What a passport service provider does, and do you need one

A [digital product passport service provider](/glossary/#digital-product-passport-service-provider) holds your passport and serves it to each reader, because the European Commission holds no passport data. You do not have to use one, because the law also lets you store the passport yourself.

European Union law names the provider role, which no vendor invented.

A battery passport must stay available after the responsible company stops trading. Your web server stops when your company stops, so a passport on your own website fails that test.

The law names the role, and it keeps the passport out of the EU registry

The Ecodesign for Sustainable Products Regulation (ESPR) is Regulation (EU) 2024/1781. It has been in force since 18 July 2024.

Warning: ESPR creates no passport duty for a product until the Commission adopts a delegated act for that product group. As at 14 August 2026 it has adopted none. Read what a delegated act is.

ESPR Article 10(c) requires the passport to be "stored by the economic operator responsible for its creation or by digital product passport service providers". Recital 41 requires "a decentralised data system".

So the European Commission does not hold your passport data. The Commission runs a registry, and Article 13(1) required that registry to store at least the unique identifiers. The passport itself sits with the operator, or with the provider that the operator pays. See the EU registry and how a passport works.

Self hosting is legal, and a battery passport must outlast your company

Article 10(c) gives two options and prefers neither. A company that runs its own passport service meets the law, if that service meets every requirement.

One requirement is the hard one. The battery regulation, Regulation (EU) 2023/1542, states it in Article 78(e):

the battery passport shall remain available after the economic operator responsible for the fulfilment of the obligations under Article 77(4) or (7) ceases to exist or ceases its activity in the Union

That regulation is in force. Its passport duty applies from 18 February 2027, and it covers three categories:

• each light means of transport (LMT) battery, such as an e-bike battery
• each industrial battery with a capacity greater than 2 kilowatt hours
• each electric vehicle battery

Article 78 governs the battery passport only. See batteries for the scope.

ESPR carries the same idea for its own passports. Article 10(e) names the case of insolvency. Article 10(4) requires a back-up copy through a passport service provider, and Annex III requires the passport to carry that provider's reference. Both duties wait on a delegated act. See what happens if the company closes.

That requirement is the reason to pay a provider. A provider is a separate legal person, and it can serve the passport after the operator stops.

A provider may not sell your data

Article 78(d) of the battery regulation bars an authorised third-party host from the resale of the data and from its re-use.

That limit is written for the battery passport. Write the same limit into your own contract for any other product. A passport can hold commercially sensitive data, and a battery passport holds the composition data. See who can see what.

You may authorise somebody to register for you, and you keep the duty

Commission Implementing Regulation (EU) 2026/1778 runs the registry. It has been in force since 6 August 2026. Article 19(4) covers the case where you pay somebody to register a passport for you.

Warning: none of this reaches you yet. Article 8(1) of the same act ties an ecodesign registration to a delegated act. This site searched the Official Journal and the Commission product group pages, and no adopted act came back.

Two rules apply together. The third party must pass the registry verification itself. The operator keeps the duty. Article 19(4) reads:

The verified economic operator shall remain fully responsible for compliance with the obligations set out in this Regulation.

So a contract moves the work, but not the responsibility. See data accuracy and who carries the liability.

The same act allows one transfer that does move the duty, and a supply contract is not that transfer. Article 6a lets a registered passport pass to another verified operator. That operator takes over the obligations from the date the transfer names.

Recital 10 gives the two cases for that transfer. The first is an actor that fails its verification. The second is an organisational change, such as a merger, a split, a sale or a cessation.

Nobody can tell you yet what a provider must do

A delegated act on passport service providers is planned. No such act is adopted, so no EU rule yet states what a provider must do, or if any body must approve it.

Four readings are in circulation, and each one gives a different date.

This site gives no date, because the sources disagree. The Commission web page also disagrees with itself. It names the act in two timeline items, and it gives a different quarter in each one. No date above belongs to an adopted act.

That gap has a practical consequence. Do not accept a claim that a service is approved in Europe, where no rule for a provider exists yet.

Three questions to ask a provider this year

1. Which requirement do you meet, and in which instrument?
2. What happens to the passport if we stop paying, or if we close?
3. How do I get my data out, in what format, and how long does it take?

Question one separates a checkable answer from a sales claim. An answer such as "Article 78(e) of Regulation (EU) 2023/1542" can be read and checked. An answer such as "full passport compliance" cannot.

Question three is the one people forget. Ask for an export of every field, in a format a machine can read, on request.

You can also ask which European standards the service is built to. Six standards are cited for the passport.

There is no EN 18217 and no EN 18218, so never accept the set written as a range. Each text costs money to read, so this site does not state what any one of them requires. See the six standards.

Warning: those standards stay voluntary. Implementing Decision (EU) 2026/1736 cites them, and it has been in force since 15 July 2026. Citation gives a product built to a cited standard a presumption of conformity, under ESPR Article 41(2). That presumption covers the requirements in Articles 10 and 11.

OwlQR, a New Zealand company that publishes this site, builds this type of service. This site names no preferred provider and recommends none. Put the three questions above to any provider before you sign.

Your EU importer usually chooses the provider and pays for it

If your company has no office in the Union, you are usually not the operator that carries the duty. Your EU importer is. So the importer usually picks the provider and pays for it. See who is the economic operator.

That does not remove your work. A provider can only publish the data that you send it. Agree in writing who supplies each item, who approves it, and who updates it. See agreeing data duties.

If you sell food or drink, you need no provider for that product. Those products sit outside ESPR scope. Read food and feed are excluded and what this means for New Zealand exporters.

The articles this page uses, and their status

Do not buy a provider service for a product that no rule covers yet

1. Find out which company places your product on the EU market.
2. Ask that company if it uses a provider, and which one.
3. Put the three questions above to that provider in writing.
4. Agree what happens to your data if you change provider.
5. Do not buy a provider service for a product that no rule covers yet.

Point five costs the most money when people get it wrong. Read how to read the timeline before you sign for a service.

Some of this software is open source, and a European project lists 46 such projects without checking any of them. See the OpenDPP catalogue.