If you supply a component, the request reaches you by contract

No European Union (EU) law puts a digital product passport duty on a company that supplies a component or a material. Instead, your customer writes a data duty into the contract before any rule applies.

The duty falls on the operator that places the finished product on the EU market. That operator is your customer, or your customer's importer.

If you ignore this, your customer writes the data promise for you. The customer then sets the timetable and the price.

No law names you, because you do not place the product on the EU market

The Ecodesign for Sustainable Products Regulation (ESPR) is the EU law that creates the passport. It came into force on 18 July 2024. Article 9 makes a passport a condition of market access, but only for a product group that a separate rule covers. That separate rule is a delegated act. As at 14 August 2026 the European Commission has adopted none, for any group. See which products need a passport, and when.

One passport duty already exists in law. It comes from the battery regulation, Regulation (EU) 2023/1542. It applies from 18 February 2027, and it names three battery categories only.

A light means of transport battery is the battery in an e-bike or an e-scooter. Every other battery, including a portable battery, stays outside the passport duty.

The duty sits with the operator that places the battery on the EU market. An importer is a person established in the Union who places a battery from a third country on the market. New Zealand sits outside the Union.

Both laws name the same party, which is not your company. See who is the economic operator.

Your customer's duty becomes your purchase condition

Your customer must keep the passport data accurate, complete and up to date. Your customer can only state what you give them. So your customer turns a legal duty into a purchase condition. That condition then binds you.

The request arrives before any rule applies, because the customer wants the data before the first shipment. Six examples follow the same pattern:

• wool tops sold to a European spinner
• a leather hide sold to a European tannery
• an aluminium extrusion sold to a window maker
• a steel fastening sold to a machine builder
• a natural extract sold to a cosmetics maker
• an electronic sub-assembly sold to an appliance maker

In each case the finished product carries the passport, if a rule covers that product. Your customer then asks you about that material, because you hold the answer.

Steel and aluminium are planned product groups themselves

Two planned product groups are materials. Iron and steel is the first ESPR product group in the Commission plan. Aluminium is another planned group.

Warning: the middle column below gives a plan. It is not a deadline. No delegated act is adopted for either group.

The right hand column adds the scrutiny period and the transition period of at least 18 months. How to read the timeline sets out each step. The sector pages are iron and steel and aluminium.

Warning: the transition period of 18 months is the usual minimum. Article 4(4) permits an earlier date in a duly justified case, for a full act or for some of its requirements.

Even for those groups, the duty stays with the operator that places the material on the EU market. The data question still comes to you.

Your data goes into the package the manufacturer draws up

The battery rules give the clearest worked example, because they carry the first firm date. Article 41(2) tells an EU importer what to verify before it places a battery on the market.

You do not draw up that package. The manufacturer does, and the manufacturer builds it from supplier evidence. Your data goes into that package. What a non-EU exporter must supply covers the package itself.

The battery passport also carries responsible sourcing information, taken from the due diligence report under Annex XIII point 1(d). The manufacturer must operate a due diligence policy for cobalt, natural graphite, lithium and nickel. Those duties apply from 18 August 2027. If you sell any of those materials, expect that question first. See batteries.

Your company can appear inside somebody else's passport

The ESPR passport identifies more parties than the seller. Annex III requires the unique operator identifier of the manufacturer, and unique operator identifiers of other actors in the chain. It also requires unique facility identifiers for the relevant locations.

If an actor has no identifier, the operator that creates the passport must ask for one. So a customer's passport can name your company, your site and an identifier for each. Ask which scheme your customer uses before you agree to anything. See operator identifiers and facility identifiers.

Do not promise data you cannot produce or keep current

Article 77(4) of the battery regulation sets the standard your customer must meet:

The economic operator placing the battery on the market shall ensure that the information in the battery passport is accurate, complete and up to date.

A customer under that duty will ask you for the same promise. One spreadsheet is a single job. A promise to keep every field current is a standing duty with no end date.

Test three things before you sign.

1. Name the fields you hold today, and the fields you do not hold.
2. Check the level. A rule can set the passport at model, batch or item level.
3. Check the term. A passport must stay available for at least the expected lifetime of the product.

Batch level and item level need more work than model level. The battery regulation sets one passport for each battery, and not one for each model.

The battery passport does not show every field to everybody. It sets three access tiers, and each tier covers a different part of your data. Agree which tier your data goes into before you send it. See access tiers and commercially sensitive data.

Give every data item an owner, a time limit and a price

Write these points into the contract, not into an email.

• Name who supplies each data item, field by field.
• Name who approves each item before it goes into the passport.
• Name who updates an item when the specification or the certificate changes.
• Set a time limit for that work, in days.
• Set a price for the work, and for each later change.
• Set the access tier for each item, and say which ones are confidential.
• Set an end date, and say what happens when the rule changes.

Agreeing data duties with your EU importer covers the same ground for a company that sells a finished product.

The due diligence route sends the same request down the same chain

A second route sends the same type of request. The Ministry of Foreign Affairs and Trade described it in a report of October 2024 on corporate sustainability due diligence. The report says EU customers inside those rules may ask New Zealand partners for sustainability information.

That request comes down the same chain, to the same person in your company, for much the same data. Treat both as one job. Give the data one owner and one process. See what New Zealand agencies have said.

No adopted rule means no deadline, so put the data duties in writing

1. Ask your customer which finished product carries the passport.
2. Ask the customer to name the rule, and to say if it is adopted.
3. If they cannot name an adopted rule, no deadline binds either of you yet.
4. List the fields you can produce today, and the ones you cannot.
5. Agree in writing who updates the data, before the next purchase order.

Do the last two points this year. Neither one needs a passport system. See what this means for New Zealand exporters.