COMPLIANCE DEEP DIVE

How the EU Digital Product Passport Registry Actually Works

Published 01.10.2026 · Updated 13.10.2026 · Reading time ~11 min · by Lior Gabriel Graetz · LG Fashion Labs

1. What the registry actually is — and isn't

Article 13(1) of the ESPR required the Commission to set up the registry by 19 July 2026, storing "in a secure manner at least the unique identifiers." The Commission adopted Implementing Regulation (EU) 2026/1778 on 16 July 2026, which lays down exactly how the registry operates, and launched the registry together with a test environment on 20 July 2026 (Commission news item of that date). By default, the registry stores at least "the unique identifiers" (Article 13(1)), plus commodity codes for goods entering the EU through customs. Not the full passport dataset. Article 13(1) does not spell out which unique identifiers are meant. The Commission describes the registry as storing "the unique identifiers, registration data, and high-level metadata for each product"; in its user guide (v1.03, 16 September 2026) the registry "records a subset of information necessary to identify and access the DPP, such as unique product identifiers and the location where the passport is hosted", and the registration record holds the Unique Product Identifier (UPI) bound to a Unique Registration Identifier (URI) issued by the registry. CEN-CENELEC, the standards body, describes a registry "where the IDs of the products, the manufacturers and the factories are stored" (15 July 2026). The registration form for batteries, the first product group, asks for the UPI and optional model and batch identifiers only. In the delegated acts it adopts for each product group, the Commission specifies any other data to be stored in the registry (Article 13(2)), taking into account at least three criteria: the need to allow verification of the passport's authenticity, the relevance of the information for improving the efficiency and effectiveness of market surveillance checks and customs controls, and the need to avoid a disproportionate administrative burden for economic operators and customs authorities.

Where things stand (Commission user guide for economic operators, v1.03, last published 16 September 2026): the registry has been open since 20 July 2026 for EU Login accounts, organisation enrolment and identity verification, and a separate test environment is available. Completing the registration of a passport is not yet possible. The guide states: "Successful registration of DPPs for batteries is not currently available, as the semantic catalogue for this product group has not yet been defined. Currently, it is not possible to successfully register DPPs." Batteries are the first product group offered; other product groups are introduced progressively, in line with the ESPR Working Plan. Textiles are not part of this first phase.

Structurally, the registry (per Implementing Regulation Article 3) is made up of nine components: a secure website interface, an API for registering passports, a verification platform, a scheme for generating registration identifiers, a storage component for identifiers and commodity codes, a list of verified digital product passport service providers, a semantic repository defining the meaning and structure of passport data, a log system, and an identification and authorisation scheme for users. It is not, in other words, a single database — it's infrastructure with several distinct jobs.

It also isn't fashion-specific. Article 1(1) of the Implementing Regulation lists what the registry covers: products under ESPR delegated acts, batteries under the Battery Regulation, construction products, toys, and detergents and end-user surfactants — each governed by its own separate EU product law, all sharing the same registry plumbing. Any future EU law that requires a digital product passport can plug into the same system.

2. Who has to register, and the identity-verification gate

Two categories of users can actually register or edit data in the registry: "verified economic operators" — the brand or importer placing a product on the market — and "verified value chain actors," a category covering repairers, refurbishers, remanufacturers and recyclers (Implementing Regulation, Articles 4 and 5). Both groups have to pass identity verification before they can register or modify anything in the registry; neither registration nor correction is possible without it. Anyone with an EU Login account can open the registry and start the enrolment, but registration operations become available only after the organisation has been verified (Commission user guide for economic operators, v1.03, 16 September 2026). The Implementing Regulation also counts digital product passport service providers among value chain actors (recital 4), and a third party authorised to register on an operator's behalf must be verified under Article 5 (Article 19(4)). The Commission's registry guide (v1.03, 16 September 2026) is written for economic operators only; as of 13 October 2026 the Commission's resources page lists no guide for value chain actors or service providers, and the indicative timeline on the Commission's Digital Product Passport page lists the delegated act for DPP service providers under both Q2 2027 and Q3 2027.

The proof required depends on who you are:

The Commission's user guide for economic operators (v1.03, 16 September 2026) describes one procedure for all organisations: a Commission-sealed PDF declaration countersigned with a qualified electronic seal (companies) or qualified electronic signature (sole traders). It draws no EU/non-EU distinction beyond a "Country of Registration" field.

