TL;DR
- Regulation (EU) 2024/1781, the Ecodesign for Sustainable Products Regulation, creates the Digital Product Passport but does not by itself require your product to carry one.
- The obligation arrives product group by product group through delegated acts, so your real deadline is the one set in the act covering your products, not any date in the Regulation itself.
- Batteries are the exception today, under Regulation (EU) 2023/1542, with the battery passport required from 18 February 2027.
Regulation (EU) 2024/1781, the Ecodesign for Sustainable Products Regulation (ESPR), is the framework law that creates the Digital Product Passport. It was adopted on 13 June 2024 and entered into force on 18 July 2024. On its own it obliges almost no one to do anything yet: it sets the machinery, and the actual product obligations arrive later, product group by product group, through delegated acts.
That distinction is the single most useful thing to understand about the ESPR, and the thing most summaries get wrong. This guide walks through what the Regulation says, which articles matter, what the data carrier obligation means in practice, and who carries which duty.
What is Regulation (EU) 2024/1781?
Article 1 describes the subject matter plainly: the Regulation establishes a framework for setting ecodesign requirements that products must comply with to be placed on the EU market, and it "also establishes a digital product passport". It replaces the 2009 Ecodesign Directive, and it widens the scope enormously.
The old Directive covered energy-related products. The ESPR applies to any physical good placed on the EU market, including components and intermediate products, with a short list of exclusions in Article 1(2): food, feed, medicinal and veterinary medicinal products, living plants, animals and micro-organisms, products of human origin, products of plants and animals relating directly to their future reproduction, and vehicles in respect of those product aspects already covered by sector-specific Union law.
Two consequences follow. First, if you make or import a physical product for the EU and it is not on that exclusion list, the ESPR can eventually reach you. Second, "eventually" is doing real work in that sentence, because nothing in the Regulation sets a product requirement by itself.
How the ESPR is structured
The Regulation runs to 80 articles across fourteen chapters. Four blocks matter for the Digital Product Passport:
| Chapter | Articles | What it does |
|---|---|---|
| II. Ecodesign requirements | 4 to 8 | Empowers the Commission to adopt delegated acts, and defines performance and information requirements |
| III. Digital product passport | 9 to 15 | Creates the DPP, its essential requirements, unique identifiers, the registry, the web portal and customs controls |
| V. Prioritisation and planning | 18 to 22 | The working plan that decides which product groups come first |
| VII. Obligations of economic operators | 27 to 38 | Who along the chain has to do what |
Everything else follows the standard architecture of EU product law: conformity assessment, notified bodies, market surveillance, safeguard procedures and penalties.
How the delegated acts work
Article 4 empowers the Commission to adopt delegated acts setting ecodesign requirements for specific product groups. Article 5 lists the product aspects those requirements can address, from durability and reparability to recycled content and carbon footprint. Article 6 covers performance requirements, Article 7 covers information requirements, and Article 8 sets out what each delegated act must contain.
This is why the ESPR reads as strangely non-committal to anyone expecting a compliance deadline. The framework says what a delegated act may require; the delegated act says what you must do, and from when. Your real deadline is the application date of the act covering your product group, not any date in the Regulation itself.
The Digital Product Passport: Articles 9 to 15
Article 9: what a passport is
Article 9(1) sets the core rule: where information requirements apply, products "can only be placed on the market or put into service if a digital product passport is available", and the data in it "shall be accurate, complete and up to date".
Article 9(2) then lists what each delegated act has to specify for its product group, and it is worth reading as a checklist of the decisions that are still open for most sectors:
- the data to be included, drawn from Annex III
- one or more data carriers to be used
- the layout in which the data carrier is presented, and its positioning
- whether the passport sits at model, batch or item level
- how the passport is made accessible to customers before they are bound by a contract, including in distance selling
- which actors may access which data
- which actors create or update the passport, and what they may change
- how long the passport must remain available, which is at least the expected lifetime of the product
Article 10: the essential requirements, including the data carrier
Article 10 is where the technical obligation lives, and it is the article that matters most to anyone choosing a platform or a barcode strategy. A passport must:
- be connected through a data carrier to a persistent unique product identifier
- carry that data carrier physically on the product, its packaging, or accompanying documentation, as the delegated act specifies
- use a data carrier and unique product identifier that comply with the standards referred to in Annex III, or equivalent European or international standards, until harmonised standards are published
- hold data based on open standards, in an interoperable format, machine-readable, structured, searchable and transferable "through an open interoperable data exchange network without vendor lock-in"
- keep customer personal data out of the passport without explicit consent under the GDPR
- refer to the model, batch or item level set by the delegated act
- regulate access according to the access rights defined at product group level
The phrase "without vendor lock-in" is not decoration. It is a legal requirement on the design of whatever system you use.
Articles 11 to 15: the rest of the chapter
Article 11 governs technical design and operation. Article 12 covers unique operator and facility identifiers, including the duty on whoever creates or updates a passport to request an identifier on behalf of an actor that does not yet have one. Article 13 requires the Commission to set up the DPP registry by 19 July 2026, storing at least the unique identifiers, and explicitly storing the battery identifiers referred to in Article 77(3) of the Battery Regulation. Article 14 provides for a public web portal to search and compare passport data. Article 15 ties the passport into customs controls for goods released for free circulation.
