How a digital product passport works

A digital product passport works in seven steps. A scanner reads the data carrier, a resolver works out which passport the identifier means, and the company supplies the data. That company is the operator that places the product on the European market.

The data does not come from the European Commission. European law requires the opposite arrangement, and this page names the rule at each step.

Here is why it matters to you. If you buy a QR code that opens a marketing page, you have not bought a passport. A passport must also answer a machine, and a European customer's compliance team will test that.

The general passport rule comes from the Ecodesign for Sustainable Products Regulation (ESPR), Regulation (EU) 2024/1781. It has been in force since 18 July 2024. It creates no passport duty for a product until the Commission adopts a delegated act for that product group. As at August 2026 it has adopted none.

One other law already creates a passport duty. Regulation (EU) 2023/1542, the battery regulation, is in force. Its passport duty starts on 18 February 2027.

The seven steps, in order

"No verified rule" means this site holds no confirmed source for that step. Implementing Decision (EU) 2026/1736 cites six European standards for the passport. The table below names each one.

Each text costs money to read, so this site does not state what they require. See the six standards and why the texts are paywalled.

Step 1. The identifier names one product

An identifier is a number or a web address that means one product and nothing else.

ESPR Annex III requires the data carrier and the unique product identifier to comply with the ISO/IEC 15459 series, where relevant for the products concerned. The annex names all six parts of that series. It also names the Global Trade Item Number (GTIN) under part 6, which is the number that sits under a retail barcode.

Article 10(1)(c) makes this an interim rule. It allows those standards, or equivalent European or international standards, until the Commission publishes the references of harmonised standards.

Some suppliers say that ESPR requires a GS1 Digital Link web address. ESPR does not name GS1 Digital Link. A search of the full regulation returns no hit for GS1, for Digital Link, or for the QR code standard ISO/IEC 18004. GS1 Digital Link writes the GTIN into a web address, so the code on the product is the address a scanner calls.

A supplier may also give you a count of the identifier schemes that European law permits. That count is unverified, because EN 18219 is sold and nobody here has read it. Which identifier schemes are permitted sets out what is verified and what is not.

An identifier can name a model, a batch or one single item. A battery passport names one single item, because the battery regulation requires a unique identifier for each battery.

A passport also carries numbers that do not name the product. An operator identifier names a company, such as the manufacturer or the importer. A facility identifier names a place, such as a mill or a packing shed. No law requires a facility identifier from a New Zealand exporter today.

No adopted European act tells you which operator identifier to hold. Your New Zealand Business Number names your company to New Zealand agencies. No verified source names that number as a European scheme, and no verified source rules it out. Why a New Zealand Business Number is not enough states both sides of the gap.

So ask your EU importer which operator identifier it holds for you, and record the answer. Buy no new identifier until that importer names the scheme it needs.

See product identifiers, what a GTIN is and GS1 Digital Link.

Step 2. The data carrier holds the identifier, not the data

The data carrier is the part you can touch: a QR code, a Data Matrix code or a radio tag.

A QR code on the label of an e-bike battery holds a short address. It does not hold the chemistry, the carbon footprint or the recycled content, which sit at the other end of the address.

Warning: a QR code by itself is not a passport. The battery regulation shows the difference. Article 13(6) gives every battery a QR code that leads to other information. Only three categories of battery get a passport, from 18 February 2027:

• each light means of transport (LMT) battery, such as an e-bike battery
• each industrial battery with a capacity greater than 2 kilowatt hours
• each electric vehicle battery

See data carriers and batteries.

Step 3. The request states which answer it wants

A person and a machine call the same address. The request carries a field named Accept, and that field states the format the caller wants.

A phone browser asks for a page. A customs system can ask for structured data.

Commentary says that a passport must open without a dedicated app. This site found no primary text that states that rule. Two European laws do require free-of-charge access to a passport. Free access is in the law, the no-app rule is not separates the two claims.

Step 4. The resolver turns the identifier into a passport

A resolver is the service that receives the request. It works out which passport the identifier means, and it sends the caller to that passport.

The resolver also reads the extra parts of the address. A scan of one carton of wine can carry a product number, a batch number and a serial number together. The resolver decides which record answers that combination.

See what a resolver is.

Step 5. The access check decides what the caller sees

No caller sees every field. The service checks who asks before it answers.

The battery passport is the only access rule verified in law today. Article 77(2) of the battery regulation names three groups:

• the general public
• notified bodies, market surveillance authorities and the Commission
• any person with a legitimate interest

Warning: these three groups are not ranked. The second group and the third group overlap, and neither one contains the first.

An implementing act must say who counts as a person with a legitimate interest. Article 77(9) sets a deadline of 18 August 2026 for that act. This site searched for it on 15 August 2026 and found none. See what is public in a passport, and what is not.

For ESPR the fields and the access rules come from each product group's delegated act. No delegated act exists yet, so no ESPR access rule exists yet.

See access tiers.

Step 6. One address gives two answers

A person gets a page they can read. It shows the fibre content of a merino jumper, the care instructions and the certificates, in words.

A machine gets the same facts as structured data. A customs system or a market surveillance authority can read that second answer. A page written for a person does not give them structured data. A PDF file does not give it either.

No European text that this site has read names a data format for that second answer. Structured data describes the shape, and it names the formats that people use.

A format by itself does not make two passports comparable. Two systems must also mean the same thing by the same word, and that agreement is a semantic data model. A supplier may say that its system uses the Asset Administration Shell. That is a way to describe an asset as data, and no verified European instrument requires it for a passport.

A reader may also ask if the data is genuine. Article 78(g) of the battery regulation requires data authentication, and it names no method. No verified European instrument requires a verifiable credential or a blockchain.

ESPR Article 15 requires the registration identifier to be given to customs. That article applies only once the registry is operational, and only to products that a delegated act covers.

See content negotiation and market surveillance and customs.

Step 7. The data stays with the company, not with the EU

ESPR Article 10(c) requires the economic operator responsible for the passport's creation to store the passport. Digital product passport service providers may store it instead. Recital 41 requires a decentralised data system. The law does not put your product data in a European database.

So the passport for a merino jumper would sit with the operator that places it on the European market. It can also sit with a service provider that the operator pays.

OwlQR, a New Zealand company that publishes this site, builds passport hosting and resolver software. Ask any provider which of the six cited standards it implements, by number.

See what a non-EU exporter must supply.

The registry holds identifiers, not the passport

The Commission runs a central registry. Article 13(1) required it to store at least the unique identifiers. The passport itself stays with the operator, under Article 10(c).

The registry is operational. Two dates appear in published material, and both are correct.

Article 13(4) requires the operator to upload the registry data. The registry returns a unique registration identifier. Article 13(5) states that the registry's communication is not proof of compliance with the regulation, so a registration is not a certificate.

No operator must upload anything yet, because no delegated act applies yet.

Article 14 requires a public web portal. It lets people search and compare passport data. See the EU registry.

You will probably not host the passport, but you supply the data

You will probably not host the passport. The operator that places the product on the European market holds that duty, and that is usually your importer.

Your data still has to be structured and current. An email attachment fails step 6, whoever hosts the passport.

No passport duty binds a product today. The first one starts on 18 February 2027, and it covers three categories of battery. Read how to read the timeline before you accept any date a supplier gives you.