Digital product passport requirements come in two layers, and mixing them up is where most planning goes wrong. One layer is already law and identical for every passport: Regulation (EU) 2024/1781 (the Ecodesign for Sustainable Products Regulation, or ESPR) says a passport must be reachable from a data carrier physically on the product, must use open standards, and must stay accurate, complete and up to date. The other layer — what data actually goes in — is set separately for each product group, in a piece of follow-on law called a delegated act.
So if you’re asking “what does my digital product passport have to contain?”, the honest answer for almost every product today is: nobody has decided yet. What you can plan against is the first layer, because it won’t change per group.
What must every digital product passport do, regardless of product?
Article 10 of Regulation (EU) 2024/1781 sets the essential requirements that no delegated act can override. There are three, and each has a practical consequence worth thinking about now.
The passport must connect to a persistent unique product identifier through a data carrier that is physically present on the product. “Data carrier” is defined in Article 2, point (29) as “a linear barcode symbol, a two-dimensional symbol or other automatic identification data capture medium that can be read by a device” — a barcode or QR code, in plain terms. A unique product identifier, point (30), is “a unique string of characters for the identification of a product that also enables a web link to the digital product passport”. Physically present matters: a passport you only host on your website doesn’t satisfy this.
The passport must use open and interoperable data standards. Your internal product database schema is not that, and neither is a PDF.
And the passport may not store customers’ personal data without their explicit consent under Article 6 of Regulation (EU) 2016/679 — the GDPR. A passport that quietly records who bought the item is a data-protection problem, not a compliance win.
Article 9 adds a standing quality duty that sits above all of it: “the data in the digital product passport shall be accurate, complete and up to date.” That’s an ongoing obligation, not a one-off at manufacture.
What data has to go in a digital product passport?
There is no general list, and anyone who gives you one is guessing. Article 2, point (28) of Regulation (EU) 2024/1781 defines the passport as “a set of data specific to a product that includes the information specified in the applicable delegated act adopted pursuant to Article 4” — the definition itself points elsewhere for the contents.
What Article 9(2) does tell you is the set of questions each product group’s delegated act has to answer. That’s a genuinely useful planning list, because whatever your group’s act says, it will say something about each of these:
| Article 9(2) requires each delegated act to specify |
|---|
| The data to include in the passport, drawn from Annex III |
| Which data carrier or carriers to use |
| The layout and positioning of that carrier |
| Whether the passport applies at model, batch or item level |
| How the passport is made accessible before a sale contract binds the customer |
| Which actors get access to which data |
| Who may create a passport or update its entries, and what they may change |
| How long the passport must remain available |
The model-batch-item question is the one that changes your systems most. A passport per model is a content problem. A passport per item is a serialisation problem reaching back into production, and it is much harder to retrofit.
Who has to produce the passport?
Article 2(46) of Regulation (EU) 2024/1781 defines “economic operator” broadly — “the manufacturer, the authorised representative, the importer, the distributor, the dealer and the fulfilment service provider”. The sharp duties in Chapter III land on one of them: the economic operator placing the product on the market.
Two concrete duties sit there. Article 10(3) requires that operator to give dealers and online-marketplace providers a digital copy of the data carrier or the unique product identifier within five working days of a request. Article 10(4) requires them to make a back-up copy of the passport available through a digital product passport service provider — defined in Article 2, point (32) as an independent third party the operator authorises to process and host the data.
Beyond that, Article 9(2), point (g) hands the question to each delegated act, which names “the actors that are to create a digital product passport or update the data in a digital product passport and what data they may introduce or update”. In a long supply chain, who fills which field is a product-group answer, not a general one.
If you’re an importer, read that carefully. Placing the product on the EU market is what triggers these duties, and it does not matter that a supplier three countries away holds the data you need.
Who gets to read it, and for how long?
Article 11 of Regulation (EU) 2024/1781 makes access free of charge and lists who is entitled to it: customers, manufacturers, importers, distributors, dealers, professional repairers, independent operators, refurbishers, remanufacturers, recyclers, market surveillance authorities, customs authorities, civil society organisations and trade unions. Each group sees whatever its product group’s delegated act grants it.
Article 11 also requires the passport to survive the company behind it — it must remain available after an economic operator’s insolvency, liquidation or cessation of activity. That is the requirement companies underestimate most. A recycler handling your product in 2040 needs the material data whether or not you still exist, which is exactly why Article 10(4) puts a back-up copy with an independent third party.
Practically, it means a passport built as a page on your own domain does not meet the requirement, however good the page is.
Which digital product passport requirements are binding right now?
For product groups under ESPR: none of them yet, as far as we can verify.
Article 9 makes the passport obligation conditional — products “can only be placed on the market or put into service if a digital product passport is available in accordance with the applicable delegated acts adopted pursuant to Article 4”. No act for your group, no passport duty. Article 4(7) sets the floor for the whole system: “The first delegated act to be adopted under this Article shall not enter into force before 19 July 2025.” And Article 4(4) builds in a runway — a delegated act’s date of application must be set “not earlier than 18 months from its entry into force”, except in duly justified cases.
Which groups go first is set by the Commission’s working plan. Article 18(3) requires a public plan covering at least three years; Article 18(5) required the first one by 19 April 2025 and named the priority groups: iron and steel, aluminium, textiles (in particular garments and footwear), furniture including mattresses, tyres, detergents, paints, lubricants, chemicals, energy-related products, and ICT products and other electronics. The Commission’s ESPR page confirms it adopted that first working plan in April 2025.