Who is obliged to do what
Chapter VII spreads duties across the whole chain, which is the part most often missed by companies assuming the manufacturer carries everything:
| Article | Who | In short |
|---|---|---|
| 27 | Manufacturers | Ensure conformity, create and keep the passport accurate |
| 28 | Authorised representatives | Act on a mandate, hold documentation |
| 29 | Importers | Verify conformity before placing on the market |
| 30 | Distributors | Check that required passports and labels are present |
| 31 | Dealers | Make the passport accessible to customers |
| 33 | Fulfilment service providers | Handle, store and dispatch only conforming products |
| 35 | Online marketplaces and search engines | Cooperate on compliance and traceability |
| 36, 37 | All economic operators | Information, monitoring and reporting duties |
| 38 | Supply chain actors | Provide the manufacturer with information needed for compliance |
Article 34 adds the rule that catches private-label businesses: an importer or distributor that places a product on the market under its own name or trademark takes on the manufacturer's obligations.
Which product groups come first
Article 18 requires the Commission to adopt a working plan listing prioritised product groups and estimated timelines. Article 18(5) names the priorities for the first working plan explicitly: iron and steel; aluminium; textiles, in particular garments and footwear; furniture, including mattresses; tyres; detergents; paints; lubricants; chemicals; energy-related products; and information and communication technology products and other electronics.
The 2025–2030 working plan, adopted in April 2025, took the first slice of that list: steel and aluminium, textiles with a focus on apparel, furniture, tyres and mattresses, plus a set of energy-related products. It also announced two horizontal measures: a repairability score, and requirements on the recyclability of electrical and electronic equipment.
Where that leaves each sector today:
| Product group | Instrument | Status |
|---|---|---|
| Batteries | Regulation (EU) 2023/1542, Article 77 | Battery passport required from 18 February 2027 for every LMT and EV battery, and for industrial batteries over 2 kWh |
| Textiles and footwear | ESPR delegated act | Prioritised in the 2025–2030 working plan; preparatory work underway, act pending |
| Construction products | Regulation (EU) 2024/3110 | Separate regulation with its own product passport track |
| Detergents | Detergents Regulation | Named as an ESPR priority; own sectoral route |
| Iron, steel and aluminium | ESPR delegated act | Prioritised in the working plan as intermediate products |
| ICT and other electronics | ESPR delegated act | Named in Article 18(5)(k); horizontal EEE recyclability measures announced |
Batteries are the only category with a hard, near-term passport date. Everything else depends on an act that has not been adopted yet.
What the data carrier requirement means in practice
Article 10(1)(a) requires a data carrier connected to a persistent unique product identifier, and Article 10(1)(c) requires both to follow recognised standards. In practice, for most consumer-facing goods, that means a 2D barcode on the pack that resolves to a web address.
GS1 Digital Link is the widely used standard for exactly that: it encodes a product's GTIN and related identifiers into a web-resolvable URL, so a single QR code serves the consumer, the retailer's scanner and the compliance query. That structure matches what Articles 10 and 13 assume: an identifier that resolves, and a passport hosted by the operator rather than by the Commission. The CEN and CENELEC DPP standards cover the interoperability layer above it.
None of this makes any particular technology legally mandatory. The delegated act for your product group specifies the carrier. But identifier and carrier work done now is not wasted, because the persistent-identifier requirement is in the framework itself, not in the sectoral act.
What to do now
Read the framework once, then stop watching it and start watching your sector. Concretely:
- Confirm whether your products fall inside Article 1(2)'s exclusions. Most do not.
- Identify your role under Chapter VII, and check Article 34 if you sell under your own brand.
- Track the delegated act for your product group, not the Regulation's own dates.
- Start on identifiers and data carriers, since Article 10's requirements are already fixed.
- Audit where your product data actually lives, because Article 9(1) requires it to be accurate, complete and up to date for the product's expected lifetime.
Points 4 and 5 are where a platform decision starts to matter. Digital Link is a GS1 solution partner, and our platform builds standards-based product passports across industries: a persistent identifier per product, a GS1 Digital Link QR code as the data carrier, and a page behind it that can be updated without reprinting anything. That is what Article 10 asks for, and what Article 9(1) keeps asking for over the product's whole life.
If you intend to keep selling in the EU, the harder question is usually not the technology but where exactly your products sit in the delegated-act queue and which Chapter VII role you carry. Our legal team can review where your products stand under the Regulation and map the implementation route that fits your product group: get in touch and we will look at your case.
Frequently asked questions
Does Regulation (EU) 2024/1781 require a Digital Product Passport today?
No. The ESPR creates the passport and its essential requirements, but the obligation to carry one arrives through a delegated act for each product group. Batteries are the exception, and they are covered by a different instrument: Article 77 of Regulation (EU) 2023/1542, applying from 18 February 2027.
Which articles of the ESPR cover the Digital Product Passport?
Chapter III, Articles 9 to 15. Article 9 creates the passport, Article 10 sets the essential requirements including the data carrier, Article 11 covers technical design and operation, Article 12 unique identifiers, Article 13 the registry, Article 14 the web portal and Article 15 customs controls.
What does the ESPR say about data carriers?
Article 9(2)(b) requires each delegated act to specify one or more data carriers for its product group, plus the layout and positioning. Article 10(1) requires the passport to be connected through that carrier to a persistent unique product identifier, physically present on the product, its packaging or accompanying documentation, and compliant with the standards referred to in Annex III.
Who has obligations under the ESPR?
Manufacturers, authorised representatives, importers, distributors, dealers, fulfilment service providers, online marketplaces and search engines, and supply chain actors, in Articles 27 to 38. Importers and distributors selling under their own name or trademark take on the manufacturer's obligations under Article 34.
Does the ESPR apply to electronics?
Article 18(5)(k) names information and communication technology products and other electronics among the priorities for the first working plan. The 2025–2030 working plan announced horizontal requirements on the recyclability of electrical and electronic equipment. Specific DPP obligations for electronics still depend on a delegated act.
When does the ESPR apply?
It entered into force on 18 July 2024 and applies as a framework now. Product-level obligations apply from the date set in each delegated act. The Commission must have the DPP registry in place by 19 July 2026 under Article 13.
