EU Digital Product Passport Regulation, Explained: What Is Law, What Is Still a Plan (October 2026)

In July I wrote about what a Digital Product Passport is and why it is a data problem before it is a technology problem. Since then the topic has stopped being theoretical. The EU’s central DPP registry went live in July 2026, the Commission opened the file on iron and steel, and the Construction Products Regulation has started its own passport track. This article is the next step: not “what is a DPP”, but “what does the regulation actually say, and which parts are already binding”.

I have tried to keep one discipline throughout. For every date I say whether it comes from a regulation already published in the Official Journal, from a Commission plan that is explicitly indicative, or from secondary commentary. In my verification work that distinction is the whole job, and DPP coverage online mixes the three constantly.

One framework, several passports

The phrase “DPP regulation” is slightly misleading, because there is no single regulation. The passport is a tool that several EU laws reach for.

The main one is the Ecodesign for Sustainable Products Regulation, (EU) 2024/1781, in force since 18 July 2024. ESPR is a framework: it describes what a passport is, who must hold one and how access works, but it does not itself oblige any product to carry one. That happens product group by product group, through delegated acts the Commission adopts later. Each delegated act fixes the data fields, the data carrier, the access rights and the application date for that group, and the regulation requires that application date to be at least 18 months after the act’s entry into force.

Alongside ESPR, a handful of sector laws carry their own passport provisions. The Battery Regulation (EU) 2023/1542 is the one with a firm date: a battery passport becomes mandatory on 18 February 2027 for EV, light-transport and industrial batteries above 2 kWh. The new Construction Products Regulation (EU) 2024/3110 has a separate construction-product passport, which I come back to below. The Toy Safety Regulation (EU) 2025/2509 and the packaging regulation also reference a passport, and the Commission’s own DPP page lists detergents in the same group.

So when a supplier or a software vendor tells you “the DPP is mandatory from 2027”, the correct reply is: for which product, under which act?

What has actually happened by October 2026

This is the part worth reading twice, because the gap between “announced” and “adopted” is wide.

The first ESPR Working Plan, adopted on 16 April 2025 as COM(2025) 187, named the priority groups for 2025–2030: steel and aluminium, textiles with a focus on apparel, furniture, tyres and mattresses, plus horizontal measures on repairability and on recycled content and recyclability of electrical equipment. The Commission’s indicative calendar for the product-specific delegated acts is iron and steel in 2026, textiles, tyres and aluminium in 2027, furniture in 2028, mattresses and ICT products in 2029, with energy-related products on their own schedule through 2026–2029. The Commission itself labels these dates indicative and says they may move. As far as I can establish at the time of writing, no product-group delegated act under ESPR has yet been published in the Official Journal.

The infrastructure, however, is real. ESPR required the central DPP registry to be operational by 19 July 2026, and the Commission reports it as live from July. It is worth understanding what the registry is and is not. It is an index: it links each product’s unique identifier to the place where the passport data is stored. It does not hold the product data itself. Registration there becomes a condition for placing a product on the single market once a delegated act applies, and customs authorities will be able to check the registry before releasing imported goods; the Commission expects the customs connection around 2029. In parallel, the Commission adopted an implementing decision on six DPP standards in July 2026, with two more planned for November, and a delegated act on DPP service providers, the companies that will host passports and keep the mandatory backups, is pencilled in for 2027.

For iron and steel, the group most relevant to Turkish exporters, the Commission published a call for evidence on 19 May 2026, open until 12 August 2026. The options under consideration include mandatory disclosure of carbon footprint, recycled content and substances that hinder recycling, performance classes with minimum thresholds based on carbon footprint, and passport obligations for all supply-chain actors, inside and outside the EU. The indicative adoption date is still Q4 2026. Even if that holds, the 18-month rule means the earliest realistic application for steel is 2028.

Who must provide the passport, and how access works

ESPR puts the obligation on whoever places the product on the EU market. For an exporter outside the EU this means the importer, authorised representative or, for online sales, the marketplace is legally responsible, but in practice none of them can build a passport without the manufacturer’s data. If you sell steel, aluminium or textiles into Europe, the request will land on your desk whichever name is on the form.

Access is tiered. Consumers get free, anonymous access to the information the delegated act makes public. Repairers and recyclers can reach technical data such as material composition or disassembly instructions where the act requires it. Economic operators and market surveillance authorities reach the detailed layer through the registry. Personal data is not stored in the passport by default. For a manufacturer the important consequence is that every field will need a classification: public, value chain, authorities only. That decision belongs with the product owner, not with the software.

Construction products: a passport of their own

Construction products deserve a separate section, because they do not follow the ESPR calendar.

The recast Construction Products Regulation (EU) 2024/3110 entered into force on 7 January 2025 and applies from 8 January 2026. It establishes its own construction-product passport system. Under Article 22(7) manufacturers will make a passport available through that system, and Article 75(1) empowers a delegated act that sets up the system and its timing; the passport becomes mandatory 18 months after that act enters into force. The Commission’s DPP timeline shows the construction delegated act as a Q2 2027 item, again indicative. Where the CPR and ESPR overlap, the CPR provisions prevail, which matters for products such as structural steel that could sit in both.