How enrolment works in practice (Commission user guide v1.03, 16 September 2026). First, sign in with an EU Login account: the registry authenticates users through EU Login, and a new account can be created from the sign-in page. Second, choose "Enrol New Organisation" on the Welcome page and then Legal Person (a company or other legal entity) or Natural Person (an individual acting in their own name, i.e. a sole trader). Third, enter the organisation data, including one identifier that must fully match the corresponding attribute in your qualified certificate (legal persons: NTR, preferred, or LEI, VAT, eID or a country-prefixed local identifier; sole traders: TIN, preferred, or PNO, eID, IDC, PAS or a local identifier), plus a compliance contact that is not publicly displayed. Fourth, name the legal representative who is entitled to seal or sign, and request the PDF declaration, which the Commission seals and which is currently provided only in English.

Fifth, the legal representative countersigns the declaration outside the registry with a qualified electronic seal (legal persons) or qualified electronic signature (sole traders), in PAdES Baseline B, T, LT or LTA format. A qualified certificate installed as a software file (.p12/.pfx) is not enough: it "produces only an advanced signature (AdES/QC), which will be rejected by the verification". The guide names two ways to produce a qualified seal or signature: a qualified certificate stored on a qualified signature creation device (a smart card or USB token provided by the qualified trust service provider), or a qualified remote signing service. Sixth, upload the signed PDF (PDF only, up to 1 GB, file name up to 100 characters) and submit it. The request shows as PROCESSING, then SUCCESS or FAILURE; on success the person who enrolled becomes the organisation's Administrator, and the success report shows the expiration day of the signature/seal. According to the guide, the registry is available in English. Note that this is the only verification route the guide describes: the electronic ID (assurance level "high") and electronic attestation of attributes options in the table above are not described in v1.03.

Once verification succeeds, the operator becomes a "verified economic operator" — authorised, per the regulation's own recitals, to create a user profile, register new passports, and modify existing registrations (recital 8; Articles 4(3) and 6). It may delegate access rights to third-party users acting on its behalf where provided by Union law (Article 6(1)). The Commission's user guide (v1.03, 16 September 2026) does not yet document how to add users or delegate access: it states only that the person whose organisation is verified becomes its Administrator, and that the profile menu shows the user's assigned role. The verified status is not permanent. It lasts until the underlying electronic identification means expire, and in any case no longer than three years from the date of verification — whichever comes first. According to the guide, the registry's success report shows the expiration day of the signature or seal. Once the status has lapsed, the operator can no longer register or modify anything until it repeats the process (Implementing Regulation Article 4(4) — a separate provision from ESPR's own Article 4(4) on delegated-act timing, cited later in Sources). One exception: where the registry is integrated with another Union information system that uses an equivalent or identical identity-verification process, an operator already verified there does not have to verify again (Implementing Regulation Article 4(5)); recital 11 gives the European Product Registry for Energy Labelling (EPREL) as an example. The Commission's user guide (v1.03, 16 September 2026) describes no such integration so far: every new organisation enrols through the PDF-declaration procedure.

Registered passports aren't locked to one operator forever, either. They can be transferred to another verified economic operator or value chain actor who takes over the associated obligations (Article 6a) — the regulation's recitals give mergers, splits, business sales, and ceasing to trade as examples of when this applies (recital 10). The Commission's user guide (v1.03, 16 September 2026) does not yet describe how a registration is transferred.

3. How registration actually works

Registration is done by the verified economic operator placing the product on the market or putting it into service — or by a separately verified third party acting on its behalf, with the original operator remaining fully responsible regardless (Articles 8(1)–(2) and 19(4)). It happens at the level of granularity the relevant delegated act requires: model, batch, or item. Where a product is subject to more than one EU rule requiring registration at different levels, the most granular one wins. If a passport is created at item level, its batch and model identifiers must also be linked where those exist; if created at batch level, the model identifier must be linked (Article 8(3)–(5)).

An operator registers either through the registry's secure web interface or through its API (Article 8(6)). On submission, the Commission runs automatic checks before anything is accepted: whether the data is semantically conformant with what the applicable delegated act requires, whether the uploaded mandatory data is coherent with the passport's actual content, whether the passport matches its required granularity level, whether any commodity code is valid for that product group, and whether a back-up link to a digital product passport service provider is present where relevant (Article 8(7)). In the Commission's user guide (v1.03, 16 September 2026) the web interface offers an online form for a single passport and a file upload (XML or JSON, template provided) for a single passport or several, up to 100 per file; the guide does not describe the API. If one passport in a submission has an error, every passport in that submission is rejected. Each request receives a correlation ID, and its status (PROCESSING, SUCCESS or FAILURE) appears in the Activity Dashboard. In the online form the model and batch identifiers are optional and, for now, only item-level registration is available.

