EU Regulatory Requirements
Digital Product Passport requirements
ESPR (EU 2024/1781) sets the data-carrier, unique-identifier, and format requirements that every Digital Product Passport must satisfy. The specific data fields a passport must contain are defined per product category in the relevant delegated act — what follows covers the framework-level obligations that apply across all categories.
The essentials (ESPR Art. 10 / Annex III)
Three requirements apply to every DPP regardless of product category. These are set directly in ESPR and do not change when delegated acts are published.
Unique product identifier
Each passport must carry a globally unique identifier that resolves to the passport record. ESPR Annex III references ISO/IEC 15459 — the international standard for unique identifiers used by GS1 (GTIN), IATA, and others.
"Each product shall carry a data carrier … containing a unique product identifier …"
— ESPR Annex III, paraphrased
QR data carrier (ISO/IEC 18004)
The data carrier must support QR codes as defined by ISO/IEC 18004. ESPR is technology-neutral — it mandates QR capability, not a specific implementation. In practice, GS1 Digital Link (which encodes the unique identifier as a resolvable URL) is the industry-consensus implementation, though it is not yet named in an adopted delegated act.
Open, interoperable, machine-readable format
Passport data must be accessible in an open format without proprietary software, machine-readable, and interoperable across systems. Closed or vendor-locked formats do not qualify.
Expected data categories
The exact fields a passport must contain are defined per product category in the delegated act for that category — not in ESPR itself. The themes below reflect the categories described in the ESPR framework and early delegated act drafts. Verify against your category’s adopted delegated act before treating any specific field as mandatory.
Across product categories, DPPs are expected to cover seven broad themes. Each delegated act will specify which fields are mandatory, recommended, or optional within these themes.
Product identity & unique ID
per delegated actName, model, SKU, and the ISO/IEC 15459-compliant unique identifier.
Materials & substances of concern
per delegated actMaterial composition and any substances of concern present above threshold concentrations.
Recycled content
per delegated actPercentage of recycled material by weight, and source declarations where required.
Durability & reparability
per delegated actLifespan data, spare-part availability, and repairability score where applicable.
Environmental & carbon footprint
per delegated actLife-cycle GHG emissions or carbon footprint, and other environmental performance indicators.
Supply-chain & manufacturing
per delegated actCountry of origin, manufacturing location, and relevant supplier identifiers.
End-of-life & recycling guidance
per delegated actDisassembly instructions, material-recovery guidance, and sorting symbols.
Access and hosting
A common misconception: the EU DPP registry does not host your passport data.
EU DPP registry — due 19 July 2026
The registry is a pointer directory. It stores a product identifier and resolves it to the URL where the passport data lives. Think of it like DNS: the registry resolves an ID to an address; the address serves the actual information. The data itself is hosted by the economic operator or a compliant platform.
Who hosts the passport data?
The economic operator (typically the manufacturer or importer) is responsible for ensuring passport data is accessible at the URL registered in the EU registry. In practice, brands use a compliant DPP platform — such as PassportBox — to host and serve the data, with the registry pointing to the platform-hosted URL.
By product category
DPP obligations become enforceable category by category as delegated acts are adopted. The sequence below reflects current confirmed timelines and projections.
Batteries
First — 18 Feb 2027Industrial, EV, and light-means-of-transport batteries over 2 kWh must carry a compliant DPP from 18 February 2027. This is the first mandatory DPP obligation under ESPR.
Battery passport requirementsTextiles
Projected ~late 2028 – mid-2029Textiles are a priority group in the ESPR first working plan. The delegated act is expected to be adopted around 2027; enforcement is projected to start late 2028 to mid-2029. These dates are projections — verify against the published delegated act once adopted.
Textile DPP guideOther priority groups in the ESPR first working plan include furniture, mattresses, tyres, iron/steel, and aluminium. Delegated acts for these categories are in preparation. Timeline dates will be confirmed when each act is adopted.
How PassportBox helps
PassportBox implements the ESPR technical requirements out of the box, so you build the passport content rather than the infrastructure.
ISO/IEC 18004-compliant QR labels
Every passport generates a QR label encoding a GS1 Digital Link URL. Print-ready PDFs are available from the Labels module.
Unique product identifiers
PassportBox gives each passport a globally-unique identifier and a public, scannable GS1 Digital Link URL.
Open, interoperable data format
Passport data is served at a public URL in a machine-readable, open format — ready for EU registry integration when the registry launches in July 2026.
Hosted passport data
PassportBox hosts your passport data and serves it from the URL that the EU registry will point to — you register the URL, we keep the data available.
See where you stand before the deadline
Run the free DPP readiness scan — upload your product list and get a compliance gap report in under two minutes.
Frequently asked questions
- Is a QR code required on every Digital Product Passport?
- ESPR Article 10 and Annex III require a data carrier that supports QR codes (ISO/IEC 18004) as a minimum. The regulation is technology-neutral — it mandates the capability, not a specific implementation — but a QR code must be one of the supported formats. GS1 Digital Link (encoding a unique product identifier in a scannable URL) is the industry-consensus way to implement this, though it is not yet named in an adopted delegated act.
- Where is the DPP data stored — in the EU registry?
- No. The EU DPP registry (due 19 July 2026) is a pointer directory: it stores a product identifier and resolves it to the URL where the passport data lives. The data itself must be hosted by the economic operator or a compliant platform such as PassportBox. Think of the registry like DNS — it resolves an ID to an address, but the address serves the actual information.
- What unique identifier standard does ESPR require?
- ESPR Annex III references ISO/IEC 15459 for the unique product identifier — the same family of standards used by GS1 (GTIN) and IATA. The identifier must be machine-readable, globally unique, and embedded in the data carrier on the physical product or its packaging.
- Which product category has to comply first?
- Batteries. Industrial, EV, and light-means-of-transport batteries over 2 kWh must have a compliant DPP from 18 February 2027. Textiles follow later — the delegated act is expected to be adopted around 2027, with enforcement realistically starting late 2028 to mid-2029.
- Do exact required data fields differ between product categories?
- Yes. ESPR sets the overall framework — carrier, identifier, and format rules — but the precise data fields (which substances to declare, what recycled content thresholds apply, which durability metrics are mandatory) are defined per product category in the relevant delegated act. Always verify the exact field list against the delegated act for your category rather than relying on general guidance.
- Can I use a proprietary format for the DPP data?
- No. ESPR requires an open, interoperable, machine-readable format accessible without proprietary software. The standard is technology-neutral in terms of which open format you choose, but closed or vendor-locked formats do not qualify.
Disclaimer: This is general information, not legal advice. Regulatory requirements and dates are evolving — verify against official EU sources.