Re-checked on 30 July 2026: the only acts that page lists as adopted are the first working plan of 16 April 2025, and two acts from 9 February 2026 — a delegated regulation on derogations from the ban on destroying unsold consumer products, and an implementing regulation on disclosing information about discarded unsold stock. None of them sets passport requirements for a product group. Treat that as a status reading with a short shelf life: check the Commission’s page yourself before you conclude your group is still clear.
Cement runs on its own clock. Article 18(6) says ecodesign requirements for cement are to be set “not earlier than 31 December 2028 and not later than 1 January 2030”, and only if the EU’s construction products framework still lacks adequate environmental and carbon-footprint requirements by then.
If you don’t yet know which EU regimes reach your products at all, that’s the cheaper question to answer first. Clearlane’s free EU scope scanner gives a cited first-pass read across the five current EU compliance regimes from a product code or description. It’s for orientation, not a filing decision.
What about the registry and customs?
Article 13(1) of Regulation (EU) 2024/1781 says: “By 19 July 2026, the Commission shall set up a digital registry (the ‘registry’) which stores in a secure manner at least the unique identifiers.” For products going into free circulation it also stores the commodity code, and it stores battery identifiers under Article 77(3) of Regulation (EU) 2023/1542.
That date has passed. It was a deadline on the Commission, never on you — but it matters to you, because of what Article 15 does next.
Article 14 requires something separate: a publicly accessible web portal where stakeholders can search and compare data held in passports.
The customs duty switches on by operability, not by date
Article 15 is where this reaches the border, and it’s worth reading precisely. Where a delegated act covers your product, you must provide the unique registration identifier to customs on release for free circulation — but Article 15(1) says that duty “shall apply from the moment the registry is operational.”
Customs may then release a product only after checking that the identifier and commodity code match what the registry holds. That verification is electronic and automatic through an interconnection with the EU Customs Single Window (EU CSW-CERTEX), and it too applies only “from the moment that interconnection is operational.” Article 15(3) gives the interconnection four years from the entry into force of the implementing act under Article 13(5).
So there are three separate switches — the registry existing, the interconnection working, and your product group having a delegated act — and the customs obligation needs all three. A passed deadline on the Commission does not by itself put anything on your desk.
This article states what the law requires. It does not tell you the registry’s current operational status — check the Commission’s published position before you build a customs process around it.
Are the battery passport requirements the same?
No, and this is the one set of passport requirements that already binds products.
The battery passport comes from a different law, Regulation (EU) 2023/1542 on batteries and waste batteries. Article 77(1) requires that “from 18 February 2027 each LMT battery, each industrial battery with a capacity greater than 2 kWh and each electric vehicle battery placed on the market or put into service shall have an electronic record (‘battery passport’)”. LMT means light means of transport — a sealed battery of 25 kg or less providing traction for wheeled vehicles like e-bikes, per Article 3(1), point (11).
Note what’s outside that: portable batteries and SLI batteries (the starting, lighting and ignition batteries in a conventional vehicle) carry no passport duty under Article 77(1).
| ESPR digital product passport | Battery passport | |
|---|---|---|
| Legal basis | Regulation (EU) 2024/1781, Articles 9–15 | Regulation (EU) 2023/1542, Articles 77–78 |
| Binding from | Only when the product group’s Article 4 delegated act applies | 18 February 2027 (Article 77(1)) |
| Covers | Any physical good in ESPR scope, group by group | LMT batteries, industrial batteries over 2 kWh, EV batteries |
| Who sees what | Free access for a listed set of actors, per delegated act (Article 11) | Three tiers: public, authorities only, and legitimate interest (Article 77(2)) |
| How it’s reached | Data carrier physically present on the product (Article 10) | QR code under Article 13(6), linked to a unique identifier (Article 77(3)) |
| Who is responsible | The operator placing the product on the market (Article 10(3), (4)) | The operator placing the battery on the market (Article 77(4)) |
Article 78 of Regulation (EU) 2023/1542 sets the battery passport’s own essential requirements, and they rhyme with ESPR’s: interoperability with other EU digital product passports, free access for consumers and economic operators, open and machine-readable formats, and availability that continues after the responsible economic operator “ceases to exist or ceases its activity in the Union”.
If you place LMT, EV or larger industrial batteries on the EU market, 18 February 2027 is a real date to work backwards from. Article 77(4) puts responsibility for keeping the passport “accurate, complete and up to date” on the operator that placed the battery on the market.
What should you do before your delegated act lands?
The useful work right now is not choosing software. It’s finding out whether you could fill a passport at all.
Take the Article 9(2) list above and run it against one real product. Could you produce a persistent unique identifier for it today? Do you know the material composition well enough to answer a question you haven’t seen yet? Can your tier-two supplier tell you where a component came from, in a format that isn’t an email? Discovering a gap now costs a conversation. Discovering it under a delegated act’s date costs a product line.
Then decide the model-batch-item question provisionally. It’s the one requirement that reaches into production systems, and eighteen months of runway disappears quickly if serialisation turns out to be the answer.
If you’re not sure which EU regimes touch your products, start with the free EU scope scanner — it’s cited, takes a minute, and needs no account. For the fuller walkthrough of ESPR and the passport, see the digital product passport guide and our explainer on what the EU digital product passport is and when it applies.
Clearlane prepares and validates compliance evidence and hands it back to you. It never files to a registry or a portal on your behalf.