Digital Product Passport: common questions, answered

This post answers ten common questions about the Digital Product Passport for a UK maker of metal parts. Most of them are questions the European Commission answers in its own DPP FAQ. Each answer points back to the Regulation, a Commission page or the UK government, and where a point comes only from the FAQ, we say so.

The FAQ is Digital Product Passport: Frequently Asked Questions (FAQ), version 1.0, December 2025. It says it "should not be considered as representative of the European Commission's official position", so treat its answers as the Commission's explanation rather than as law. The Regulation is Regulation (EU) 2024/1781. Dates are the Commission's own, and a date marked indicative is a plan, not an adopted act.

When does a passport become a requirement for my parts?

There is no single start date. The Commission's FAQ says the DPP is introduced 'product by product', through delegated acts under the Ecodesign Regulation, and that a product group being in the Working Plan 'does not automatically mean' a DPP is mandatory. No product delegated act has been adopted yet. No product DPP obligation applies before 18 February 2027, and then only for certain batteries: electric vehicle, light transport and industrial batteries above 2 kWh, under the Battery Regulation.

Commission FAQ, questions 5 and 6

Which product rules are closest for metal parts?

The Commission's indicative timeline puts iron and steel first, in 2026. The Working Plan treats iron and steel as an intermediate product, and the Commission's DPP page now gives Q4 2026 for its act. That date is indicative, and the act has not been adopted. Aluminium is indicatively planned for Q3 to Q4 2027. A JRC draft proposal for steel content was prepared for stakeholder consultation in 2026. The JRC calls it 'a draft proposal prepared for stakeholder consultation', so it is not a rule.

Commission DPP page on iron and steel

Does this apply in Northern Ireland and Great Britain?

EU DPP requirements apply in Northern Ireland under the Windsor Framework. Great Britain is different. The UK has not adopted a DPP requirement. The Department for Business and Trade call for evidence on digital product records closed on 21 September 2026, and for Great Britain the UK government 'has not yet determined its approach'. If you ship to Northern Ireland, plan for the EU requirements. For Great Britain, watch the outcome of that call for evidence rather than assuming a rule.

UK government call for evidence on digital product records

Who creates the passport, us or our customer?

The Commission's FAQ says primary responsibility for creating a DPP, and for its accuracy, rests with the economic operators placing the product on the EU market. That list includes the manufacturer, the authorised representative and the importer. The FAQ says the DPP must be active and registered before a product is first made available on the EU market, and that the operator keeps the data accurate through the product's life. If you sell into the EU, check which of these roles you hold. Traced does not register passports with the EU registry and does not talk to it.

Commission FAQ, question 11

What must a passport contain?

Each product's delegated act sets the data. Article 9(2) of the Regulation says the acts specify data by reference to Annex III. Annex III lists the unique product identifier, the global trade item number, commodity codes, compliance documents such as the declaration of conformity and technical documentation, user manuals and safety warnings, identifiers for the manufacturer and facilities, the importer's EORI number, and a reference to the back-up service provider. For steel, a JRC draft proposal adds items such as product parameters and substances of concern. That is a draft, not adopted. Traced does not yet check a passport's fields against the regulation, because the rules for iron, steel and aluminium are still being finalised.

Regulation (EU) 2024/1781 on EUR-Lex

Is the passport kept per model, per batch or per item?

Each delegated act decides. Article 9(2) lets the act say whether the DPP applies at model, batch or item level, and Article 10(1)(f) says the data must refer to the product model, batch or item as the act specifies. The Commission's FAQ says each product, 'whether at the model, batch, or item level', is linked to a single unique identifier. No product act has been adopted, so no product has a level in force today. The JRC steel draft proposes a level for each data point, such as batch for the heat number, but that is a proposal.

Regulation (EU) 2024/1781 on EUR-Lex

What data carrier will the passport use?

The delegated act for each product group sets the data carrier. Article 10(1)(b) says it must sit physically on the product, its packaging or the documents that come with it, as the act specifies. The Commission's FAQ says CEN-CENELEC JTC 24 is assessing the suitability of technologies, and that QR codes and NFC chips are being considered. Because no product act is adopted, no carrier is fixed for metal parts yet. Check each delegated act when it appears rather than building around one technology now.

Commission FAQ, question 26

What does the EU registry hold, and does it hold our data?

The Commission's FAQ says the DPP Registry stores unique identifiers and links each one to the location of its DPP. The registry 'will not store the detailed product data itself'. That data stays with the operator or with a service provider acting for it. The Commission says the registry became operational on 20 July 2026. Under Article 13(5), a registration identifier is not proof of compliance. Customs checks linked to the registry are expected around 2029. Traced does not register passports with the EU registry and does not talk to it.

Commission news on the DPP registry, 20 July 2026

Do we need a service provider for the back-up copy?

The Commission's FAQ says operators must provide a back-up copy of the DPP through a third-party service provider, under Article 10(4). The back-up keeps the DPP available for the product's expected lifetime, even if the operator faces insolvency or stops trading (Article 11(e)). Service providers can take on the hosting and the legally required back-ups for a business. Implementing Regulation (EU) 2026/1778 says the registry includes a list of verified DPP service providers. The delegated act on service providers is not adopted, and its indicative date is Q2 to Q3 2027.

Commission FAQ, questions 8 and 24

Are the standards final?

Not all of them. CEN-CENELEC JTC 24 is writing eight standards for the DPP, covering areas from identifiers to APIs. Implementing Decision (EU) 2026/1736, published in the Official Journal on 15 July 2026, cites six as harmonised standards for Articles 10 and 11. EN 18239 on access rights and security, and EN 18246 on data authentication and integrity, were published by CEN on 16 September 2026 but are not yet cited. The Commission's indicative date for the decision on those two is November 2026, so do not treat all eight as harmonised yet.

Commission page on harmonised DPP standards

These answers come from the Commission's FAQ and the Regulation, and dates will move as the Commission adopts acts, so check its pages before you act on any of them. To see how Traced handles a passport record, start at the Traced page, or read the digital product passport page.