2027 every LMT battery (e-bikes, e-scooters), every industrial battery above 2 kWh and every electric vehicle battery placed on the market needs a battery passport. This date is certain.
• Everything else under the ESPR. Regulation (EU) 2024/1781 makes a passport mandatory only through a delegated act for a specific product group. By 20 October 2026 no such act requiring a passport had been adopted. Under Article 4(4) an act applies no earlier than 18 months after it enters into force, except in duly justified cases. For textiles the act is expected around 2027 and real obligations around 2028-2029.

Check your category and both dates on the industries and deadlines page. Then check who is responsible: the obligation sits with the economic operator that places the product on the EU market, which may be you, your importer or your brand owner. We explained the roles in who the DPP applies to.

Nothing stops you from creating a passport voluntarily before your deadline. It will not be a legal passport yet, but it is the cheapest way to find out which data you are missing.

Step 2. Choose model, batch or item

Article 9(2)(d) of the ESPR says the delegated act decides whether a passport describes a model, a batch or a single item. Until your act exists, you choose, and the choice is expensive to reverse: it sets how many passports you print, how much data you store and which questions you can answer after a recall. Batteries leave little choice, because Article 77(2) requires information specific to the individual battery.

We wrote eight questions that settle model, batch or item. Answer them before you print anything.

Step 3. Give the product an identifier that will not change

Article 10(1)(a) of the ESPR requires a persistent unique product identifier, connected to the passport through a data carrier. Persistent is the key word: the code you print in 2027 must still resolve in 2037. Two practical rules follow:

• You do not need GS1 or a GTIN. No EU rule names an issuing body, and the standard cited for identifiers, EN 18219, is vendor-neutral. Details in do you need GS1 for a DPP and EN 18219 in plain language. If you already have GTINs, you can use them.
• Make the identifier a web address that answers directly over https. The EU registry calls the address before it accepts it, and a chain of redirects is a reason to reject it.

For batteries, Article 77(3) points to the ISO/IEC 15459 series or equivalent for the QR code and the identifier.

Step 4. Collect the data

The content of a passport comes from the delegated act (Article 9(2)(a) and Annex III of the ESPR) or, for batteries, from Annex XIII of the battery regulation. Batteries are the only group where the list is known in detail: the Commission guidance has 71 data points, and we showed which ten will stay empty on day one.

For other groups you already know a good part of the list, because Annex III of the ESPR names the building blocks a delegated act chooses from: the unique product identifier, commodity codes such as TARIC, compliance documents such as the declaration of conformity, manuals and safety information, the details and identifiers of the manufacturer, of the importer (with its EORI number) and of the facilities, and the reference of the provider that hosts the backup copy. Product data such as materials, substances of concern or recycled content comes through Article 7 and the act for your group. Much of it sits with your suppliers, which is why this step takes the longest. The law asks for data that is accurate, complete and up to date (Article 9(1) ESPR, Article 77(4) battery regulation), so a figure you cannot back with a document is a liability, not a feature.

Step 5. Split the data by who may see it

Not everything in a passport is public. The battery regulation has three tiers in Article 77(2): the general public; notified bodies, market surveillance authorities and the Commission; and persons with a legitimate interest, such as repairers and recyclers. Under the ESPR, Article 9(2)(f) leaves it to each delegated act to say which actors see which data.

The detailed rule for the battery legitimate-interest tier comes from an implementing act under Article 77(9), which has not been adopted yet. We tracked it in the battery access rights deadline. The practical answer today is to tag every field with its tier now and keep the tiers configurable, so the act changes settings, not your data.

Step 6. Decide where the passport lives, and where its backup sits

Article 11(c) of the ESPR lets you store the passport yourself or through a digital product passport service provider. Whatever you choose must meet a few hard requirements:

• open standards and an interoperable, machine-readable format, without vendor lock-in (Article 10(1)(d));
• availability for the period set in the delegated act, at least the expected lifetime of the product (Article 9(2)(i)), and also after your insolvency or liquidation (Article 11(e));
• a backup copy made available through a passport service provider when the product is placed on the market (Article 10(4)), and for manufacturers a backup of the most up-to-date version (Article 27(1)(c)).

The backup duty comes from the ESPR. The battery regulation has no such rule, but Article 78(e) still requires a battery passport to remain available after the responsible operator ceases to exist. Before you sign with anyone, run through fourteen questions that test a provider.

Step 7. Put the code on the product

Under Article 10(1)(b) of the ESPR the data carrier must be physically present on the product, its packaging or the documents that come with it, as the delegated act specifies. In practice that is a QR code. For batteries, Article 13(6) requires a QR code on all batteries by 18 February 2027, but only the three categories from step 1 carry a full passport behind it. We untangled that in two battery obligations, only one of them is the passport.

You rarely need new labels. The code can go on the existing label or packaging, and one code can serve both the passport and the packaging label (one QR code for both). Remember Article 10(3): dealers and online marketplaces can ask you for a digital copy of the code, and you have five working days to send it.

Step 8. Register the identifier in the EU registry

Article 13 of the ESPR set up the EU registry, which went live in July 2026. The operator that places the product on the market uploads the identifier (Article 13(4)). Today you can enrol and verify your organisation, with a qualified electronic seal or, for a sole trader, a qualified signature, under Implementing Regulation (EU) 2026/1778.

You cannot register a passport yet. On 12 October 2026 every attempt still ended with the error SEMANTIC_VALIDATION_UNAVAILABLE, because the semantic catalogue for batteries is not published. The Commission helpdesk expects the registry API in the fourth quarter of 2026. Enrolment needs a qualified seal or signature and a declaration that matches the certificate exactly, and a rejected application starts over, so it is worth doing early: our registry verification walkthrough shows each screen.

Step 9. Keep it current

A passport is not a document you publish once. Data must stay accurate and up to date, and some events create a new passport: a repurposed or remanufactured battery gets a new passport linked to the original one (Article 77(7) battery regulation), and the ESPR has the same linking rule in Article 11(d). Name one person who owns updates, and keep a version history, so you can show an inspector what the passport said on a given day.

If you sell in several countries, plan the languages too. Article 7(8) of the ESPR requires information in a language easily understood by customers, as decided by each Member State. We listed the other traps in the ten challenges small brands actually hit.

What you can do this week

Steps 1 to 4 need no software and no budget: confirm your deadline, choose the level, decide on the identifier and open a spreadsheet of the data you already have. That spreadsheet is the real work. Software matters from step 5 onwards, and its cost is usually the smaller part of the bill, as we showed in what a DPP really costs a small brand.

If you want to see your own product as a passport before you decide anything, you can create two passports for free in DPPera, with the QR code and the public page.

FAQ

Łukasz Głuch

Builds DPPera, a digital product passport tool for small and medium-sized companies. Reads the delegated acts so you do not have to. Writes about what he checked in the registry, not about what vendors promise.

LinkedIn