Digital Product Passports are no longer a policy concept. With the EU's DPP Registry live since July 2026 and the first mandatory passports due for certain batteries on 18 February 2027, the question for most businesses has shifted from "what is a DPP?" to "is our data ready for one?"
For anyone working with chemicals, that second question matters more than most. A product passport is only as reliable as the data behind it, and much of that data is chemical: what a product contains, which substances are of concern, and how they are classified and managed. In this first post of our series, we explain what a Digital Product Passport is, where the rollout stands, and why, for most chemical companies, the real task is supplying trusted data to the businesses that publish passports.
A Digital Product Passport is a structured, digital record of key information about a product, accessed through a data carrier such as a QR code on the product or its packaging. It gives customers, authorities and other businesses in the value chain reliable information about what the product is, what it contains and how it complies.
The legal backbone is the Ecodesign for Sustainable Products Regulation (ESPR), Regulation (EU) 2024/1781, which entered into force in July 2024. ESPR sets the horizontal framework, but it does not switch on passport obligations by itself. Those arrive product group by product group, through delegated acts under ESPR and through sector legislation such as the Battery Regulation (EU) 2023/1542.
Depending on the product group, a passport can include:
Not everyone sees everything. Passports use tiered access, so different users from customers to market surveillance authorities and customs, can each be given the information relevant to them.
The infrastructure is now in place, and the first deadline is a little over four months away. July 2026 brought two key implementing acts: Commission Implementing Decision (EU) 2026/1736, referencing six harmonised EN standards covering data exchange, unique identifiers, data carriers, storage, APIs and interoperability, and Commission Implementing Regulation (EU) 2026/1778, which sets the arrangements for the DPP Registry.
The Registry itself went live on 20 July 2026, alongside a testing environment and helpdesk (European Commission). One point is often misunderstood: the Registry does not hold the passports. It records each passport's unique identifier and metadata, while the product data stays decentralised with the economic operator or their service provider.
|
Milestone |
Date |
What it means |
|
ESPR enters into force |
July 2024 |
Framework for DPPs across product groups |
|
ESPR Working Plan 2025–2030 adopted |
April 2025 |
Priority product groups and indicative timetable set |
|
DPP standards and Registry rules adopted |
July 2026 |
Technical and operational rules set |
|
DPP Registry launched |
20 July 2026 |
Testing environment open; registration becomes mandatory as each obligation applies |
|
First mandatory passports |
18 February 2027 |
Certain large batteries under Regulation (EU) 2023/1542 |
|
Detergents passport applies |
23 September 2029 |
Under the new Detergents Regulation (EU) 2026/405 |
Each industry's passport arrives on its own timetable. Some dates are fixed in law; others are the Commission's indicative dates for adopting the relevant ESPR delegated act. Product requirements under ESPR generally apply no earlier than 18 months after a delegated act enters into force, so an indicative adoption year is not a compliance deadline, but it is a strong signal of when the clock will start.
|
Industry |
Legal basis |
DPP timing |
Status |
|
Batteries (EV, light means of transport, and industrial batteries above 2 kWh) |
Battery Regulation (EU) 2023/1542 |
18 February 2027 |
Fixed in law |
|
Iron and steel |
ESPR delegated act |
Act expected Q4 2026; applies at least 18 months later |
Call for evidence closed August 2026 |
|
Textiles (apparel), tyres and aluminium |
ESPR delegated acts |
Acts indicatively 2027 |
Preparatory work under way |
|
Furniture |
ESPR delegated act |
Act indicatively 2028 |
Preparatory work under way |
|
Mattresses |
ESPR delegated act |
Act indicatively 2029 |
Planned |
|
Construction products |
Construction Products Regulation (EU) 2024/3110 |
Phased by product family; first acts expected from late 2027, with 18 months to comply |
Construction DPP system being set up by delegated act |
|
Detergents and surfactants |
Detergents Regulation (EU) 2026/405 |
23 September 2029 |
Fixed in law |
|
Toys |
Toy Safety Regulation (EU) 2025/2509 |
1 August 2030 |
Fixed in law; the DPP replaces the EU declaration of conformity |
For chemical suppliers, the order matters less than it might seem. Steel, textiles, toys, detergents and construction products all depend on chemical inputs, so requests for passport data will flow upstream well before each deadline.
In most cases, the obligation to create a passport falls on whoever places the finished product on the EU market: the battery maker, the textile brand, the toy manufacturer. Most chemical companies sit further upstream. Their substances and mixtures end up inside those products, but they will not usually be the ones publishing the passport.
That does not put them out of scope. The passport holder needs composition and substance-of-concern data that, in practice, only its suppliers hold. As deadlines approach, chemical companies can expect customers to ask for that data in a structured, machine-readable form, often at short notice.
This is where a Digital Material Passport (DMP) comes in. A DMP is a structured digital record of a material's identity, composition, hazard classification and substances of concern, prepared so that downstream partners can draw on it directly when building their own DPPs. It is not a legal requirement under ESPR in its own right, but for chemical suppliers it is the practical way to meet customer demand once and consistently, rather than answering every data request from scratch.
There are exceptions. Detergents have their own passport requirement under Regulation (EU) 2026/405 from 23 September 2029, so detergent manufacturers will need to issue passports themselves as well as supply data.
At the heart of ESPR is a requirement to track substances of concern through a product's life cycle. Article 2(27) of ESPR defines these in four groups: substances on the REACH Candidate List of substances of very high concern; substances classified under CLP in specific hazard classes, such as carcinogens, mutagens, reproductive toxicants and endocrine disruptors; persistent organic pollutants; and substances that negatively affect the reuse and recycling of materials in the product.
What is not yet settled is how that definition applies in practice. Which substances of concern must be declared for each product group, any thresholds or exemptions, and which substances count as hindering recycling are all being decided product by product in delegated acts. Where a passport applies, companies will need to declare the substances of concern present, where they sit in the product, and in what concentration.
That information already exists in most organisations, but rarely in one place or one format. It is spread across:
A passport pulls these threads together and makes them visible, often to regulators and downstream users simultaneously. Gaps or contradictions that once sat quietly in separate systems become public. An SDS that disagrees with a SCIP notification, or a composition that does not match a supplier's declaration, is no longer an internal housekeeping issue. It is a compliance risk printed on the product.
Much of the DPP market is focused on the publishing layer: generating QR codes, hosting passport pages and connecting to the Registry. These are necessary, but they solve the last step of the problem. A well-built passport filled with unverified data is still unverified data. And for chemical suppliers, the deliverables is not a QR codes at all: it’s the data itself.
The harder work sits upstream. Chemical data needs to be:
Regulatory lists change constantly, and a passport is a living record that must keep pace. Companies that treat the DPP as a one-off publishing exercise will find themselves re-validating data under deadline pressure. Those that treat it as a data governance programme will find each new customer request, and each new product group, easier than the last.
Even if your customers’ products are not in the first wave, the groundwork takes time. Five practical steps to start with:
Penman Consulting has spent years helping companies manage chemical regulatory data across REACH, CLP, SDS and SCIP. Digital Product Passports bring that work into the open, and we help clients make sure the data they publish, or supply to their customers, is defensible.
In the next post in this series, we will look at what the first wave of passports means in practice for specific sectors. In the meantime, get in touch to talk through your readiness.