CIRPASS-2 listed 46 open-source passport tools, and vetted none of them

A supplier may tell you it uses a tool from the OpenDPP catalogue. That tells you the tool is on a list, and it tells you nothing about compliance.

CIRPASS-2 published the catalogue on 26 August 2026. It holds 46 open-source projects, and the consortium says plainly that it did not check any of them against a standard or against a rule.

Here is what that costs you if you miss it. You buy a system because it appears on a European list. No adopted act requires a passport for your product in the first place.

The disclaimer is the most useful sentence on the page

CIRPASS-2 states:

Disclaimer: The CIRPASS-2 consortium is not responsible for ensuring that the proposed projects are compliant with any DPP system standards or any jurisdiction's specific DPP regulatory requirements.

Read that twice before you read anything else about the catalogue. It says the publisher makes no claim about standards, and no claim about the law of any country.

CIRPASS-2 is a project funded by the European Union, so the catalogue carries a European look. The disclaimer is the part that tells you what the look is worth.

Anybody can add an entry, and nine entries are marked inactive

The catalogue takes submissions. CIRPASS-2 invites developers and technology providers to send in their own projects.

So the list is a community directory. It is not a register, it is not an approval, and a place on it is not a test that a project passed.

One project appears twice under the same name. Read the list as a working document that grows and decays, and check the repository date yourself.

The catalogue holds parts, and a passport is not one of them

Most entries are building blocks rather than passports. The categories include wallets, identity resolvers, ontologies, message brokers, storage and verifiable credential libraries.

A few describe a full passport platform. Most describe one layer that a developer would assemble with others.

That matters for reading a vendor claim. "Built on an open-source component from the catalogue" describes a dependency, and it describes no capability that a rule asks for.

Each entry gives you four checkable things

An entry shows the technology stack, the software licence, a link to the source code and a link to the documentation, where documentation exists.

Those four are the value of the catalogue. You can open the repository, read the licence, and see when somebody last touched the code.

Warning: check the last commit date before you depend on a project.

Nine entries already carry an inactive mark, and an open licence gives you no maintainer. A project on the list can stop being maintained the day after you build on it.

No adopted act asks you to use any of this

The Ecodesign for Sustainable Products Regulation (ESPR) creates a passport duty for no product group on its own. A duty starts when the European Commission adopts a delegated act for that group, and it has adopted none. See which products need a passport, and when.

So a New Zealand exporter reading the catalogue today is reading a toolbox for a job that no rule has ordered. The exception is a battery, and that duty starts on 18 February 2027 under a different law. See batteries.

If you export food, drink or feed, the ecodesign regulation cannot reach your product at all. See food and feed are excluded.

What to do with the catalogue

1. Read it if you or your European importer builds a passport system.
2. Take the licence and the repository from it, and take no compliance claim.
3. Ask a supplier which entry it uses, and open that repository yourself.
4. Check the last commit date, and check who maintains it.

The catalogue is at cirpass2.eu, and the announcement of 26 August 2026 is on the same site.

A tool is not a duty, and a directory is not an approval. See what a passport is not and digital product passport service providers.