ESPR Digital Product Passport Requirements Checklist for Businesses

The Digital Product Passport has moved from policy discussion to operational reality. The ESPR entered into force on 18 July 2024, and the first hard compliance date, 18 February 2027 for batteries, is now close enough that preparation, not planning, is the task in front of most businesses. If you place physical products on the EU market, a DPP will eventually apply to you, and understanding the ESPR regulation DPP requirements obligations early is far cheaper than reacting once a delegated act comes in to force. This guide connects the regulatory framework to the practical steps, and where the post-purchase side of your operation (from real-time tracking to structured returns) intersects with the data circular-economy rules increasingly demand, we flag it. For the packaging-specific side of the same regulatory wave, our PPWR compliance guide and our overview of the circular supply chain are useful companions, and the full ShippyPro resources hub collects our EU compliance material in one place.

What Is the ESPR Digital Product Passport?

The Digital Product Passport is a structured digital record tied to an individual physical product through a unique data carrier such as a QR code, an NFC tag, or an RFID chip. Scanning that carrier resolves to information about the product across its whole lifecycle: what it is made of, where it came from, how to repair it, and what to do with it at end of life. The passport is machine-readable and interoperable by design, so a manufacturer, a recycler, a customs officer, and a consumer can each reach the layer of data relevant to them from the same code.

Crucially, a DPP is a data architecture, not a document. According to the DPP guidance published by specialist providers, a compliant passport cannot be a static webpage or a simple PDF; it must use a persistent unique identifier, rely on secure and resolvable hosting, and follow interoperability standards. That distinction is the single most common misunderstanding businesses have when they first approach the ESPR regulation DPP requirements obligations, and it drives almost every technical decision that follows.

Where the DPP comes from: the ESPR

The legal foundation is the Ecodesign for Sustainable Products Regulation, published as Regulation (EU) 2024/1781. The ESPR replaces the older Ecodesign Directive 2009/125/EC, which applied only to energy-related products such as washing machines and boilers, and dramatically widens the scope to cover almost all physical goods placed on the EU market, with only narrow exemptions for food, feed, and medicinal products. It is a framework regulation: it sets the machinery for ecodesign and information requirements, and then product-specific rules are introduced gradually through delegated acts. This is why there is no single "DPP format" that applies to everything, and why your obligations depend on your product category and its position in the rollout.

The scale of the environmental rationale is worth stating plainly, because it explains why the EU is regulating at the design stage rather than only at disposal. According to the European Commission, product design determines up to 80% of a product's environmental impact across its lifecycle. Addressing that impact where it is set, at design, is the entire logic of the regulation and of the passport that makes design and material data visible.

What Are the 8 Core DPP Requirements Under ESPR?

Before working through the checklist, it helps to see what the regulation actually demands. Every DPP placed on the EU market under the ESPR framework must satisfy all eight of the following requirements, and each is a continuing obligation rather than a one-time launch task.

Read together, these eight cover identity, content, technology, registration, access, interoperability, responsibility, and maintenance. The rest of this ESPR digital product passport requirements checklist for businesses expands each into the concrete work it implies.

What Data Must a Digital Product Passport Contain?

The ESPR defines a mandatory data architecture, and product-specific delegated acts then layer additional fields on top for each category. The core structure is usefully understood as five data layers, each with its own verification and update obligations. Getting the layer model right early is what stops a DPP project from stalling halfway, because it forces the question of where each data point comes from before you start collecting.

Layer 1: Product identity and traceability

This is the foundation. Without a valid, persistent identifier that resolves to a live data endpoint, nothing else in the passport is legally accessible or technically verifiable. The identity layer covers the unique product identifier (commonly a GS1 Digital Link or QR-encoded URL), the manufacturer's legal name and registered address, the product model or type identifier, batch or serial number at the granularity the delegated act sets, country of manufacture, date of production, and a reference to the Declaration of Conformity. Most of these are self-declared, but the identifier itself must be registered in the EU DPP Registry before market placement.