The content is where the EPD world comes in. The construction passport will carry the Declaration of Performance and Conformity, the DoPC, together with instructions and safety information. The DoPC is the successor to the Declaration of Performance, and under Article 15(2) environmental performance is declared using the indicators of EN 15804. The CPR phases those indicators in: the climate change indicator comes first, with the wider indicator set following later in the decade, in two steps that secondary sources place in 2030 and 2032 (check Annex II for your product family before planning around those dates). Crucially, the obligations only bite for a product family once its revised harmonised standard is cited in the Official Journal. For most families that has not happened yet, so a manufacturer who already publishes an EN 15804+A2 EPD is currently ahead of the legal requirement, not behind it.

One nuance that gets lost: under the CPR, the environmental declaration in the DoPC is subject to third-party assessment by a notified body under the new assessment system, which is a different legal route from ISO 14025 EPD verification. The data and the method are the same EN 15804; the person signing off is not necessarily the same.

Where EPD and LCA data fit, and where they do not

The DPP is a container. The environmental fields inside it have to come from somewhere, and for most product groups the Commission’s language, carbon footprint, recycled content, substances of concern, points straight at life-cycle data. An EN 15804+A2 EPD already holds GWP by module, resource use, waste flows and, in the content declaration, the material composition. A manufacturer with a verified EPD has the verified payload; what is missing is the digital wrapper.

But I want to be precise about three things that an EPD does not automatically give you.

First, granularity. An EPD is usually an average for a product or a family, declared per unit. A passport is attached to a product on the market, potentially down to batch or serial level. A steel passport that must carry a carbon footprint per coil cannot be filled by a plant-wide EPD average without a documented allocation step.

Second, method. The carbon footprint the steel delegated act ends up requiring will be defined in that act. It may align with EN 15804, with the Product Environmental Footprint method, or with sector-specific rules; the call for evidence did not fix it. An LCA model built cleanly, with inventory data kept separate from impact assessment, can be re-run under a new method in days. One built around a single result cannot.

Third, lifetime. EPDs are valid for five years. Passports follow the product for its life, and the registry links to a passport that must remain available even if the manufacturer disappears, which is why service providers and backups exist. Version control and expiry flags become compliance features, not housekeeping.

If you are already collecting actual embedded-emissions data for CBAM, you are not starting from zero: the production, energy and precursor data overlap heavily with an LCA inventory. The methods are not identical, though, and I would not present CBAM figures as passport-ready carbon footprints without checking the boundary and the allocation rules of whichever act applies.

What I would do in the next twelve months

Not buy DPP software first. The sequence that makes sense from a verifier’s chair looks like this.

Find your product in the law. Is it an ESPR priority group, a CPR construction product, a battery, or none of these yet? That single answer sets your clock. Steel and aluminium exporters should read the iron and steel call for evidence; construction product manufacturers should watch the harmonised standard for their family.

Build a product data inventory you would be comfortable showing a verifier. Material composition per product, supplier declarations for recycled content and substances of concern, metered energy and yield data, allocation rules written down. This is the same inventory an EPD, a CBAM report and a passport all draw on.

Run the LCA for your priority products as a model, not as a report. Keep the inventory, the background datasets and the impact method as separate layers, so a change in method or a new product variant is a re-run, not a new project. Publish and verify as an EPD where it helps commercially.

Decide ownership. One named person for product identity, one for environmental data, one for supplier attestations. Passports expose inconsistency between departments faster than any audit does.

Then, and only then, look at data carriers, service providers and the software that will serialise the data. That layer will be shaped by the delegated acts anyway, and by the standards still being finalised this year.

Frequently asked questions

Is the Digital Product Passport mandatory today?

Only for batteries, from 18 February 2027, under the Battery Regulation. Under ESPR no product group is yet obliged to carry a passport; that requires a product-specific delegated act, and the first of those, for iron and steel, is still at the drafting stage as of October 2026. Construction products will get their own passport under the CPR, 18 months after the relevant delegated act.

Does a DPP replace an EPD?

No. The passport is the container; the EPD is one source of verified environmental data that can feed it. For construction products, the CPR explicitly uses EN 15804 indicators for the environmental declaration. What may change is who signs off: under the CPR, the DoPC route uses notified bodies rather than ISO 14025 verifiers.

Does the DPP apply to manufacturers outside the EU?

Yes, to the product. Whoever places it on the EU market is responsible for the passport existing, but the data has to come from the manufacturer. Once customs is connected to the registry, expected around 2029, imported products without an active passport will not be released into free circulation.

We export steel to the EU and already report under CBAM. Are we DPP-ready?

Partly. The production and energy data overlap with what a passport’s carbon footprint field will need, but the calculation method for the passport will be fixed by the iron and steel delegated act and may differ from CBAM’s embedded-emissions rules. Keep the underlying data, not just the CBAM result.

---

Sources used for this article: Regulation (EU) 2024/1781 (ESPR); Commission Working Plan COM(2025) 187 of 16 April 2025; the European Commission’s Digital Product Passport pages and FAQ, including the iron and steel page; the Commission call for evidence on ecodesign requirements for iron and steel products (19 May–12 August 2026); Regulation (EU) 2024/3110 (CPR) and the Construction Products Europe manufacturers’ guide; Regulation (EU) 2023/1542 (batteries). Indicative dates are the Commission’s own and may change; phasing dates for CPR environmental indicators beyond the first step are taken from secondary summaries and should be checked against Annex II of the CPR for your product family.

At EPDlogy we prepare LCA models and EPD files for manufacturers, and we verify EPDs for other companies as an independent verifier. We do not verify studies we have prepared ourselves. If you would like to work out where your products sit in this timeline, get in touch.