The EU Digital Product Passport: What ESPR Requires, and When It Actually Lands

The EU Digital Product Passport (DPP) is a structured set of product data, reachable from a data carrier on the product itself, that follows an item through its life. It is created by the Ecodesign for Sustainable Products Regulation — Regulation (EU) 2024/1781, known as ESPR — which is already in force. The part most teams get wrong is the timing: ESPR itself does not oblige anyone to issue a passport. Each product group only becomes subject to one when the Commission adopts a delegated act for that group.

That distinction matters commercially, because the market is full of countdown clocks to deadlines that do not yet legally exist.

• Confirmed in law: the battery passport under the EU Battery Regulation (EU) 2023/1542 applies from 18 February 2027.
• Not yet adopted: no ESPR delegated act has been adopted for any product group. Textiles are indicatively scheduled for 2027.
• Therefore estimated: textile DPP obligations realistically land around 2028–2029, after the act plus its transition period.
• Already biting: the ban on destroying unsold apparel and footwear applies to large companies from 19 July 2026.

[Visual · Timeline] Confirmed vs estimated — battery passport fixed at Feb 2027, ESPR delegated acts still pending, textile obligations in an estimated 2028–29 band.

What a Digital Product Passport actually contains

ESPR sets the frame; the delegated act for each product group sets the detail. Across the published drafts and the battery precedent, a passport is consistently built from four things.

1. A persistent product identifier. A unique ID for the item, batch or model, depending on the group. This is the anchor everything else hangs from.

2. A data carrier on the product. Something physically present — a QR code, a barcode, or an NFC or RFID tag — that resolves to the passport. ESPR is deliberately technology-neutral here: it specifies that a carrier must exist and be accessible, not which radio or symbology you use.

3. A defined data set. Durability, repairability, recycled content, substances of concern, and compliance documentation. The battery passport is the most developed example, covering carbon footprint, material composition and state of health.

4. Tiered access. Not everyone sees everything. Consumers, repairers, recyclers, customs authorities and market surveillance each get a different view of the same record.

The confirmed obligation: the battery passport

The battery passport is where DPP stops being theoretical. Under Regulation (EU) 2023/1542 it applies from 18 February 2027 to electric-vehicle batteries, batteries for light means of transport, and industrial batteries above 2 kWh placed on the EU market or put into service.

It is worth noting that other parts of that regulation have moved — battery due diligence obligations were pushed back by two years to August 2027 via Regulation (EU) 2025/1561 — while the passport date itself has not. Treat the February 2027 date as real and plan against it.

The unconfirmed ones: everything under ESPR

The ESPR Working Plan 2025–2030 names the first priority groups, with textiles and apparel, iron and steel, aluminium and tyres among them. Indicative adoption for the textile delegated act sits in 2027. Add the objection period and a transition window of roughly 18 months and the first genuine textile compliance date arrives in 2028 or 2029.

Footwear is a separate category and is not in the first working plan; a preparatory study is expected by the end of 2027.

The practical reading: you cannot be non-compliant with a delegated act that has not been adopted. You can, however, be two years behind on the data work it will require — and that is the real risk.

[Visual · Diagram] One product identity, many audiences — the same passport record serving consumer, repairer, recycler, customs and market surveillance views.

The part nobody regulates: whether the carrier can be trusted

Here is the gap in most DPP programmes. ESPR requires that a data carrier exists and resolves to a passport. It does not, in itself, require that the carrier proves it belongs to the product it is attached to.

A printed QR code is a picture of a URL. It can be photographed, reproduced perfectly and applied to a counterfeit item, which then resolves to a real passport for a real product. The record is authentic. The object holding it is not. You have, in effect, issued counterfeiters a compliance-grade credential.

This is not hypothetical. Every serialisation scheme that relies on a printed identifier has the same structural weakness: the identifier must be shown in order to be read, so it can be observed and copied.

What closes it

A carrier backed by a secure element answers a different question. Instead of presenting a copyable number, the chip holds a private key generated on-chip that is never exportable, and proves it holds that key by signing a fresh random challenge on every tap. Copy the chip’s readable data and you copy the public identifier but not the key, so the clone cannot sign and fails on the first verification.

The passport is then bound to the object, not merely printed on it. That is the difference between a product that has a passport and a product that is its passport.

A comparison of carrier options

	Printed QR / barcode	Standard NFC or RFID tag	Secure-element chip
Satisfies “a data carrier exists”	Yes	Yes	Yes
Unit cost	Lowest	Low	Low to moderate
Works without line of sight	No	Yes	Yes
Bulk reading	No	Yes (UHF)	Yes (UHF variants)
Can be copied onto a counterfeit	Trivially	Yes — the UID is readable	No — the key cannot be extracted
Proves carrier belongs to product	No	No	Yes
Survives the product’s full life	Poor — print wears	Good	Good
Supports tiered access control	Via the resolver only	Via the resolver only	Cryptographically, per reader

What to do in the next twelve months

The deadline uncertainty is an argument for doing the data work early, not for waiting.

1. Fix your identifiers first. Most DPP projects stall on the unglamorous problem that the same physical item has three different IDs in ERP, PLM and the warehouse system. Resolve that before you choose a carrier.
2. Assemble the data set you already owe. Substances of concern, recycled content and repairability information are largely already known somewhere in the business. Finding and structuring them takes longer than the technology.
3. Pick a carrier you will not have to replace. A carrier change means re-tagging physical inventory. If authenticity, warranty or resale matters to your category, a copyable carrier is a decision you will revisit.
4. Decide who sees what. Tiered access is a requirement, not a feature. Map your consumer, repairer, recycler and authority views now.
5. Treat batteries as the live one. If you place EV, light-transport or industrial batteries above 2 kWh on the EU market, February 2027 is a real date.

Frequently asked questions

Is the Digital Product Passport mandatory now? No. ESPR is in force, but passport obligations attach per product group through delegated acts, and none has been adopted yet. The battery passport is a separate regulation and does apply from 18 February 2027.

Does ESPR require a QR code specifically? No. It requires a data carrier that resolves to the passport. The choice of carrier is yours.

Will one passport cover the EU and UK? Not automatically. ESPR is EU law; other jurisdictions are developing their own schemes, so design your data model to be exportable rather than EU-shaped.

What happens to the passport when the product is resold? For products where ownership matters, the passport should transfer with the item. That requires a carrier that can prove which physical object it is attached to — see our guide to cryptographic provenance in luxury watches for how signed ownership transfer works in practice.

Can a counterfeiter clone a DPP? They can clone a printed carrier and point it at a genuine passport. They cannot clone a secure element, because the private key never leaves the chip.

Build the passport onto something that cannot be copied

If you are scoping a DPP programme, the carrier decision is the one with physical consequences — changing it later means touching every unit you have already made.

Talk to our team about chip selection, data model and tiered access, or see how the same architecture works across regulated and high-value categories.

Regulatory status in this article reflects published Commission working plans and the regulations cited, as at October 2026. Delegated act timing is indicative and has moved before — confirm current status against EUR-Lex and the Commission’s ESPR pages before committing to a compliance plan.