Digital Product Passport Implementation: An Eight-Step Plan Mapped to the Law

Digital product passport implementation is an eight-step project that ends with a registered, backed-up Digital Product Passport (DPP) for every in-scope product before it reaches the EU market. This guide is for the operator placing goods on that market: the brand, importer or manufacturer carrying the legal duty.

Each step is tied to the article it must satisfy in Regulation (EU) 2024/1781, the ESPR (Ecodesign for Sustainable Products Regulation), or in the registry rules. New to the topic? Start with what a digital product passport is.

What does digital product passport implementation actually involve?

Digital product passport implementation means making a passport available for each product covered by an ESPR product-group delegated act. Each passport must be linked to a persistent unique identifier, reached through a data carrier on the product, backed up by an independent digital product passport service provider and registered in the EU registry before market placement (ESPR Articles 9–13).

A delegated act here is the product-group regulation the Commission adopts under the ESPR. It sets the actual passport fields, the carrier and the level of detail. As of October 2026, none with passport requirements has been adopted, so no ESPR product needs a passport yet and act-specific details are unknown.

Which law governs each step?

This table maps each step of a digital product passport implementation to its legal anchor, the evidence to keep and its status. "IR" means Implementing Regulation (EU) 2026/1778, the registry rules.

Two steps decide whether a product can be registered at all: the back-up in step 5 and registry onboarding in step 6.

Steps 1–2: where do you start?

Step 1: scope. Under ESPR Article 9(1), a passport becomes a condition for market placement only once a delegated act requires it. The only ESPR delegated act adopted so far, Delegated Regulation (EU) 2026/296, concerns unsold goods and sets no passport requirements. Batteries run on their own law: their passport is mandatory from 18 February 2027.

A delegated act normally applies no earlier than 18 months after it enters into force (Article 4(4)). That is your minimum window. The ESPR working plan shows which groups are expected first.

Step 2: data inventory. List the Annex III elements your act could require and mark what you hold.

Some duties are already written into the ESPR and will apply once your act does: a type, batch or serial number on the product, manufacturer contact details on the public part of the passport, and digital instructions in the passport, online for the product's expected lifetime and at least 10 years (Article 27(5)–(7)).

The act may define who creates or updates which data (Article 9(2)(g)), so name an owner per field now. The first deliverable of a digital product passport implementation is a scope memo plus a gap list. For textiles, see the textile data guide.

Step 3: which identifiers do you need?

Most identifier work in a digital product passport implementation can start before your act appears; only the level (one passport per model, batch or item) waits for it. You need three kinds (ESPR Articles 10(1) and 12, Annex III):

• Unique product identifier: persistent, and connected to the passport through the data carrier.
• Unique operator identifiers: for you and the other actors the passport names.
• Unique facility identifiers: for the sites the passport names.

Which standard? Annex III names ISO/IEC 15459. The ESPR allowed "equivalent European or international standards" only until harmonised standards were cited in the Official Journal. That happened on 15 July 2026 with Implementing Decision (EU) 2026/1736, so plan identifiers against EN 18219 (unique identifiers) and carriers against EN 18220 (data carriers).

Missing identifiers. If a supplier or site has none, the operator creating or updating the passport must seek that actor's confirmation that none exists, request one on the actor's behalf and pass on the details once issued (Article 12(2)–(3)).

Numbering levels. Design model, batch and item numbering before you register: the registry links an item-level passport to its batch and model, and a batch-level one to its model, where those exist (IR Article 8(4)–(5)).

The GS1 route. GS1's provisional, not ratified DPP standard uses the GTIN, plus batch/lot or serial number as required, and the GLN for operators and facilities, both ISO/IEC 15459-compliant. GTINs come from a GS1 Company Prefix licensed by a GS1 member organisation. Our GS1 Digital Link page shows how a GTIN becomes a web address.

Step 4: QR code or Data Matrix — what goes on the product?

In a digital product passport implementation, the carrier is the step you cannot finish early. It must be physically on the product, its packaging or accompanying documents (Article 10(1)(b)), and the delegated act sets its type, layout and position. Final artwork waits for the act; meanwhile, decide what the carrier will encode.

With GS1 identifiers, the carrier holds a GS1 Digital Link URI, whose syntax conforms to ISO/IEC 18975. GS1's provisional standard names a QR Code or Data Matrix with that syntax, and allows RFID only in addition.

