The Digital Product Passport (DPP) is the piece of EU compliance most hardware teams have not started on, and it is coming for almost every physical product. It is the data backbone of the Ecodesign for Sustainable Products Regulation (ESPR), Regulation (EU) 2024/1781, which entered into force on 18 July 2024 and extends ecodesign rules from a small set of energy-related products to almost the entire physical goods market.
What a Digital Product Passport actually contains
A DPP is not a marketing label or a sustainability score. It is a defined data record tied to a unique product identifier, holding the information regulators, recyclers and buyers need over the product's whole life: what the product is, what it is made of, which substances of concern it contains, its conformity and compliance documentation, how durable and repairable it is, where to get spare parts, and how to handle it at end of life. The exact data fields are set per product group, but the shape is consistent: verifiable, machine-readable, and accessible for as long as the product exists.
Which products are in scope
The ESPR covers almost all physical products placed on the EU market, with narrow carve-outs such as food, feed and medicinal products. It does not switch on one universal passport overnight. Instead, the Commission sets the concrete ecodesign and DPP requirements group by group through delegated acts, guided by its ecodesign working plan. Batteries move first, followed by priority groups that include textiles and apparel, furniture, iron and steel, aluminium and tyres. If you make a physical product for the EU market, the safe planning assumption is that a DPP requirement will reach your category during the ESPR roll-out.
The deadlines that matter
| Date | What applies |
|---|---|
| 18 July 2024 | ESPR enters into force; framework for the DPP established |
| 18 February 2027 | Battery passport required under the Batteries Regulation (EU) 2023/1542 for EV, industrial (over 2 kWh) and LMT batteries |
| 2027 onward | Product-specific ESPR requirements phase in group by group via delegated acts, starting with the first priority categories |
The battery passport is the first hard, dated DPP obligation, which is why it is the one most teams should be watching even if they do not make batteries: it sets the technical pattern the rest of the ESPR passports will follow.
How the data is made available
Each in-scope product carries a data carrier, in practice usually a QR code, that resolves to the passport through a unique product identifier. The data is not all public: the ESPR defines access rights, so consumers, economic operators along the value chain, and market-surveillance authorities each see the subset relevant to them. For manufacturers, the practical consequence is that the passport has to be generated, hosted and kept accurate for the life of the product, not assembled once at launch.
Penalties, and the real risk: market access
The ESPR does not set a single EU-wide fine cap the way the EU AI Act and the Cyber Resilience Act do. It requires member states to lay down penalties that are effective, proportionate and dissuasive, and it allows measures beyond fines, including confiscation of goods and revenue and time-limited exclusion from public procurement and public funding. In commercial terms the sharper risk is simpler: without a required passport, a product cannot be placed on or made available on the EU market at all.
It rarely comes alone
The DPP almost never lands on a product by itself. A connected physical product can owe CE marking under its product directives, cybersecurity duties under the Cyber Resilience Act, and a sustainability data record under the ESPR, all at once. Working one regulation at a time is how teams miss obligations. The hard part, as always, is seeing the full set of norms that apply to one specific product.
Where NormScout fits
NormScout maps every standard a product must meet, from the headline regulations to the harmonized standards and your own internal requirements, and traces each obligation to its source. As the ESPR delegated acts land, the DPP joins that map alongside CE, the CRA and the rest, so you see it coming rather than discovering it at a border. Run the free assessment to see what applies to your product today.
Further reading
For sharper, on-the-ground field notes on the DPP and where it is heading, see NormSignal, written by NormScout founder Timo Hauser: