EU Digital Product Passport: What the New Technical Standards Mean for Your Business

On 27 May 2026, the European Committee for Standardization (CEN) and CENELEC published the first six technical standards that define how the EU Digital Product Passport (DPP) system will work in practice. These standards were developed under the joint technical committee CEN-CLC/JTC 24 in response to Standardisation Request M/604 from the European Commission, and they support Regulation (EU) 2024/1781, the Ecodesign for Sustainable Products Regulation (ESPR).

What the standards cover

The six published standards form the technical foundation of the DPP system:

• EN 18216:2026 defines secure data exchange protocols and data formats to ensure that DPP data can move between systems in a structured, machine-readable, and interoperable way across all sectors and platforms
• EN 18219:2026 defines the rules for unique product, economic operator, and facility identifiers used in DPPs, covering global uniqueness, persistence, and interoperability at model, batch, or item level
• EN 18220:2026 specifies requirements for physical data carriers such as QR codes and NFC chips that link a physical product to its digital passport
• EN 18221:2026 covers data storage, archiving, and persistence, including a decentralised approach and rules to ensure DPP data remains available even if the company that created the passport is no longer active
• EN 18222:2026 standardises the API specifications for DPP platforms, covering lifecycle management, searchability, and security
• EN 18223:2026 addresses system interoperability, including semantic data models, metadata formats, and technical and organisational interoperability rules

Two additional standards are still in draft and are expected in September 2026: FprEN 18239 on access rights management, IT security, and business confidentiality, and FprEN 18246 on data authentication, integrity, and tamper-evidence.

Who do these standards apply to

The primary obligation under these standards sits with manufacturers and other economic operators who are required to issue a DPP under the ESPR, as well as with the DPP platforms and the central EU DPP registry that store and manage passport data.

The ESPR itself does not apply to all product categories at once. The Commission is rolling out DPP requirements product group by product group through delegated acts. The first product categories in scope include batteries (already covered by a separate regulation), textiles, electronics, furniture, steel, aluminium, and tyres. Companies in these sectors should treat the publication of these standards as a signal that the technical infrastructure is now in place and that DPP compliance timelines are becoming real.

What is not yet available

The standards are not yet available for purchase. National standardisation bodies have six months from 27 May 2026 to implement them at national level, meaning they will become accessible through bodies. The European Commission is also still defining the rules on access rights, specifically which categories of people and organisations will have access to which parts of DPP data, based on the concept of legitimate interest.

What this means for your business

If your company manufactures or places products on the EU market in any of the ESPR priority sectors, now is the time to assess how your current product data management processes will connect to a future DPP system. The standards published on 27 May 2026 define exactly how data must be structured, stored, exchanged, and identified within a DPP. Reviewing these requirements now will help you plan system changes and avoid integration problems later.

If you use compliance data management systems to collect and manage material or substance data across your supply chain, you should also check with your system providers how they plan to support DPP data exchange requirements, in particular the data exchange and interoperability standards EN 18216 and EN 18223.

Source: CEN/CENELEC publication, 27 May 2026