EN 18220 is the cited harmonised standard on data carriers. Our 2D barcode guide covers printing, and the free GS1 Digital Link QR generator makes test codes.

The dealer copy. Dealers and online marketplaces can request a digital copy of the data carrier or unique product identifier, or a webpage link. You must supply it free of charge, promptly and in any event within five working days (Article 10(3)). Name one person to handle these requests.

Step 5: what must a passport platform guarantee?

Whether you build or buy, the law lists properties that any host in a digital product passport implementation must deliver:

The back-up applies even if you host the passport yourself: a DPP service provider is an independent third party you authorise (Article 2(32)), so your own server cannot hold it. Manufacturers and importers must keep it at the most up-to-date version, an ongoing duty.

Two caveats. EN 18239 (access rights, security) and EN 18246 (data integrity) are published by CEN-CENELEC but not yet cited in the Official Journal. And a delegated act on service-provider requirements is indicated for 2027 (expected), so no provider can yet show it meets those rules.

Step 6: what must you schedule for registration?

Registration is the last gate of a digital product passport implementation, and three parts of it need lead time:

• Verification. Only verified operators can register. An EU company proves its identity with a qualified electronic seal, a company's legally recognised digital stamp from a qualified trust service provider, or with a qualified electronic attestation of attributes (IR Article 4). Status lasts three years at most.
• Data mapping. The registry automatically checks each submission against the data models in its semantic repository, the Commission's official catalogue of passport data definitions (IR Article 8(7)). Map your fields to it early.
• Who registers for whom. A platform or contract manufacturer can register for you only if it is verified itself, and you stay fully responsible (IR Article 19(4)).

Our registry guide walks through enrolment, verification and the upload step by step.

Is the registry ready? Partly. The platform, testing environment and helpdesk are live, and enrolment and verification work. But the Commission's User Guide v1.03 of 16 September 2026 says "Currently, it is not possible to successfully register DPPs", as the battery semantic catalogue is not yet defined.

No ESPR product needs registering yet; battery passports come first. For a digital product passport implementation, that means: verify now, register later.

Steps 7–8: what changes at customs and after launch?

Step 7: customs. If you import, customs adds a duty to your digital product passport implementation. For products under an ESPR delegated act, whoever declares goods for release for free circulation must give customs the unique registration identifier (Article 15(1)).

Release for free circulation is the customs procedure that clears imports onto the EU market. Batteries are the exception (see the table below).

Automated checks need the registry linked to the EU Customs Single Window Certificates Exchange System (EU CSW-CERTEX), which exchanges information with national customs systems. That link is due within four years of the registry rules entering into force: by 6 August 2030 at the latest (Article 15(3)). Our customs guide covers the flow.

Step 8: run it for the product's life. A digital product passport implementation does not end at launch. Passport data must stay accurate, complete and up to date (ESPR Article 9(1)), so the passport must reflect production or design changes, and the back-up must follow every update. Such changes may also call for a conformity reassessment (Article 27(4)).

The registry keeps a timestamped version of every registration update. After remanufacturing, a new passport must link to the original one.

Walkthrough: a hypothetical apparel producer in Łódź

Take a hypothetical contract manufacturer in Łódź: two plants, 180 SKUs of T-shirts and sweatshirts, three EU brands. Assume the textile delegated act, not yet adopted, has entered into force. Each brand sells under its own name, so each is the manufacturer (ESPR Article 2(42)). The Łódź firm runs the digital product passport implementation for all three:

• Months 1–2: gap analysis against the act; one owner per field.
• Month 2: identifier plan. Two brands assign GTINs from their GS1 licences; the third applies to its GS1 member organisation. GLNs for both plants. Three yarn suppliers named in the passport lack operator identifiers. After the three suppliers confirm none exists, the operator creating the passports requests them (Article 12(2)).
• Month 3: qualified electronic seals ordered by the brands and by the Łódź firm, which will register for them.
• Months 3–5: data mapped to the semantic repository.
• Month 6: 10-SKU test registration in the registry testing environment.
• Months 6–8: carrier artwork.
• Months 7–9: platform and back-up contracts.
• Months 10–18: rollout brand by brand. Each brand receives a proof of registration, the registry's sealed and time-stamped evidence.

