DPP and product traceability: the supply-chain data work the passport actually demands

Most of the conversation about the Digital Product Passport focuses on the carrier — the QR code, the data-matrix, the NFC tag, the consumer-facing landing page. That is the visible end of the artefact and the easiest to demo. It is also the cheapest part to build.

The expensive part — and the part that actually decides whether a brand is ready for ESPR, the Batteries Regulation, and the delegated acts following them — is traceability. The data chain that runs from the unit on the shelf back through every component, supplier, country of origin, and substance declaration. The DPP is the rendering. Traceability is the substance.

This guide explains what traceability the passport actually demands, how to capture it without doubling work you already do for GPSR, and what a no-regrets 2026 baseline looks like.

Why traceability is the binding constraint

Every category delegated act under ESPR — adopted or anticipated — anchors on the same underlying dataset:

• a persistent unique identifier for the product unit (or batch / model, per category);
• economic operator identification — manufacturer, importer, EU RP;
• bill of materials — components, weights, materials;
• supplier identification per component — who supplied each input;
• country of origin per component — increasingly tier-2 and raw material, not just tier-1;
• substances of concern — REACH SVHC, PFAS, restricted substances, with concentration where applicable;
• certifications and conformity declarations — references plus the underlying documents;
• repair, disassembly and end-of-life guidance — actionable instructions.

This is supply-chain data work. The QR code is the last 10 minutes. The 12 months before it is collecting, validating and structuring the upstream record. Brands that miss the deadline for their category almost always miss the data, not the carrier.

The four-tier traceability picture

A practical traceability model has four tiers:

1. Unit / SKU layer. The persistent unique identifier — GS1 GTIN-style — that addresses the passport. One identifier, used consistently across PIM, ERP, marketplace listings, the data carrier and the passport.
2. Component layer. The bill of materials. Each component identified, with weight, material code, and a link to its supplier.
3. Supplier layer. Each supplier identified as a legal entity — name, address, role (manufacturer / mill / refiner / converter / packager) — with the dated declarations they have provided about the components they ship.
4. Country / origin layer. Country of origin per component, with — where the delegated act requires it — country of extraction for raw materials. The Batteries Regulation already pushes this depth for cobalt, lithium, nickel and natural graphite.

Every claim on the eventual DPP traces back through these four tiers to a supplier declaration, a test report, or a certification.

How deep — tier 1 versus tier 2 and beyond

The honest answer is category-dependent, and the direction of travel is deeper than tier-1:

• Batteries. The Batteries Regulation (EU) 2023/1542 explicitly requires due-diligence depth on the upstream raw materials — cobalt, lithium, nickel, natural graphite. Tier-1 supplier identity alone does not satisfy.
• Textiles. Anticipated ESPR delegated act for textiles is expected to require fibre-level composition with increasingly granular origin information. Fast-fashion supply chains will face the largest gap.
• Electronics. Conflict-mineral due-diligence (Regulation (EU) 2017/821) is already an upstream-traceability regime; ESPR for electronics will layer additional fields on top.
• General categories. The broad direction is the same: substantiate where it comes from, who handled it, what's in it.

The defensible 2026 working assumption is: treat tier-2 / raw-material origin as in scope by default, and roll back only where a specific delegated act narrows the ask. The cost of building tier-2 capability once and using it across categories is materially lower than building it three times against three different deadlines.

The overlap with GPSR — build one evidence ledger, not two

The DPP dataset overlaps 60–80% with the GPSR technical file every consumer product sold into the EU already owes (under Regulation (EU) 2023/988). Both demand:

• economic operator identification;
• bill of materials with materials and weights;
• certifications and applicable standards;
• risk assessment;
• EU Responsible Person details (for non-EU producers);
• evidence retention with dated provenance.

The right architecture is one evidence ledger per SKU, with multiple renderings:

• a DPP rendering for the passport;
• a GPSR technical-file rendering for market-surveillance authorities;
• an EmpCo substantiation rendering for each claim made about the product;
• an EPR volume-report rendering for the packaging and product data feeding national PROs.

Brands that maintain separate GPSR and DPP systems do twice the work upfront and end up with two systems that drift apart, leaving the audit-trail in disagreement with the consumer-facing passport.

What "evidence" actually means

For each claim or data point on the eventual DPP, the underlying evidence is typically one of:

• a supplier declaration — a dated written statement from the supplier (often a self-declaration of substance content, origin, or certification status);
• a third-party test report — chemical, physical, or substance testing with the lab identified and the methodology referenced;
• a certification document — Oeko-Tex, GOTS, BSCI, Energy Star, applicable category-specific certifications, with the certificate ID and validity dates;
• an EC Declaration of Conformity — for products where one is required;
• a risk assessment record — methodology and outcome under the applicable framework.

Each evidence item should be dated, attributed to a source, retained for at least the GPSR window (10 years from placement on the market), and linked back to the SKU and the specific data point it substantiates. Without provenance, evidence is unverifiable; without retention, the audit trail expires; without linkage, you cannot demonstrate that a specific DPP claim is supported.

The no-regrets 2026 baseline

Six things that pay back regardless of which delegated act lands first for your category:

1. One persistent identifier per SKU. GS1 GTIN or equivalent, used everywhere — PIM, ERP, marketplace listings, data carrier, passport.
2. A bill of materials per SKU with component weights and material codes.
3. A supplier identification per component, with the supplier captured as a legal entity (not just a name).
4. A country-of-origin per component, with the assumption that tier-2 / raw-material origin will be asked for in some categories.
5. A substance-declaration capture flow — REACH SVHC, PFAS, restricted substances. Dated, attributed.
6. A single evidence ledger with dated provenance, retained for the GPSR window or longer.

Stand these up, and the eventual DPP delegated act for your category is a rendering job — not a re-platforming job.

How Regonance helps

Regonance binds a persistent identifier to each SKU, captures the bill of materials and supplier-per-component structure, and lets you attach dated evidence per claim. The same record drives the passport, the GPSR technical file, and the EmpCo substantiation pack — one evidence ledger, multiple renderings. The EU Responsible Person details surface on every passport, closing the overlap with GPSR. Available on Growth, Pro and Agency plans.

What to do this quarter

• Adopt one persistent identifier scheme per SKU; back-fill if your PIM uses internal codes that don't survive marketplace ingestion.
• Build the bill of materials per SKU; capture component weights.
• Identify the legal-entity supplier behind each component, not just the trading name.
• Send a substance-declaration request to each supplier; store the dated response.
• Pick the SKUs in your top-revenue categories and prove the chain end-to-end on a handful before scaling.

Glossary

Persistent unique identifier. A stable identifier (often GS1 GTIN-based) bound to a product unit or model and used to address its passport across systems.

Bill of materials (BOM). The structured list of components and materials that make up a product unit, with weights and material codes.

Tier-1 / tier-2 supplier. Tier-1 = the supplier you buy directly from; tier-2 = your supplier's supplier; raw-material origin sits further upstream still.

Substances of concern. REACH SVHC (Substances of Very High Concern), PFAS, heavy metals, and other restricted substances; presence and concentration are typically declared per component.

EC Declaration of Conformity. The manufacturer's signed statement that a product conforms to the applicable EU regulations.

Evidence ledger. A single structured record per SKU holding dated, attributed evidence per claim or data point, retained for the regulatory window.

---

Educational information, not legal advice. Category-specific traceability requirements are set by Commission delegated acts and evolve frequently — validate scope and depth with a qualified advisor before acting.