Digital Product Passport: The future of product compliance

The EU Digital Product Passport applies to every product sold in Europe, whether your factory is in China, Bangladesh, Turkey, or Germany. The first confirmed deadline is 18 February 2027. This guide tells you what applies to your business, what is still being decided, and what you can do before your sector’s rules land.

Scan the QR code and you reach a live data record, hosted by the manufacturer, importer or a DPP service provider, that identifies who made the product, confirms it meets EU regulations, links to the technical file and declaration of conformity, and tells recyclers and repairers what they need to know.
The data carrier must be permanently attached to the product, its packaging or its documentation, and stay accessible for the entire commercial life of the product. No app to download, no account to create. The product data lives on a server. The QR code is just the door that must be machine-readable.
Every product also needs a unique identifier registered in the EU Product Passport Registry, the centralised EU database that connects to customs systems. The Registry stores identifiers only while the product data stays with you or your provider.

No. The DPP uses a role-based, need-to-know access model. Not everyone who scans a DPP sees the same data. Access is divided into five tiers, defined per product group, so companies share only what they are required to share with each audience.

The DPP applies to virtually every physical product placed on the EU market, regardless of where it is manufactured. Sell into the EU, directly or through a distributor, and the obligation is yours. Selling through an intermediary does not remove your responsibility as the economic operator who places the product on the market.

ESPR covers almost all physical products. The DPP rolls out category by category, with each sector getting its own specific rules. Categories confirmed or in progress include:

Further product groups will follow through 2030 and beyond under the ESPR working plan.

Machinery:

Machinery falls under the Machinery Regulation (EU 2023/1230), a separate legislative track with no DPP requirement confirmed. Components within machinery products, including electronics, batteries and steel or aluminium parts, may trigger DPP obligations when those categories’ delegated acts are published.

The exemption list is short. Most physical products are in scope. Confirmed exemptions include:

The DPP creates obligations across the entire supply chain. Primary responsibility sits with the economic operator who places the product on the EU market for the first time.

Not sure where your products sit? We work with manufacturers across 30+ countries. Contact us and we’ll help you understand which product categories are in scope, what timeline applies, and what you can do now:

The only fully confirmed DPP enforcement date is 18 February 2027 for industrial batteries and EV batteries above 2 kWh. For textiles, electronics, furniture and most other categories, dates depend on sector-specific rules that have not yet been published. Until those rules are confirmed, any date you see is a working target, not a legal deadline.
This page is updated as confirmed dates become available.

All dates other than batteries are working targets subject to change.

The longest step in DPP readiness is not building the technology, it is getting the right data from your supply chain. Collecting substances of concern information, production facility records and traceability data from multi-tier global suppliers typically takes twelve months or more.
Think of it this way: if the rules for your sector are published tomorrow and give you twelve months to comply, you have twelve months. Companies already gathering supplier data will use that time building and testing. Companies starting now will spend it chasing responses.
For battery products, the data burden is higher and the deadline is fixed. Materials composition, carbon footprint and recycled content are already confirmed requirements under the Battery Regulation, applying from February 2027.

Not everything in the DPP is still being decided. ESPR already confirms a core set of required fields covering product identity, compliance documentation, supply chain traceability and end-of-life guidance. The sector-specific rules, when published, will add to this foundation. Until then, the confirmed fields are the baseline every DPP should be built on.
These are the data fields confirmed in ESPR Annex III today:

Additional fields expected from delegated acts
The following data elements are not confirmed in Annex III but are widely expected to appear in sector-specific delegated acts, based on the Article 7 ecodesign requirements and existing proposals:

These fields will be confirmed per product group. Until the relevant delegated act for your category is published, treat them as expected rather than legally required.

The regulation allows three levels of DPP detail depending on the product category and the relevant delegated act. For most consumer goods categories, model-level is expected to be the baseline. The exact requirement for your sector will be confirmed in its delegated act.

For most product categories, the sector-specific data requirements have not yet been confirmed in law. That means no provider can offer a genuinely final, fully compliant DPP for textiles, electronics, furniture or most other categories today. What reputable providers can offer is a pre-DPP: a structured, data-backed product record built on ESPR Annex III, designed to become compliant when the delegated act confirms the additional fields.
A pre-DPP is not a workaround. It is the only responsible approach available right now. Companies that build their pre-DPP now avoid the compliance crunch that will affect every sector simultaneously when enforcement dates are confirmed.

CE Marking and the DPP are separate legal requirements. The Declaration of Conformity and technical file produced for CE marking are mandatory data fields within the DPP, making them the starting point, not the complete solution. Carbon footprint, substances of concern, materials composition and end-of-life instructions must still be gathered separately. For companies that are already CE marked, the gap between current position and pre-DPP ready is significantly smaller than for those starting from scratch.
The Authorised Representative link is structural. ESPR Annex III specifies AR identity as a mandatory DPP data field. Without an EU-based economic operator (AR or Importer), a non-EU manufacturer cannot issue a compliant DPP and cannot legally place products on the EU market once the relevant enforcement date applies. If you have already appointed 24hour-AR as your AR, that field is already covered.