Only once those checks pass does the registry generate a unique, persistent registration identifier and communicate it back automatically — through the interface or the API response (Article 8(8) and (10)). Alongside that identifier, the Commission stores the product's other unique identifiers, its commodity code where relevant, a reference to the digital product passport service provider, and registrant information including the date and time of registration and the integrity of the digital product passport as evidence of the registration event (Article 8(9)). As ESPR Article 13(5) states directly: this automatic confirmation "shall not be deemed to be proof of compliance" with the Regulation or any other EU law. Registering a passport and complying with ESPR are two separate legal questions. This describes the legal process; according to the Commission's user guide (v1.03, 16 September 2026), successful registration of passports is not yet possible (see the status note in section 1).

The Commission's guide uses two abbreviations that are easy to confuse. The Unique Product Identifier (UPI) is a URL you supply: it must conform to a URL format compliant with JTC 24 standards, may be at most 2,000 characters, must start with https:// and must resolve to where you host the passport data. The Unique Registration Identifier (URI) is issued by the registry after a successful registration and "connects to an existing DPP Data via an UPI". The registry checks the UPI at validation time, and the guide lists as causes of error, for example, an unsupported protocol, a disallowed domain, a non-permitted network port, excessive redirects or a redirect to a less secure protocol (user guide v1.03, 16 September 2026). The guide does not define a format for the registration identifier itself; Implementing Regulation Article 8(8) requires only that it be unique and persistent.

Test environment. Since the launch the Commission also runs a separate test site (registry.acc.product-passport.ec.europa.eu). According to the user guide (v1.03, 16 September 2026) it is a sandbox for enrolment and registration; it needs its own EU Login, separate from the production account; it uses the same verification process as production, so an organisation must be verified there with valid organisation data and the required signatures or seals; and objects created there do not migrate to production and may be deleted by a data cleaning routine.

4. What happens after registration

A verified economic operator can generate proof of registration for any passport it's responsible for, at any time (Article 9). It's a secure electronic document, sealed with a qualified electronic seal and a Commission timestamp, containing the unique product identifier, the commodity code where relevant, the identity of the responsible operator, the date and time of registration, and a hash of the passport version it refers to. That proof is downloadable through the registry for 90 calendar days after it's generated; since an operator can generate proof "at any given time" (Article 9(1)), a fresh copy can simply be regenerated after that window closes. The Commission announced on 20 July 2026 that economic operators can request proof of registration; the user guide (v1.03, 16 September 2026) does not yet describe this function and shows, for completed requests, the UPI, URI and product group and an "Export as CSV" option for error reports.

Registration isn't a one-time filing. Operators are required to keep their registry data "accurate, complete and up to date at all times" (Article 19(2)), and every change — creation, modification, or deletion — is logged and versioned with its own Commission timestamp (Article 10(1)–(2)). The Commission's user guide (v1.03, 16 September 2026) covers enrolment, verification and the registration of passports; it contains no step-by-step function for modifying or deleting an existing registration, and says only that the operator remains responsible for the passport data's availability and accuracy "including any updates over time". By default, registration data is automatically deleted ten years after registration; where other EU law sets a specific availability period for that product's passport instead, the registry follows that period (Article 10(3)). Separately, a registry user can request deletion of their own account once they're no longer responsible for registry activity (Article 10(4)) — that's account deletion, not the underlying product registration.

Responsibility doesn't transfer just because a task is delegated. A verified operator that authorises a third party to register or edit on its behalf remains fully responsible for complying with the Implementing Regulation, and is considered the data controller for whatever it submits (Articles 19(3)–(5) and 20). Each operator is also responsible for applying appropriate technical and organisational security measures to its own IT systems and to the credentials it uses to access the registry, so that registration data cannot be accessed or modified without authorisation through its IT system (Article 19(3)).

5. The enforcement layer: customs, authorities and the public portal

Anyone placing a covered product under the customs procedure "release for free circulation" has to provide the product's unique registration identifier to customs, who may only release it after verifying that identifier and the commodity code against what's stored in the registry (ESPR Article 15). The law phases this in deliberately: the duty to provide the identifier applies "from the moment the registry is operational," while the fully automatic electronic check — run through an interconnection with the EU Customs Single Window Certificates Exchange System (EU CSW-CERTEX) — applies "from the moment that interconnection is operational." Those are two separate triggers, not necessarily the same date.