Layer 2: Material composition and substance data

This is the layer most manufacturers underestimate, because full disclosure needs data from sub-tier suppliers that many companies do not currently collect systematically. It covers material composition by weight percentage (including coatings and surface treatments), Substances of Very High Concern listed under REACH disclosed above 0.1% by weight, other restricted hazardous substances, recycled-content percentages split by pre- and post-consumer where applicable, critical raw material sourcing declarations, and geographic material origin for flagged materials. The REACH candidate list now runs to more than 250 SVHCs and is updated roughly twice a year, so treating substance disclosure as a one-time data entry guarantees non-compliance within months.

Layer 3: Performance, durability, and sustainability data

Requirements here vary by category, but the framework draws from a common set of parameters: carbon footprint (lifecycle kg CO2e with the methodology stated), energy-efficiency class, rated durability or expected lifetime, repairability score where mandated, recyclability rate, recycled content, and, for batteries, state-of-health data. Some of these can be self-declared; others require a test report or independent third-party verification. For batteries specifically, state-of-health and rated-capacity data must update dynamically as the battery ages, which turns the passport from a static record into a live one.

Layer 4: Repair, maintenance, and end-of-life information

The circular-economy layer is where implementations often stall, because it needs input from aftersales, spare parts, and logistics teams who have historically managed this information in isolation. It covers spare-parts availability and duration, repair manuals, authorised repair centres, disassembly instructions for recyclers, recyclability classification by component, hazardous-component locations, take-back scheme information, and software-update availability periods. This is also the layer that most directly touches the post-purchase side of an e-commerce operation, since take-back and return logistics are part of it.

Layer 5: Certification, compliance, and documentation

The compliance layer links the passport to the legal documentation behind the product's market authorisation: the CE marking reference and applicable directives, the full Declaration of Conformity, third-party audit certificates and their validity periods, notified-body information where relevant, the standards applied in testing, and EU type-examination certificate references for regulated categories.

Which Products Need a DPP, and When?

The DPP does not arrive for every category at once. Product-specific requirements are introduced through delegated acts on the timeline set by the Commission's first ESPR and Energy Labelling Working Plan for 2025 to 2030, and each act carries a minimum 18-month transition period before its requirements bite. The table below summarises the indicative picture; treat the battery date as fixed law and the others as adoption-work timelines that firm up as each act is published.

Two points matter for planning. First, ICT and electronics do not have a single delegated act; they are covered by horizontal requirements (reparability, indicative 2027; recycled content and recyclability of electrical and electronic equipment, indicative 2029). Second, application follows at least 18 months after each act enters into force, so the effective compliance date is always later than the adoption date. It is safer to say adoption work is expected around a given year than to claim full DPP compliance is automatically required that year.

Does the DPP apply to non-EU businesses and SMEs?

Yes on both counts. The ESPR's obligations are triggered by the act of placing a product on the EU market, not by where the manufacturer is incorporated, so a brand in the US, China, or anywhere else must comply if its products are sold in the EU. There is also no blanket SME exemption: while the Commission has committed to support tools for smaller companies, the core requirements apply once you place packaging or products on the market, and larger brands will contractually require their SME suppliers to provide structured compliance data regardless.

Product & Resources

Get your post-purchase data in order before the deadlines land

ShippyPro centralises tracking, returns, and shipment data across every carrier, so the operational records circular-economy rules increasingly expect are already in one place. Try it free for 14 days.

Who Is Responsible for Creating a Digital Product Passport?

One of the most misunderstood parts of ESPR compliance is that the regulation does not place every obligation on the manufacturer. It distributes responsibility across the value chain based on each actor's role in placing the product on the EU market, and it deliberately casts a wide net. The obligation is triggered by market placement, so the legal duty can cascade from a factory in one country to an importer in another.

Manufacturer obligations

The manufacturer is the primary duty holder when established in the EU or when it is the entity placing the product on the market. Its obligations include creating the DPP before market placement, populating all mandatory fields, registering the unique identifier in the EU DPP Registry, ensuring the data carrier is affixed to the product or its packaging, maintaining data accuracy throughout the product's market life, updating the passport when information changes, obtaining any mandated third-party verifications, and providing the DPP to importers and distributors on request.

