The EU Toy Safety Regulation and the digital product passport for toys

TL;DR

• The EU Toy Safety Regulation, Regulation (EU) 2025/2509, requires the manufacturer to create a digital product passport for every toy before placing it on the EU market. The duty applies from 1 August 2030.
• The passport must stay available for ten years after the toy is placed on the market, even if the company that created it goes insolvent or ceases trading.
• For several other instruments, a complete toy passport can replace the EU declaration of conformity. It is not purely an additional burden.

The EU Toy Safety Regulation, Regulation (EU) 2025/2509, was signed in Strasbourg on 26 November 2025 and replaces the 2009 Toy Safety Directive. For anyone working on Digital Product Passports it is a more useful document than most of what is written about the subject, for one simple reason: it contains an adopted passport obligation with article numbers and an annex, rather than a framework waiting for a delegated act.

This guide covers what Articles 19 to 23 actually require, what Annex VI says a toy passport must contain, and which parts of the Regulation are already in application. As of October 2026, the passport duty itself is not.

When it applies, and what is already live

The Regulation applies from 1 August 2030. That is the date the passport obligation, and almost everything else a toy manufacturer has to do, starts to bind.

A smaller set of provisions applies much earlier, from 1 January 2026: Articles 28 to 44 and Articles 49 to 55. Reading those articles is the quickest way to understand why the early date is not a deadline for industry. They cover notification of conformity assessment bodies, the requirements on notifying authorities, applications for notification, the operational obligations of notified bodies, coordination between them, the Commission's delegated powers and the penalties regime.

In other words, the machinery that has to exist before the substantive rules can work. A toy manufacturer does nothing on 1 January 2026 because of this Regulation.

Anyone selling you urgency on this file in 2026 is selling you something. The reason to read it now is different, and better: it is the clearest legal text on what a digital product passport must be, and it is already law.

What Article 19 requires

Article 19(1) is short and unambiguous. Before placing a toy on the market, the manufacturer shall create a digital product passport for that toy.

Article 19(2) then sets out what that passport must do. It must:

• correspond to a specific toy model, not to an individual item
• state that the toy's compliance with the Regulation, and in particular the essential safety requirements, has been demonstrated
• contain at least the data listed in Part I of Annex VI
• be accurate, complete and up to date
• be available in the language or languages required by the Member State where the toy is made available
• be accessible to consumers and other end users, market surveillance authorities, customs authorities, notified bodies, the Commission and other economic operators, according to their access rights
• remain available for ten years after the toy is placed on the market, including where the economic operator that created it becomes insolvent, is liquidated or ceases activity in the Union
• be connected through a data carrier to a persistent unique product identifier

Two of those deserve more than a bullet.

The ten-year availability requirement surviving insolvency is an infrastructure obligation, not a content one. A passport hosted on a company's own web server disappears when the company does, which is precisely the scenario the text names. This is why Article 20(5) allows the passport to be stored either by the economic operator or by digital product passport service providers.

The data carrier plus persistent unique product identifier is the same construction the ESPR uses, and Article 21 makes the connection explicit, which we come back to below.

Article 19(4) adds the consequence that matters legally: by creating the passport, the manufacturer assumes responsibility for the toy's compliance with the Regulation.

The passport can replace the declaration of conformity

Article 19(5) is the part most summaries miss, and the one worth taking to a compliance manager.

Where a toy's digital product passport includes all the information required for the EU declaration of conformity under certain other instruments, the manufacturer is deemed to have complied with the obligation to draw up that declaration. The instruments named include the AI Act, Regulation (EU) 2024/1689; the Cyber Resilience Act, Regulation (EU) 2024/2847; the RoHS Directive 2011/65/EU; the EMC Directive 2014/30/EU; the Low Voltage Directive 2014/35/EU; the Radio Equipment Directive 2014/53/EU; and Delegated Regulation (EU) 2019/945 on drones.

That reframes the project. A connected toy today can sit under several of those at once, each with its own declaration. A passport built properly can collapse that paperwork rather than add to it. Annex VI Part I even anticipates the bookkeeping, requiring the passport to state, where applicable, that it replaces the EU declaration of conformity.

What data the toy passport must carry

Part I of Annex VI is the mandatory set. Part II lists data the passport may additionally contain. The mandatory list includes:

• the unique product identifier of the toy
• the name and address of the manufacturer, and of the authorised representative where applicable, with the unique operator identifier
• the name, address and unique operator identifier of the economic operator responsible under Article 4 of the market surveillance Regulation (EU) 2019/1020
• a statement that the passport is issued under the sole responsibility of the manufacturer
• the object of the passport: identification of the toy allowing traceability, including a colour image of sufficient clarity to identify it
• where applicable, the commodity code under which the toy is classified
• references to all Union law the toy complies with
• where applicable, the mention that the passport replaces the EU declaration of conformity
• references to the harmonised standards used, or to common specifications
• where applicable, the name and number of the notified body that intervened, and the certificate reference
• the CE marking
• a list of allergenic fragrances present in the toy that are subject to specific labelling requirements

Read that list next to a typical product page and the gap is obvious. This is not marketing content with a compliance section bolted on. It is a conformity record that happens to be reachable by a consumer scanning a code.

