yellow3 / Digital Product Passport
Buyer resource
Digital Product Passport evidence requirements
Two different things are called requirements: what the law requires of you, and what you choose to require of a provider. This page never lets one pass for the other.
- What this helps you do
- Know which obligations are law today, with their article and status, and which provider requirements are your choice.
- Evidence basis
- Regulation (EU) 2023/1542, Regulation (EU) 2024/1781, Implementing Regulation (EU) 2026/1778, the European Digital Product Passport standards.
- Updated
- Regulatory status checked 28 September 2026
Part 1
What the legislation requires
Obligations on the economic operator, from the instruments' own text, each with its article and legal status.
| Article | Obligation | Source | Status |
|---|---|---|---|
| Article 77(4) | Keep the passport accurate, complete and up to date | Regulation (EU) 2023/1542 | Fixed in law |
| Article 77(3) | Make it accessible through a QR code linking to a unique identifier attributed by the operator | Regulation (EU) 2023/1542 | Fixed in law |
| Article 77(4) | Written authorisation for another operator to act on its behalf is allowed; the responsibility is the operator's | Regulation (EU) 2023/1542 | Fixed in law |
| Battery passport. Fixed in law: applies from 18 February 2027 (Article 77(1)) to every LMT battery, every electric vehicle battery and every industrial battery above 2 kWh placed on the market or put into service. | |||
| Article 9(1) | Compile the passport data the delegated act specifies | Regulation (EU) 2024/1781 | Adopted framework, product timing pending |
| Article 10(1) | Attach a data carrier linked to the unique product identifier | Regulation (EU) 2024/1781 | Adopted framework, product timing pending |
| Article 10(4) | Keep a back-up copy with an independent Digital Product Passport service provider | Regulation (EU) 2024/1781 | Adopted framework, product timing pending |
| Article 13(4) | Register the passport's identifiers in the EU Digital Product Passport Registry | Regulation (EU) 2024/1781 | Adopted framework, product timing pending |
| Article 31(2) | Make the passport accessible to customers before they buy, including online | Regulation (EU) 2024/1781 | Adopted framework, product timing pending |
| Digital Product Passport under ESPR. Adopted framework, product timing pending: a passport is required only in accordance with a delegated act for the product group (Article 9(1)), and none has been adopted as of 28 September 2026. Requirements normally apply no earlier than 18 months after an act enters into force (Article 4(4)). | |||
| Article 19(4) | The economic operator remains responsible where a service provider performs the work | Implementing Regulation (EU) 2026/1778 | In force |
| The EU Digital Product Passport Registry. In force since 6 August 2026; the Registry went live on 20 July 2026. | |||
Part 2
What you may require from a provider
Not law. Each of these is a requirement a buyer chooses to set, drawn from yellow3's Buyer Platform. The line under each says what legal weight the underlying standard or fact carries.
-
01
Buyer-selected requirement
Unique identifiers EN 18219
European standard, cited in the Official Journal (Implementing Decision (EU) 2026/1736)
Ask The provider supports at least one of the five identifier schemes permitted by EN 18219, and can state which, including the operator identifier.
Evidence that answers it A written statement naming the scheme or schemes supported (GS1 Digital Link URI, IEC 61406 identification links, W3C decentralised identifiers, RFID or 2D product identifiers, or DOIs) and how the economic operator is identified. A demonstration against a real product is stronger than a datasheet.
-
02
Buyer-selected requirement
Data carriers EN 18220
European standard, cited in the Official Journal (Implementing Decision (EU) 2026/1736)
Ask At least one data carrier offered is free to use and readable by an ordinary smartphone with no application installed, as EN 18220 requires.
Evidence that answers it A working link or code you can scan on an unmodified phone. A carrier that needs the provider's own app does not satisfy this, and anybody can run the test in a meeting.
-
03
Buyer-selected requirement
Data exchange protocols EN 18216
European standard, cited in the Official Journal (Implementing Decision (EU) 2026/1736)
Ask Passport data is exchanged over the REST, HTTPS and TLS transport described by EN 18216.
