Foundations
Why your website cannot be the digital product passport
A well built web page fails five rules in EU law. This page names each rule, and the article of the law that sets it.
Your website cannot be the digital product passport. A passport must answer a machine, split its data three ways, outlive the company, take its identifier from an ISO series, and be registered. A web page does none of those five things.
Here is what that costs you. You can print a QR code on the label of a merino jumper, and point the code at your website. You may believe the work is done. Your European customer then asks for the machine answer, and you pay for the work a second time.
A passport is structured data about one product, with access rules attached. See what a digital product passport is and what is not a passport.
No EU law requires a passport for your product today
Two EU laws matter here. Neither one requires a passport for your product today. The battery regulation binds first, from 18 February 2027.
| Law | Status | Passport duty |
|---|---|---|
| Ecodesign for Sustainable Products Regulation (ESPR), Regulation (EU) 2024/1781 | In force since 18 July 2024 | None yet for any product group |
| Battery regulation, Regulation (EU) 2023/1542 | In force | Starts 18 February 2027 for three categories of battery |
ESPR creates no passport duty for a product group until the European Commission adopts a delegated act for that group. The Commission has adopted none, as at 14 August 2026.
The battery duty covers three categories of battery:
- each light means of transport (LMT) battery, such as an e-bike battery
- each industrial battery with a capacity greater than 2 kilowatt hours
- each electric vehicle battery
The battery passport is the only passport model written in law that you can read today. Most of the rules below come from it.
A passport answers a machine, and a page answers a person
A product page answers a person. The facts sit inside a layout, and a computer cannot pull one field out of that layout reliably. A customs system cannot read the fibre content of a jumper off your web design.
A passport holds structured data. A buyer's purchasing system, a market surveillance authority and a recycler's system read the same fields from it, without a person to interpret them. See what structured data is.
The battery regulation states this as full interoperability, in Article 78(a). Your page can stay the answer that a person reads. See how a passport works and content negotiation.
The battery law splits the data three ways, and a page has one answer
A public page shows the same content to every visitor.
Article 77(2) of the battery regulation names three groups of readers:
- the general public
- notified bodies, market surveillance authorities and the Commission
- any person with a legitimate interest
Warning: the three groups are not nested. The second group and the third group share one set of data. Each group then reads data that the other group cannot reach.
An e-bike battery is an example. A person who scans the pack reads the public data. The detailed composition, which includes the cathode and the electrolyte materials, sits in the restricted part under Annex XIII point 2. A page that publishes everything gives that composition to every visitor, and you cannot take it back.
No delegated act exists, so ESPR sets no access tiers for any product group today. See who can see what.
The passport must outlive the company, and a website closes with it
A website stops when somebody stops paying for it. European law forbids that outcome for a battery passport.
Article 78(e) of the battery regulation, verbatim:
the battery passport shall remain available after the economic operator responsible for the fulfilment of the obligations under Article 77(4) or (7) ceases to exist or ceases its activity in the Union
The duty continues after the company that held it stops trading. A lapsed domain name, an unpaid hosting bill or a liquidation each end a website, but none of them ends this duty.
For an ESPR passport, Article 10(e) of ESPR covers the insolvency of the operator. See what happens if the company closes.
The identifier comes from an ISO standard series, and your domain is not in it
ESPR sets the rule for the data carrier and the unique product identifier in Annex III. It points at an ISO standard series. A web address on your own domain is not part of that series.
| Point | What ESPR says |
|---|---|
| Annex III | The data carrier and the unique product identifier comply with the ISO/IEC 15459 series, parts 1 to 6, where relevant for the products concerned |
| Annex III(c) | It names the Global Trade Item Number (GTIN) under ISO/IEC 15459-6 |
| Article 10(1)(c) | Those standards apply, or equivalent European or international standards, until the Commission publishes the references of harmonised standards |
ESPR names no vendor scheme at all. A search of the full regulation returns no hit for GS1, for Digital Link, for IEC 61406 or for the digital object identifier (DOI). Some suppliers state the opposite, and the text of the regulation refutes them.
There is a second problem with a page address. It usually names a model. Article 77(3) of the battery regulation requires a unique identifier for each battery. Two identical e-bike batteries would share one product page. See product identifiers.
The operator registers the product, and a page cannot be registered
ESPR Article 13(1) required the Commission to set up a digital registry that stores at least the unique identifiers. That registry is operational.
| Date | What it is |
|---|---|
| 19 July 2026 | The statutory deadline in Article 13(1) |
| 20 July 2026 | The launch, with a testing environment |
A database is not a legal act, so do not read "operational" as "in force".
Article 13(4) requires the economic operator that places the product on the market to upload the registry data. Article 13(5) states that the registry's communication "shall not be deemed to be proof of compliance with this Regulation or other Union law". A registration identifier is not a compliance certificate.
No operator must upload anything yet, because no delegated act applies yet. See the EU registry.
The law does permit you to host the passport yourself
ESPR decentralises the data.
ESPR Article 10(c) requires the economic operator responsible for the passport's creation, or a digital product passport service provider, to store the data. Recital 41 of ESPR requires a decentralised data system.
So the law permits you to store the data in your own systems. The Commission does not hold your product data. The registry holds identifiers, and the passport stays with the operator or with a service provider.
The survival duty is the hardest part to meet yourself
Article 78(e) requires a battery passport to stay available after the responsible operator ceases to exist. If you host that passport yourself and your company stops trading, nothing keeps it available. See what a service provider does.
Keep the product page, and build the data behind it
Your website is still useful. It sells the product, and it can be the page a person reads after a scan.
Three steps cost only time. They keep their value whatever rule reaches your product group.
- Find out where you store each product fact. Name the owner of each fact.
- Tag each field with the reader who may see it.
- Ask your EU importer who answers a data request. Write the answer into the supply contract.
You usually have no establishment in the European Union. The operator that places the product on the EU market carries the passport duty, and that operator is usually your importer. Your data still has to be structured and current, whoever holds the passport. See what a non-EU exporter must supply.
If you sell wine, or any other food or drink, ESPR does not reach your product at all. See food and feed are excluded.