Digital Product Passport (DPP)

The Digital Product Passport (DPP) will soon become a mandatory requirement for European companies. It is being introduced under the Ecodesign for Sustainable Products Regulation, which has been in force since 2024. The ESPR is a key component of the European Green Deal and the EU’s circular economy framework.

From this article, you will learn:

• What the DPP is and how trust services support it
• Which products are covered by the DPP
• What the DPP implementation timeline looks like
• How to ensure the reliability and integrity of DPP data
• What the key implications are for businesses
• What role trust services under eIDAS play in the DPP
• What conditions must be met for the DPP to work effectively
• Why companies should start implementing DPP-related solutions early

What Is the DPP and What Role Do Trust Services Play?

The Ecodesign for Sustainable Products Regulation (ESPR) 2024/1781 has been in force since 2024.  One of its core elements is the Digital Product Passport. 

The Digital Product Passport (DPP) collects, stores, and makes available product-related information across the product life cycle. This includes the stages from production, distribution, and use through to recycling or disposal. The DPP covers information such as the composition and origin of raw materials, durability, repairability, environmental footprint, and compliance with regulatory requirements. Manufacturers and suppliers will be required to ensure that this data remains reliable, up to date, consistent, and available over the long term.

The details of the DPP are set out in the Regulation of 29 April 2026: Laying down the implementation arrangements for the digital product passport registry under Regulation (EU) 2024/1781. Data recorded in the DPP will be accessible, for example, via a QR code or NFC, to market surveillance authorities, supply chain participants, and consumers. The purpose of the DPP is to increase market transparency and support sustainable production.

Which Products Are Covered by the DPP?

The obligation to implement the DPP will not apply to all products at once. It will be phased in gradually through 2030. The first wave of implementation is expected to begin in 2027, when sector-specific rules for the first product categories start to apply.

However, the central DPP registry is scheduled to launch in 2026, along with more detailed requirements. Businesses will be given a transition period to adapt.

The central DPP registry will serve as a system for identifying, registering, and verifying product passports and the entities participating in the system. The first practical application of the DPP will be batteries.

Product categories covered by the first wave of regulation include:

• textiles and apparel
• tires
• furniture and mattresses
• intermediate products (e.g., iron, steel, aluminum)
• Electronics and ICT Equipment
• batteries (under separate sector-specific regulations)
• construction products

In later phases, the DPP will be extended to additional product groups and, ultimately, to most physical products placed on the EU market.

What Is the DPP Implementation Timeline?

How Can the Reliability and Integrity of DPP Data Be Ensured? 

For the DPP to fulfill its purpose, product data must be:

• linked to a specific entity
• protected against unauthorized modification
• verifiable over time
• legally recognized across the EU

In practical terms, this means that data must be integral, authentic, traceable, and available throughout the entire product life cycle.

What Are the Key Implications for Businesses?

For companies, the new regulations mean more than just implementing the DPP. To participate in the system, businesses will also need mechanisms for identification and identity verification. The DPP also represents a shift in how companies manage data. In particular, it requires businesses to collect and maintain structured product data across the entire supply chain. This means involving every participant in the product life cycle, from raw material suppliers to distributors and recycling operators.

At the same time, companies will need to keep this data continuously updated. Examples include product repairs or changes in material composition. In practice, this marks a move away from one-off reporting toward dynamic information management. A major challenge will be integrating data from multiple entities and establishing a consistent technological and organizational approach.

Failure to meet DPP requirements may prevent access to the European Union market, as products without a passport will not be allowed to be placed on the market.

What Role Do Trust Services under eIDAS Play in the DPP?

Trust services play a critical role in the operation of the Digital Product Passport (DPP) registry. They provide the foundation for identifying and verifying the entities using the system, as well as for registering and updating DPP data. They ensure both security and legal effect for digital data across the EU. Trust services are governed by the eIDAS Regulation, Regulation (EU) No. 910/2014, as amended by Regulation (EU) 2024/1183 of 11 April 2024.

To verify the identity of DPP registry participants, qualified electronic signatures will be used for natural persons, while qualified electronic seals will be used for legal entities. Qualified trust services will also be used to ensure data integrity and generate evidence of registration.

This evidence will be secured with a qualified electronic seal and a timestamp, giving it evidentiary value. Information assigned to a product cannot be modified without authorization, and its source can be clearly established. This provides non-repudiation.

By using trust services, the data contained in the DPP also gains legal recognition across the European Union. This is essential in the context of cross-border trade in goods and regulatory inspections. The eIDAS Regulation provides uniform rules for the recognition of electronic signatures and electronic seals in all Member States.

Qualified trust services will also support interoperability between systems and Member States. Full DPP interoperability will depend on the technical standards adopted and the architecture of the systems deployed within this ecosystem. In addition, qualified trust services guarantee long-term data availability and evidentiary value. This is important for audits as well as for potential administrative or judicial proceedings.

In the DPP ecosystem, trust services form the foundation for mechanisms that ensure access control, entity traceability, data integrity, and the ability to audit events over time.

Why Are Trust Services Important from a Market Perspective?

According to industry analyses, the DPP will ultimately cover around 1.1 million companies. The digital wallet may apply to as many as 10 to 20 billion products for 450 million citizens and consumers in the European Union market. Manufacturers, importers, distributors, market surveillance authorities, and end users will all need data that is reliable, integral, and traceable.

Using trust services does not require building new tools from scratch. As a result, implementation is faster, more efficient, and less costly. The cost of trust services does not have a significant impact on the total cost of operating the DPP.  It remains relatively low compared with other system components. This will be especially important for small and medium-sized enterprises.

Trust services also ensure regulatory consistency with other digital domains in the European Union. This helps avoid fragmentation and inconsistent interpretations of requirements across EU Member States.

Clear attribution of data and its verification over time protect the market and consumers against false product claims and help combat greenwashing.

What Conditions Must Be Met for the DPP to Work Effectively? 

The Digital Product Passport accelerates the transition toward a more sustainable, data-driven economy. To operate effectively, the DPP requires mechanisms that ensure data reliability and entity identification.

Qualified trust services are a natural solution because they are a regulated and widely used infrastructure across the EU. They protect data while also ensuring legal validity, interoperability, and long-term availability. Without trust services, it is difficult to build a DPP that is functional, scalable, and accepted throughout the European Union.

Key Takeaways

The requirement for data integrity and traceability is systemic, legal, and regulatory.

The data must be durable, linked to an entity, and tamper-resistant. These are precisely the functions delivered by e-signatures, e-seals , and timestamps.

Implementation at Scale Requires Automation

The DPP will apply to millions of products. Mass data authentication mechanisms will be essential.

Entity and Data Operation Verification Based on Trust Services

Trust services will be required to verify entities and data operations. They will not function merely as an optional security layer.

Interoperability and Cross-Border Recognition Are Required by Design

The DPP is based on EU regulations that apply across all Member States. The system must ensure full interoperability and cross-border recognition of legal effects and operations.  This will be enabled by qualified trust services compliant with eIDAS.

2026 Is the Market Preparation Phase

2026 will be the year for building the infrastructure before the first regulations enter into force. It will also be the time to select partners and solutions, and to integrate them with existing systems and business processes.

Companies Should Implement the DPP Early

Early implementation of the DPP and integration of trust services will ensure operational readiness when obligations enter into force for specific product groups. It will also reduce the risks associated with adapting to the requirements at a later stage.