Importer obligations

An EU-established importer that places a product from a non-EU manufacturer on the market carries significant liability. If the manufacturer has not created a compliant DPP, the importer assumes effective manufacturer status: it must create one, with all the same obligations, verify compliance before placement, keep a copy available to authorities for the retention period, ensure the carrier is present before distribution, and pass access credentials downstream. For EU importers sourcing from outside the EU, the practical response is to write DPP compliance into supplier contracts and to run pre-shipment DPP checks for categories already under active delegated acts.

Distributor obligations

Distributors, including online marketplaces, carry lighter but real obligations: verify that a compliant DPP exists and that the carrier is present before making the product available, never remove or obscure the carrier, cooperate with market surveillance authorities, and escalate any compliance issue to the manufacturer or importer (and to authorities where the product presents a risk).

The Three-Tier Access Model Explained

The regulation distinguishes three categories of data within a passport, each visible to a different set of actors. Configuring this correctly is both a technical requirement and a commercial one, because some data that must be in the DPP is genuinely sensitive and should reach authorised operators or authorities without being published to the public.

Tier 1: public consumer access

Reachable by anyone scanning the carrier, with no authentication. Typically the product model and manufacturer, country of origin, key sustainability parameters (energy class, recycled-content percentage, repairability score), a carbon-footprint summary, repair and maintenance information, end-of-life instructions, and CE marking references.

Tier 2: economic operator access

Reachable by authenticated business actors such as recyclers, second-hand dealers, and professional repairers. This tier carries commercially sensitive detail that circular operations need but the public should not see: precise material composition, specific SVHC concentrations, step-by-step disassembly instructions, and exact hazardous-component locations.

Tier 3: market surveillance authority access

Reachable only by EU authorities through secure channels. It holds the complete compliance record: the full Declaration of Conformity and technical documentation, third-party audit and notified-body certificates, complete test reports, full supply-chain traceability, and the DPP's version history.

Implementing this needs field-level, role-based access control, not just document-level permissions. Each data field needs an access classification, and the API must enforce it on every request, which is a core reason general-purpose CMS or document systems are not viable for compliant DPPs.

The ESPR DPP Requirements Checklist for Businesses: 8 Steps

Here is the practical sequence to work through. It follows the implementation order compliance and operations teams should take, from confirming scope to planning multi-decade data maintenance.

Technical Standards, Data Carriers, and the EU DPP Registry

Technical compliance is where projects most often run into unforeseen scope, because the regulation prescribes how DPP data is structured, stored, and accessed, not only what it contains. The physical carrier must meet a recognised standard: ISO/IEC 18004 for QR codes, ISO/IEC 18000-63 for UHF RFID, or ISO/IEC 14443 / 15693 for NFC, with GS1 Digital Link as the recommended encoding scheme because it lets one scan resolve to different data layers depending on the scanner's permissions. Data itself is expected to be machine-readable over open REST APIs, with JSON-LD as the preferred exchange format and interoperability standards such as EPCIS 2.0 and W3C Verifiable Credentials shaping how supply-chain events and tamper-evidence are handled.

The EU DPP Registry is the enforcement backbone. Under ESPR Article 13, the Commission must establish the registry, and industry guidance points to operational readiness around 19 July 2026. It is important to understand what it does and does not do: it stores unique identifiers and supports registration and lookup; it does not store all proprietary product data. When a regulator or customs officer scans a carrier, the registry resolves the identifier to the manufacturer's own data host. That decentralised design means operators keep control of, and legal responsibility for, their own data, while authorities get a standardised access path and a hard gate at import.

ESPR DPP Rollout as a Progression: From Readiness to Enforcement

It helps to see the rollout not as a single deadline but as stages that most businesses move through in the same order. The progression below frames where the effort sits at each point.

Common Compliance Gaps and How to Avoid Them

Businesses running early DPP pilots hit the same gaps between their initial assumptions and the actual requirements. Knowing them in advance saves significant remediation cost.

Related Articles

Build the operational backbone your compliance record needs

From full-loop tracking to structured returns, ShippyPro keeps the post-purchase data that circular-economy rules increasingly expect in one place. Start a free 14-day trial.