EU Digital Product Passport: what brands need to know before 2027
Under the Ecodesign for Sustainable Products Regulation, product data moves from paper files to structured, machine-readable passports with tiered access. What a passport contains, which categories come first, why it is a data problem rather than a document problem, and what to organise during 2026.
The Digital Product Passport (DPP) is the EU's answer to a simple question: where does the information about a product live, and who gets to see it? Instead of paper files held by the manufacturer and a label with room for eight lines of text, each product gets a structured, machine-readable record reachable from a code on the product itself.
The legal basis is the Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781 (ESPR), which entered into force in July 2024. The DPP is not one deadline — it arrives category by category through delegated acts, with the first waves expected from 2027.
What a passport actually is
Four components:
A unique product identifier. Not your SKU. A globally unique identifier at the level the delegated act specifies — model, batch or item — so a specific product can be distinguished from every other.
A data carrier. A QR code or comparable carrier, on the product, its packaging or its documentation, that resolves to the passport.
A structured dataset. Fields defined per product group: composition and materials, substances of concern, durability and reparability, recycled content, carbon and environmental footprint, spare parts and repair instructions, end-of-life handling, and compliance documentation.
Tiered access. Not everyone sees everything. Consumers get information relevant to purchase, use, repair and disposal. Repairers, recyclers and market surveillance authorities get deeper technical detail. Commercially sensitive data is restricted to authorities and specified actors.
That last point is worth dwelling on, because it is the part most misunderstood. A DPP is not a public data dump, and it is not a product marketing page. It is a permissioned record with different views for different audiences.
Which products first
The ESPR is a framework: it sets the machinery, and delegated acts set the requirements for each product group. The Commission's working priorities put textiles and apparel, iron and steel, aluminium, furniture, tyres, mattresses, and certain electronics and ICT products in the first wave, with construction products following their own regulation.
Batteries move first and separately. The Battery Regulation already mandates a battery passport for LMT, industrial batteries above 2 kWh and EV batteries from February 2027, which makes batteries the working prototype for everything else.
Expect first ESPR-based DPP requirements from around 2027, phased through the late 2020s. Any specific date for a given category is only certain once its delegated act is adopted, so treat published timelines as strong signals rather than settled law.
Why this is a data problem, not a document problem
Brands used to compliance as PDFs consistently underestimate this. A passport requires per-product, per-batch or per-item structured data, sourced from suppliers, kept current for the product's lifetime, and served reliably years after the sale.
The specific capabilities you need:
- Supplier data collection. Material composition, recycled content percentages, substance declarations and footprint figures come from your supply chain. If your supplier relationship is a purchase order and an invoice, this is a new conversation.
- A stable identifier scheme. Decided once, applied consistently, resolvable for years. Changing it later invalidates every code already printed.
- Persistence. The passport must remain available for a defined period, which means whoever hosts it must still exist and still be reachable. Vendor concentration risk is a real consideration.
- Versioning. When a formulation, supplier or specification changes, the passport for units already sold must remain accurate for those units. That means version history, not overwriting.
- Access control. Consumer, repairer, recycler and authority views of the same record.
None of this is exotic engineering. All of it takes time to organise, and none of it can be improvised in the quarter before a deadline.
What the QR code on the product will mean in practice
The carrier is the part your customers will actually meet, and it changes how a product page works. A shopper scanning a code expects an immediate, readable answer about materials, care, repair and disposal — not a PDF and not a login. A repairer scanning the same code expects part numbers and disassembly information. A recycler expects material composition and any substance of concern. Serving one audience well and the others badly is the most likely early failure mode.
Two design decisions are worth making early. First, where the code physically lives: on the item, on a sewn-in label, on packaging, or on documentation — each has different durability and each is specified per product group. Second, whether the code resolves at model, batch or item level, because that determines how much data you must hold and how granular your production records need to be.
What to do in 2026
Confirm whether you are in an early category. Textiles, furniture, electronics, steel, aluminium, tyres and mattresses are the ones to watch, plus batteries if any product you sell contains a cell.
Audit what data you already hold. For a representative SKU, try to fill in: full material composition by weight, recycled content with evidence, substances of concern above threshold, country of manufacture, durability and repairability information, spare parts availability, and end-of-life instructions. The gaps in that exercise are your roadmap.
Fix identifiers first. Decide how products, batches and items are identified, and get it consistent across your systems. Everything else hangs off this, and it is the cheapest thing to fix now and the most expensive to fix later.
Start supplier data requests. Add composition, recycled content and substance declarations to your standard supplier documentation now. Retrofitting requests across a supplier base takes a year in practice.
Watch the battery passport work. If you sell products with batteries, February 2027 is a real date with real data requirements, and doing it properly builds the exact capability the ESPR waves will need.
Do not buy a passport platform yet, but do not wait to organise data. Standards and delegated acts are still landing. Clean data moves between platforms; missing data does not become available because you bought software.
Who inside the business owns it
The passport does not fit neatly in one function, which is why it stalls. Product and sourcing own composition and supplier data; sustainability owns footprint methodology; legal owns the compliance documentation; engineering or IT owns identifiers, hosting and persistence; commercial owns what consumers see. Assign a single accountable owner early, even if implementation is years out, because the work that has to happen now is entirely about getting other people's data into a consistent shape.
A useful early exercise is a data-ownership map: for each field a passport is likely to require, who inside or outside the business holds the answer, in what format, and how often it changes. The map usually reveals that a third of the fields have no owner at all, which is the finding worth having in 2026 rather than 2028.
How the DPP relates to what you already do
It does not replace existing obligations. GPSR technical documentation, CE marking and conformity assessment, PPWR packaging documentation, national EPR registration, REACH substance communication and SCIP notification all continue. The DPP increasingly becomes the channel through which parts of that information are exposed to the people who need it — which means inconsistency between your files and your passport becomes visible in a way it never was before.
That is the strategic point. Today, contradictory compliance data can sit unnoticed in separate systems. Under a passport regime, it sits in one record with a QR code on the product. Getting the underlying data right matters more than getting a passport tool early.
Educational information only, not legal advice. Product-group requirements and dates depend on delegated acts still in progress — confirm the position for your categories with a qualified advisor.
Start your free Digital Product Passport
Build a passport from your own product data, publish it behind a QR code, and keep the evidence trail behind every field.
Start free workspaceEvery EU deadline, on one page.
Nine mandates, each with dates attached between now and 2030. Get the calendar, plus a note when the guidance behind an article like this one changes.
- → Every applicable EU compliance date
- → Which mandate hits your category first
- → An alert when a rule or guidance changes
Compliance guidance based on published EU regulatory texts. Not legal advice. Consult qualified counsel for your specific situation.