Competent national authorities and customs authorities — alongside the Commission itself — get registry access for their own statutory duties (ESPR Article 13(6)). On the national side, every EU member state must designate a single "national administrator" by 18 February 2027 — one official contact point for the Commission, responsible for managing and delegating registry access to the relevant authorities within that state (Implementing Regulation, Article 7).

Separately from the registry sits the public web portal (ESPR Article 14): a Commission-run tool letting stakeholders search and compare passport data, scoped to whatever access rights the relevant delegated act grants them. According to recital 42, the web portal should provide links to data already stored by the economic operator in its decentralised digital product passport. In other words, it should point to that data rather than host it centrally.

On security: the Commission can act against "inappropriate or fraudulent" use of the registry, explicitly including bulk scraping it calls "massive data download" (Implementing Regulation Article 17) — and any user who becomes aware of, or has reasonable grounds to suspect, malicious behaviour in or against the registry must immediately inform the Commission and, where appropriate, the Member States concerned. A Commission helpdesk is already running: Article 13(1) of the Implementing Regulation provides for year-round operation from 08:00 to 20:00 Brussels time, while the Commission's user guide (v1.03, 16 September 2026) gives Monday to Friday, 8 AM to 8 PM CET, by e-mail ([email protected]) and phone (+32 22960431). A 24-hour automated support tool is due by February 2029 (Implementing Regulation Article 13 — distinct from ESPR's own Article 13 on the registry itself).

Sources

• ESPR — registry, web portal & customsRegulation (EU) 2024/1781 of 13 June 2024, Article 2 (definitions); Article 4(4) (minimum 18-month gap between entry into force and application of delegated acts); Article 11 (technical design and operation of the digital product passport); Article 13 (digital product passport registry); Article 14 and recital 42 (public web portal and links to data in decentralised passports); Article 15 (customs controls); Article 72(6) (scrutiny period for delegated acts); Annex III (digital product passport identifier categories, including manufacturer and facility identifiers). CELEX 32024R1781 ↗
• EU DPP Registry — implementation arrangementsCommission Implementing Regulation (EU) 2026/1778 of 16 July 2026 laying down the implementation arrangements for the digital product passport registry set up under Regulation (EU) 2024/1781, OJ L, 2026/1778, 17.7.2026 — Articles 1–24 in full, including registry structure (Art. 3), identity verification (Art. 4–5), registration process (Art. 8), proof of registration (Art. 9), data retention (Art. 10), national administrators (Art. 7), and the helpdesk (Art. 13). CELEX 32026R1778 ↗
• Shared registry infrastructure — other product lawsRegulation (EU) 2023/1542 (batteries), Article 77; Regulation (EU) 2024/3110 (construction products), Article 76; Regulation (EU) 2025/2509 (toy safety), Article 19; Regulation (EU) 2026/405 (detergents and surfactants), Article 21 — each cited in Implementing Regulation (EU) 2026/1778, Article 1(1), as sharing the same registry.
• Identity verification — eIDASRegulation (EU) No 910/2014 of 23 July 2014 on electronic identification and trust services (qualified electronic signatures, qualified electronic seals, qualified trust service providers) — referenced throughout Implementing Regulation (EU) 2026/1778, Articles 4–5.
• CEN-CENELEC — description of the registry architectureCEN-CENELEC, "Digital Product Passport, the cornerstone for the implementation of sustainability and circularity on the European Single Market" (15 July 2026): describes a registry operated by the European Commission in which the IDs of the products, the manufacturers and the factories are stored, with the management and storage of product data delegated to third-party service providers. cencenelec.eu ↗
• EU DPP Registry — operator guidanceEuropean Commission, DG GROW, "DPP Registry User Guide for Economic Operators", v1.03, last published 16 September 2026 (PDF, English), linked from the Commission's DPP Registry page; Commission news item "The Digital Product Passport Registry is now live", 20 July 2026. user guide (PDF) ↗ · DPP Registry page ↗ · news item ↗

The legal texts were accessed and verified directly on EUR-Lex on 01.10.2026; the CEN-CENELEC page, the Commission's user guide and the Commission's web pages were accessed on 13.10.2026. This is general information, not legal, financial or investment advice.