From each sector’s enforcement date, placing a product on the EU market without a valid, accessible DPP is unlawful. The consequence is an immediate loss of market access, potential customs detention and financial penalties. The scale of penalties depends on the Member State, but the regulation requires all penalties to be effective, proportionate and dissuasive.

The Product Passport Registry connects directly to EU customs systems. A missing or non-compliant DPP can result in shipments being detained at the border.

Penalties are determined by individual Member States but must meet the regulation’s minimum standard. At minimum, authorities must be able to impose fines and time-limited exclusions from public procurement procedures. When setting the level of a penalty, authorities consider the nature, gravity and duration of the infringement, whether it was intentional, the environmental damage caused and any economic benefit gained from non-compliance.
Market surveillance authorities can also prohibit sale, order market withdrawal or recall, and recover the direct costs of inspections and product testing from the responsible economic operator.

The risk most often overlooked is not a fine. It is time. The DPP requires upstream data from every relevant tier of your supply chain. That process typically takes twelve months or more in multi-tier global supply chains. Suppliers need to be identified, briefed and given time to respond, and some will need their own upstream suppliers to provide data first. If your delegated act is published and gives you twelve months to comply, that window needs to include data collection. Companies that have not started are already behind.

Working with over 300 brands on EU market access and DPP readiness, we see the same mistakes appearing consistently. The most damaging ones are not technical errors. They are strategic assumptions that leave companies with less time and fewer options when enforcement arrives.
Assuming your EU distributor handles it. The obligation to create and maintain the DPP sits with the economic operator who places the product on the EU market. Your distributor is not that party. You are.
Thinking CE marking already covers it. CE marking documentation is one data field within the DPP. It does not replace the need for carbon footprint data, materials composition and end-of-life instructions. It is the starting point, not the complete solution.
Buying a “compliant DPP” before the delegated act is published. For most categories, the sector-specific requirements have not yet been confirmed in law. Any provider claiming to offer a fully compliant DPP for those categories is offering a pre-DPP. That may be useful work. It is not final compliance. Understand what you are buying before you invest.
Waiting for the delegated act before starting supplier data collection. Supplier data collection takes twelve months or more in most supply chains. Waiting for regulatory confirmation before starting means you will not have the data ready when the compliance window opens.
Not having an EU-based operator (AR or importer). Without an EU AR, you cannot issue a compliant DPP. The AR’s identity is a mandatory field under ESPR Annex III. Without it, the DPP cannot be issued and your products cannot legally be placed on the EU market.

The DPP is a legal obligation and a market barrier. Companies will comply because they must. The more important question is what can be gained by acting before the deadline, when there is time to design the approach rather than react to it. The answer is more significant than most companies expect, and it extends well beyond compliance.

Preparing for the DPP forces a question that most companies cannot currently answer: where is your product data, and who owns it? For most businesses, product information is fragmented across ERP systems, PDFs, supplier emails, spreadsheets and audit reports, with no single reliable source. The DPP requires building one.
Companies that invest in data governance in preparation for the DPP do not simply become DPP-compliant:

• They gain a data foundation that serves the entire business.
• Real-time detection of quality and supply chain errors becomes possible.
• Responding to market surveillance requests takes hours rather than weeks.
• Manual reconciliation between teams is reduced.

And the same data foundation covers obligations across multiple EU regulations simultaneously: REACH, CSRD (Corporate Sustainability Reporting Directive), CBAM (Carbon Border Adjustment Mechanism) and PPWR.

– EY at the World DPP Summit in Berlin in March 2026​

Every time a customer scans the QR code on your product, it is not the end of a transaction. It is the beginning of a conversation.
Companies already implementing pre-DPPs report this as the most unexpected commercial insight: the data carrier is a direct, permission-free channel to the end user at the moment of highest product engagement.
Companies are using it to tell the story of the brand and the supply chain, demonstrating quality and provenance of materials in a way no marketing content can match. They are using it to deliver after-sales value (maintenance guides, spare parts, repair service access) which reduces returns and extends product life. Each scan also creates a natural moment to connect the consumer to complementary products.
For brands selling physical goods into the EU, the DPP data carrier is potentially the most direct post-purchase touchpoint available. Once the infrastructure is in place, activating this channel costs nothing additional.

The Green Claims Directive (effective September 2026) prohibits unsubstantiated environmental claims. A verified, data-backed DPP is the strongest available evidence base for any sustainability or circularity claim. Companies that invest in DPP data infrastructure before the legal deadline will be able to substantiate claims that competitors cannot, creating genuine market differentiation rather than a compliance checkbox.

The DPP represents a monumental shift in how products are tracked, regulated, and understood. For businesses, this means not only staying compliant but also embracing a more sustainable and transparent way of doing business. The time to prepare is now. Start by engaging with your supply chain, standardization bodies, and regulatory frameworks to ensure your business is ready for the future of product compliance and sustainability. If you have any questions or would like further information, please don’t hesitate to contact us:

We have worked with over 300 non-EU manufacturers on EU market access, with zero compliance failures due to documentation errors. Our starting point for DPP work is the same as for CE marking: understanding your products, your supply chain and your timeline before recommending any action.