Article 20: how it has to work

Article 20 governs technical design and operation, and it closes several doors that vendors have historically left open:

• the passport must be fully interoperable with other digital product passports required by other Union law, technically, semantically and organisationally
• all data must be based on open standards, in an interoperable format, machine-readable, structured, searchable and transferable through an open interoperable data exchange network without vendor lock-in
• access must be free of charge, according to each actor's access rights
• consumers shall not be requested to register or provide a password to access the passport
• the passport is stored by the responsible economic operator or by digital product passport service providers
• where a new passport is created for a toy that already has one, the new passport must be linked to the original

Article 20(4) is the one to quote in internal arguments. A passport behind a lead-capture form, an account wall or a cookie gate is not compliant. The scan has to land on the information.

Article 21: the link to the ESPR

Article 21(1) states that the data carriers, the unique product identifiers and the unique operator identifiers required under the Toy Safety Regulation shall comply with the standards applicable under Regulation (EU) 2024/1781, the Ecodesign for Sustainable Products Regulation.

This is a legal cross-reference, not a commercial analogy. The toy passport does not invent its own identifier scheme: it inherits the ESPR's. Article 21(2) goes further, applying Article 12(2) of the ESPR to toy economic operators who need a unique operator identifier that does not yet exist, and extending any ESPR lifecycle rules for identifiers and carriers to toys.

The practical consequence: identifier and data carrier work done for ESPR readiness is not a separate project from toy compliance. It is the same project. GS1 Digital Link is the widely used standard for a web-resolvable product identifier of exactly this shape, and the CEN and CENELEC DPP standards sit above it on interoperability.

Articles 22 and 23 complete the pattern set by the ESPR: a digital product passport registry, and customs controls tied to the passport for goods entering the Union.

How toys compare with the other categories

Toys and batteries are the two categories where the passport duty is written into adopted law rather than awaiting a delegated act. For a toy with a battery in it, both instruments can be in play, on different dates and at different levels of granularity.

What toy manufacturers can usefully do now

Four years is long enough to do this badly twice. It is also long enough that starting a full implementation programme in 2026 would be premature. The useful work sits in between.

1. Settle your identifiers. Article 21 has already decided this for you: ESPR-compliant unique product identifiers and operator identifiers. There is nothing speculative about starting here.
2. Work out who your Article 4 responsible person is, because Annex VI requires their name, address and operator identifier in the passport itself.
3. Find your conformity data. References to every Union law the toy complies with, harmonised standards, notified body and certificate numbers, allergenic fragrances. In most companies that data exists, in a folder, unstructured.
4. Check whether Article 19(5) applies to you. If your toys carry declarations under RoHS, EMC, the Low Voltage or Radio Equipment Directives, or the AI Act, the passport may be able to absorb them.
5. Decide where the passport will live. The ten-year requirement surviving insolvency is a question about hosting and continuity, and Article 20(5) explicitly contemplates a service provider answering it.
6. Do not design a gated experience. Free, no registration, no password, with access tiers for authorities and operators.

Digital Link is a GS1 solution partner, and our platform builds standards-based product passports across industries: a persistent identifier per product, a GS1 Digital Link QR code as the data carrier, and a page behind it that can be updated without reprinting anything. For toys, the point that usually decides the project is continuity, because a passport has to outlive the packaging run and, under Article 19(2)(g), potentially the company. If you want to work out where your products stand, get in touch and our legal team will review your case.

Frequently asked questions

Do toys need a digital product passport?

Yes, but not yet. Article 19 of Regulation (EU) 2025/2509 requires the manufacturer to create a digital product passport before placing a toy on the EU market, and the Regulation applies from 1 August 2030. Before that date there is no passport obligation for toys.

What applies on 1 January 2026?

Articles 28 to 44 and Articles 49 to 55: notification of conformity assessment bodies, requirements on notifying authorities, the operational obligations and coordination of notified bodies, the Commission's delegated powers and the penalties regime. None of it requires action from a toy manufacturer.

Is the toy passport at model level or item level?

Model level. Article 19(2)(a) requires the passport to correspond to a specific toy model. That differs from the battery passport, which is tied to an individual battery's unique identifier.

How long must a toy passport stay available?

Ten years after the toy is placed on the market, under Article 19(2)(g), and the text is explicit that this holds even where the economic operator that created the passport becomes insolvent, is liquidated or ceases activity in the Union.

Can the passport replace the EU declaration of conformity?

For several instruments, yes. Article 19(5) provides that where the passport includes all the information required for the declaration, the manufacturer is deemed to have complied with the obligation to draw one up. The instruments named include the AI Act, the Cyber Resilience Act, RoHS, EMC, the Low Voltage Directive, the Radio Equipment Directive and the drones Delegated Regulation.

Can we put the toy passport behind a login or a form?

No. Article 20(3) requires access free of charge, and Article 20(4) states that consumers shall not be requested to register or provide a password to access the passport.

What data carrier does a toy passport use?

The Regulation does not name a technology. Article 19(2)(h) requires the passport to be connected through a data carrier to a persistent unique product identifier, and Article 21(1) requires the carriers and identifiers to comply with the standards applicable under Regulation (EU) 2024/1781, the ESPR.