Every Digital Product Passport needs a data carrier, the physical mark that links a product to its passport. Most manufacturers still want to know where that mark has to go. The honest answer is that the Regulation leaves the choice open, and the detail sits in the delegated acts that will follow.
What Article 10(1)(b) says
Article 10(1)(b) of Regulation (EU) 2024/1781, the Ecodesign for Sustainable Products Regulation (ESPR), says the data carrier must be:
"physically present on the product, its packaging or on documentation accompanying the product, as specified in the applicable delegated act"
The Regulation does not rank the three locations; the delegated act for each product group will say which applies. The Commission's FAQ says the same thing from another angle: the carrier type is decided per product group (FAQ Q26). You can read the Commission's overview on its Digital Product Passport pages, and the Regulation text on EUR-Lex.
So for now there is no rule to follow. There is a set of questions the delegated act will ask, and it helps to think through them before it arrives.
Three places, three trade-offs
The three locations are practical trade-offs, not a legal order of preference. Here is how each one looks for a machined or fabricated metal part.
On the product
A nameplate, a laser mark or a metal tag fixed to the part is the most durable option. It stays with the part through packaging, installation and maintenance, which matters for parts that may stay in service for years. It is also where a technician will look.
The limits are physical. A small part, a coated surface or a component machined to tight tolerances may leave no room for a mark, or a mark may affect the part. Check this before you design the part, not after.
On the packaging
A label on the box or the pallet suits small parts that cannot carry a mark. It is cheap, and it can be changed without touching the part.
The weakness is that packaging is removed at installation. Once the box is in the bin, the link to the passport may be gone. Note also that ESPR does not address packaging as a specific product category. Packaging is covered by Regulation (EU) 2025/40 (PPWR), so do not assume a passport obligation for packaging under ESPR.
On the documentation
A code printed on the batch certificate or the paperwork that travels with a delivery suits information that applies to a whole batch rather than to each item. It is easy to produce and easy to change.
Paperwork is also the easiest thing to separate from the goods. A certificate in a folder at the goods-in desk does not follow a part that has been fitted into a machine.
One carrier or several?
Article 10(1)(a) says the passport must be "connected through a data carrier to a persistent unique product identifier". It says a data carrier, singular, and it sets no maximum. A second carrier for a different reader is therefore a design choice, not a rule. A common example is a durable mark on the part for a technician, and a label on the box for a buyer who scans before purchase. Both should lead to the same record.
Whether the delegated act asks for more than one carrier is for that act to decide.
The identifier and the carrier
The carrier is the thing you scan. The identifier is what the record is keyed on, and it has to be persistent, so the same code still works after the product changes hands. A QR code that encodes a web address to a record is a workable carrier. It works with any phone camera, and it does not depend on a special reader.
QR today, NFC-ready. The Regulation does not fix the technology, and the delegated act for each group will say which carrier types apply.
The Regulation also sets a lifetime requirement. Article 9(2) lets the delegated acts set an availability period, and it must be at least the expected product lifetime. For a metal part with a long service life, the mark and the record both have to last that long.
The standards
Two harmonised standards cover this ground. EN 18219 covers unique identifiers, and EN 18220 covers data carriers. Implementing Decision (EU) 2026/1736 cites them in the Official Journal of 15 July 2026, along with four others covering data exchange, storage, APIs and interoperability. The standards cover how the identifier and the carrier are specified. They do not decide where your mark goes.
What Traced does today
Traced gives each serialised product, or each batch, a 16-character trace ID. That ID is shown as a QR code. The QR code opens a public, mobile-first scan page that anyone can open. Signed-in staff also see the batch record on the same page. The same scan URL returns JSON, and every scan is logged.
A passport in Traced is any JSON file the customer uploads. Each version is kept, and each carries a SHA-256 checksum, so a change to the file can be spotted.
Traced does not yet check a passport's fields against the regulation, because the rules for iron, steel and aluminium are still being finalised. We will adopt the iron and steel and aluminium delegated-act schemas as they are published.
If you want to see how this fits your products, the Digital Product Passport page on Traced sets out what the platform stores and how a scan works. The wider platform is at Traced.
Where things stand
No ESPR product delegated act has been adopted yet. The Commission's indicative timetable puts iron and steel in Q4 2026, and aluminium in Q3 to Q4 2027. Indicative means the Commission's planned date, not an adopted act. Until an act for your product group is adopted, its carrier rules are not in force.
The UK has no Digital Product Passport law. The Department for Business and Trade's call for evidence closed on 21 September 2026, and the government "has not yet determined its approach". EU rules apply in Northern Ireland under the Windsor Framework. Products placed on the EU market will need a passport once a delegated act covers their product group.
What to do now
You cannot pick the final location until the act for your product group is published. You can prepare for it. Ask three questions of each product line. How long will the part be in service? Who will need to read the mark, and when? Does the part have room for a durable mark, or will it need one on the packaging or the paperwork?
The answers will hold whichever location the delegated act chooses, and they will tell you early where a redesign would be expensive.
Need a clearer record model?
Discuss a practical Traced or Verified setup for your product and inspection workflow.
Talk to usRelated Articles
The shift towards connected, transparent products
The EU's Digital Product Passport marks a shift from fragmented documentation towards live,...
Read The shift towards connected, transparent productsWhy is the EU introducing Digital Product Passports?
The EU introduced DPPs to close information gaps that hinder circularity and enable comparable data...
Read Why is the EU introducing Digital Product Passports?When does the EU Digital Product Passport become mandatory?
The ESPR has been in force since 18 July 2024, but no passport obligation has started yet. The first...
Read When does the EU Digital Product Passport become mandatory?