Three counterfactuals. If the back-up link is missing from one brand's passports, the automatic check fails (IR Article 8(7)(e)): no registration identifier, no proof of registration. If one GTIN digit is mistyped on a label, the check digit fails and the code does not resolve.

If a label carries another SKU's valid GTIN, the registry cannot see the mix-up, and the code opens the wrong product's passport. The first error stops you at the gate, the second at the first scan. The third surfaces only when someone reads the passport closely.

How does the battery passport differ from an ESPR passport?

Both use ISO/IEC 15459 identifiers and the same registry. A company making both can therefore share registry onboarding across its digital product passport implementation, but not its carrier, storage or back-up set-up. See our battery passport guide.

Edge cases: what if your situation is different?

These cases change who does what in a digital product passport implementation, not the eight steps.

Private label. If you make private-label goods, the brand selling under its own name or trademark is the manufacturer (ESPR Article 2(42)). You supply the data and, once verified, may register for the brand; the brand keeps the duty.

No GS1 licence of your own. GTINs come from a GS1 Company Prefix that a GS1 member organisation licenses to a company. If you make goods for brands, agree whose prefix each GTIN comes from before artwork starts.

Products already on sale. The passport is a condition for placing a product on the market (Article 9(1)), not for launching a SKU. Expect an established SKU to need passports for units placed on the market once your act applies, and check the act's own transitional rules.

The act changes mid-project. An amendment to a delegated act may apply earlier than the usual 18 months (Article 4(4)). Keep act-specific fields configurable.

Non-EU manufacturer. The importer must ensure the passport and its current back-up exist (ESPR Article 29(2)(c)). See our guide for non-EU manufacturers.

No delegated act yet. No ESPR passport duty applies. Article 9(4) also lets the Commission exempt a group where specifications are missing or other EU law offers an equivalent system. Small firms: see SME exemptions.

Zoom out: what is settled and what is still pending?

Settled (law): ESPR Articles 9–15 and Annex III; the registry rules in Implementing Regulation (EU) 2026/1778; six harmonised standards cited by Implementing Decision (EU) 2026/1736; the battery passport from 18 February 2027.

Pending (expected, not adopted):

• Iron and steel delegated act: 2026 (expected)
• Textiles delegated act: 2027 (expected)
• Delegated act on DPP service-provider requirements
• Official Journal citation of EN 18239 and EN 18246
• Battery access-rights implementing act, which missed its legal deadline
• The Article 14 public web portal, which the Commission plans "in the coming years"
• The registry–customs interconnection
• Article 12(4) rules on identifier issuing agencies and self-issued identifiers, which the Commission may adopt; none is in its indicative timeline

Proposal COM(2025) 504 would amend ESPR rules on documents for authorities and on contact details. It leaves Articles 9–15, the passport rules a digital product passport implementation relies on, untouched. A negotiated text still awaits Parliament's plenary vote, so the final wording may differ.

The architecture of a digital product passport implementation is law; product details are not. Build what is fixed, and keep act-specific fields configurable.

What should you do in the first 90 days?

Start your digital product passport implementation with seven items that do not wait for your delegated act:

1. Scope memo: each product, its likely act, and who the manufacturer is.
2. Identifier plan: product, operator and facility identifiers; numbering levels; GS1 licence status.
3. E-seal: order a qualified electronic seal; it is a lead-time item.
4. Data gap list: Annex III elements, one owner each.
5. Back-up shortlist: independent providers, checked against the Article 11 clauses.
6. Registry onboarding: create an EU Login (a separate one for the testing environment), enrol and get verified; test registrations once the registry accepts them.
7. Dealer copy: a process with a five-working-day clock.

Try the free QR generator for a test code: no signup, and it runs in your browser. Passmith also has a free plan.

Further reading: What is a digital product passport? · DPP at EU customs · Battery passport · GS1 Digital Link

Related articles

What Is a Digital Product Passport? 2026 GuideWhat a Digital Product Passport is, how it works, which products need one and when (batteries first, 18 February 2027), and what data it carries.Digital Product Passport for Non-EU ManufacturersYou manufacture outside the EU and export in? Who legally owns the digital product passport obligation, what buyers will demand, and how to prepare.Battery Passport: Ready for February 2027?The EU battery passport becomes mandatory on 18 February 2027. Which batteries are in scope, what data is required, and how an exporter prepares for it.