The Digital Product Passport Is Coming. Almost None of It Is Law Yet.
Search for the Digital Product Passport and you will find a great deal of material announcing that it is here, that deadlines are imminent, and that your business is probably unprepared. Most of it is published by companies selling compliance software.
The legal position is less dramatic and considerably more interesting. The DPP is real, it is coming, and it would change how material claims are made. But as of now, for almost every product category, it is not yet law — and the question that determines whether it works at all is still open.
What it is meant to do
A Digital Product Passport is a machine-readable record attached to a physical product, reachable through a data carrier such as a QR code. The European Commission describes it as a digital identity card for products.
The intended contents vary by product, but the recurring items are the ones industry has historically not disclosed: material composition, recycled content, repairability, spare-part availability, and supply chain information.
That matters because it attacks a specific structural problem. Circular decisions — whether to repair, how to recycle, what a product is actually made of — are made by people who do not have the information the manufacturer holds. A recycler receiving a product usually cannot tell what is in it. The passport is an attempt to move that information downstream with the object.
What the law actually says
The framework is the Ecodesign for Sustainable Products Regulation, Regulation (EU) 2024/1781, in force since 18 July 2024.
Here is the part that most coverage skips: the ESPR is enabling legislation. It creates the power to require passports. It does not itself require one for any product. The actual obligations — which products, which data fields, what verification — arrive through delegated acts, adopted one product group at a time.
And the regulation builds in a delay. A delegated act must generally wait at least 18 months after entering into force before it applies, giving industry time to prepare.
So the sequence is: working plan, then delegated act per product group, then an 18-month-plus runway, then obligation. Each product category is years from the framework date before anything binds.
Where the queue actually stands
The Commission’s first ESPR working plan, adopted in April 2025, set the priority order. The indicative schedule runs roughly:
- Iron and steel — first in line, indicatively 2026
- Textiles, tyres, aluminium — 2027
- Furniture — 2028
- Mattresses — 2029
Apply the 18-month rule and the earliest real compliance dates land around 2028 for steel, with textiles following into 2029.
More to the point: at the time of writing, no product-specific ESPR delegated act appears to have been adopted. The framework is two years old and the queue has not started moving in earnest. Anyone describing a 2026 or 2027 DPP deadline for textiles or furniture is extrapolating, not quoting law.
A note on sourcing, because it matters here: the Commission’s own pages are sparse on dates, and most of the detailed timelines circulating online come from compliance vendors and consultancies who extrapolate from the working plan and the 18-month rule. Those extrapolations are reasonable. They are not official, and they are produced by firms with an interest in urgency.
The exception: batteries
One category does have a fixed statutory date, and it comes from a different law entirely.
The battery passport under Regulation (EU) 2023/1542 applies from 18 February 2027 to electric vehicle batteries, light means-of-transport batteries, and industrial batteries above 2 kWh.
This makes batteries the real pilot. It is the first passport with a hard deadline, on a product with a complex global supply chain, significant critical-mineral content, and a genuine second-life and recycling economy. Whether it produces trustworthy data will tell us far more about the DPP concept than any number of working-plan timelines.
If you are tracking one date in this area, it is that one.
The unanswered question: who checks?
A passport is only as good as the data in it, which makes verification the whole ballgame. It is also the part that has not been settled.
The regulation’s intent is that passport data be substantiated rather than simply self-declared. But the mechanisms — third-party certification, test-lab reports, audited chain-of-custody — are left to the same delegated acts that have not yet arrived. The system for checking supply-chain data and catching false claims is, by most accounts, still being designed.
This produces a structural tension worth stating plainly. Manufacturers will be legally answerable for information originating with suppliers they have limited ability to inspect. Reliable primary data on recycled content and upstream emissions is genuinely hard to obtain across a fragmented supply chain. A rule that demands accuracy without providing a workable means of establishing it pushes firms toward whatever number is defensible on paper.
We have seen where that leads. Chemical recycling already runs on mass-balance accounting, where “recycled content” is an allocation rather than a measurement. A passport that faithfully records an allocated figure has not made anything more transparent. It has given a contested number an official container.
Mandated disclosure only beats voluntary disclosure if someone is checking.
Confidentiality cuts against it
There is a real tension the framework has to resolve, and it is not merely industry foot-dragging.
The most useful passport fields — exact material composition, supplier identity, process details — are precisely the ones firms treat as commercially sensitive. Academic work on DPP implementation identifies intellectual property and business confidentiality as major open challenges, with composition and supply-chain detail the specific sticking points.
The usual proposed resolution is role-based access: a recycler sees material composition, a repairer sees parts and disassembly, a consumer sees a summary, a regulator sees everything. That is sensible in principle and complicated in practice, and it means the passport a shopper scans may be considerably less informative than the phrase “product passport” suggests.
The burden argument
Smaller manufacturers argue the cost of compliance falls disproportionately on them, and there is a legitimate point underneath it. Passport infrastructure has fixed costs that large firms amortise across huge volumes. Peer-reviewed work on DPP design explicitly flags avoiding disproportionate SME burden as a design requirement.
Treat the louder statistics with care, though. Survey figures on SME unreadiness circulate widely and are frequently traced back to vendor marketing rather than to the original survey. The structural concern is real; the numbers attached to it often are not independently verifiable.
The counterargument deserves a hearing too: much of the required information already exists inside companies, scattered across spreadsheets and supplier emails. For some firms the exercise is less about generating new data than discovering what they never actually knew about their own supply chain.
Why this is a global rule
The ESPR applies to products placed on the EU market, regardless of where they are made. A textile manufacturer in Bangladesh, a steelmaker in India, an electronics assembler in Vietnam selling into Europe will face the same documentation requirements as a firm in Germany — without the EU funding programmes and advisory infrastructure available domestically.
This is the Brussels Effect in its usual form: a regional rule becoming a global standard because the market is too large to forgo and maintaining two production systems is uneconomic. It is also why the SME burden question is not primarily a European one. The firms least equipped to build passport infrastructure are largely outside the jurisdiction writing the rules, and outside the conversation shaping them.
What to watch
Three things, in order of how much they will actually tell you:
- 18 February 2027 — the battery passport takes effect. The first real-world test of whether mandated product data is trustworthy.
- The iron and steel delegated act — the first ESPR passport rule. Its verification provisions will set the template for everything after it.
- Whether verification gets teeth. If delegated acts require independent audit, the DPP could become the most consequential transparency instrument in materials policy. If they accept self-declaration, it becomes an expensive way to publish marketing claims in a standard format.
Between those two outcomes lies most of the difference between a circular economy policy that works and one that merely reports.
Sources: European Commission, Ecodesign for Sustainable Products Regulation; Regulation (EU) 2024/1781; Regulation (EU) 2023/1542 on batteries; Federation of American Scientists, Digital Product Passports.