Evidence that answers it API documentation showing the transport and TLS configuration, or a written statement of conformity naming the standard.
-
04
Buyer-selected requirement
Lifecycle APIs EN 18222
European standard, cited in the Official Journal (Implementing Decision (EU) 2026/1736)
Ask The provider offers create, read, update and search operations, batch retrieval, versioning and registry submission, per EN 18222.
Evidence that answers it API documentation covering each operation by name. Batch retrieval and registry submission are the two most often missing, so ask for them specifically rather than accepting a general conformance claim.
-
05
Buyer-selected requirement
System interoperability EN 18223
European standard, cited in the Official Journal (Implementing Decision (EU) 2026/1736)
Ask Passport data uses the shared data model and semantics of EN 18223, so it remains machine-interpretable outside the provider's own platform.
Evidence that answers it A sample passport export you can read without the provider's tooling. This is the requirement that decides whether leaving the provider is possible, so test it rather than accept it on paper.
-
06
Buyer-selected requirement
Storage, archiving and persistence EN 18221
European standard, cited in the Official Journal (Implementing Decision (EU) 2026/1736)
Ask The provider supports the lifetime availability, versioned history and independent backup arrangements described by EN 18221.
Evidence that answers it Written terms covering retention period, version history, and the backup copy held by an independent service provider under ESPR Article 10(4). The economic operator remains responsible for availability, so a backup held only by the same provider does not answer this.
-
07
Buyer-selected requirement
Access rights, security and confidentiality EN 18239
European standard, published 16 September 2026, not yet cited in the Official Journal
Ask The provider can describe how role-based access separates public from restricted passport data, and states whether it conforms to EN 18239.
Evidence that answers it A written description of the access model and the roles it distinguishes, and a statement of conformity where the provider claims one. Conformity does not yet carry a legal presumption of conformity.
-
08
Buyer-selected requirement
Data authentication and integrity EN 18246
European standard, published 16 September 2026, not yet cited in the Official Journal
Ask The provider can describe how passport data is made tamper-evident, and states whether it conforms to EN 18246.
Evidence that answers it A written description of the mechanism used (W3C verifiable credentials, an eIDAS electronic attestation of attributes, an ISO 22376 visible digital seal or ISO/IEC 20248) and a statement of conformity where the provider claims one. Conformity does not yet carry a legal presumption of conformity.
-
09
Buyer-selected requirement
Who is the economic operator of record Contract
Contract clause the buyer chooses to require
Ask The contract states that you remain the economic operator responsible for registration and for the accuracy of passport data, and describes what the provider does on your behalf.
Evidence that answers it A contract clause. Under Implementing Regulation (EU) 2026/1778, Article 19(4), the economic operator placing the product on the market stays responsible even where a service provider performs the work, so a provider who implies otherwise is describing something that is not available to sell.
-
10
Buyer-selected requirement
The pending service-provider rules Contract
Contract clause the buyer chooses to require
Ask The provider commits to meeting the requirements for Digital Product Passport service providers under ESPR Article 11(3) once that delegated act is adopted, and the contract lets you exit if it does not.
Evidence that answers it A contract clause naming the act and an exit right. The delegated act is not yet adopted (status checked 28 September 2026; the Commission plans it for 2027). Nobody knows what certification it will require, which is a reason to keep the first term short rather than a reason to wait.
What counts as evidence
Stated means the provider says it: on its website, in a datasheet or in a response. Shown means you can inspect something concrete that demonstrates it: a code that scans, an export you can read, documentation of an operation by name, a clause in a contract. A stated capability is a reason to ask for evidence, not evidence itself. The yellow3 Supplier Register publishes every finding with its state, its source page and the date it was checked.
Sources and status
Legal statements cite the article that imposes them, and every date carries its legal status, as in the Digital Product Passport 2026 executive report. Regulatory status checked 28 September 2026; yellow3 re-checks the Official Journal and CEN-CENELEC's published standards every week. This page separates what the law requires from what a buyer may choose to require, and neither is legal advice.