COMPLIANCE DEEP DIVE
DPP for Manufacturers and Private Label Producers: Who's Responsible for What
Under EU law, the word "manufacturer" doesn't mean what it sounds like it means. In the Ecodesign for Sustainable Products Regulation (ESPR), the legal "manufacturer" is whoever markets a product under their own name or trademark — not necessarily whoever actually makes it. For a factory producing under contract for a brand, or a private-label producer supplying a retailer's own-brand line, that single definition decides who carries the Digital Product Passport obligations, and who doesn't.
This guide works through what the ESPR text itself says about the split between the legal "manufacturer" and the party ESPR calls a "supply chain actor," what each one is actually required to do, and how the passport's own data structure keeps their identities separate. Everything here is sourced directly from ESPR (Regulation (EU) 2024/1781) — nothing else.
1. The legal test: who is the "manufacturer" under ESPR
ESPR's definitions section sets out exactly who counts as a "manufacturer" — and the definition turns on marketing, not production:
ESPR (Regulation (EU) 2024/1781), Article 2, point 42
"'manufacturer' means any natural or legal person that manufactures a product or that has a product designed or manufactured, and markets that product under their name or trademark."
Read closely, this definition covers two distinct situations with one label. It covers a company that physically makes its own products. But it equally covers a company that "has a product designed or manufactured" by someone else entirely, provided that company then markets the finished product under its own name or trademark. A brand that designs a garment, contracts a factory to produce it, and sells it under the brand's own label is the "manufacturer" under ESPR — full stop — regardless of who cut and sewed the fabric. The factory that did the actual work is not the "manufacturer" for that product under this Regulation.
This matters because every Digital Product Passport obligation in ESPR is written to attach to "manufacturers." A private-label producer or contract factory needs to know, product by product, whether it is standing in that role or not.
2. What the brand carries — even when someone else makes the product
Article 27 sets out the obligations that attach to whoever holds the "manufacturer" role. Before placing a covered product on the market, manufacturers must ensure the product meets the applicable requirements, that it's accompanied by the required information, and that a Digital Product Passport is available, including a back-up copy held by a DPP service provider. Manufacturers must also carry out — or arrange — conformity assessment:
ESPR Article 27(2)
"Before placing a product covered by a delegated act adopted pursuant to Article 4 on the market or putting it into service, manufacturers shall carry out the conformity assessment procedure specified in that delegated act, or have it carried out on their behalf, and draw up the required technical documentation."
That phrase — "or have it carried out on their behalf" — is doing real work here. It confirms a brand can delegate the practical testing, documentation and data-collection tasks to its manufacturing partner, a compliance specialist, or a third-party body. What it does not do is move the underlying legal duty. Article 27(1) opens by saying manufacturers "shall ensure" compliance — that obligation to ensure, and the duty to keep the technical documentation and EU declaration of conformity on file, sits with whoever holds the legal "manufacturer" role, however much of the actual work is subcontracted out.
Manufacturers must also put their own name, registered trade name or trademark, and contact details on the product (or its packaging) and on the public part of the Digital Product Passport itself (Article 27(6)) — another marker that the law is tracking the brand, not the factory, as the accountable party.
3. What the factory owes the brand, even without being the legal "manufacturer"
Not carrying the "manufacturer" label doesn't mean a contract factory or private-label producer has no obligations. ESPR uses a separate term — "supply chain actor" — for exactly this role, and gives it its own, binding requirements once specified in the relevant delegated act:
ESPR Article 38 — Requirements on supply chain actors
"When specified in the delegated act adopted pursuant [to] Article 4, supply chain actors shall: (a) provide, upon request and free of charge, manufacturers, notified bodies and competent national authorities with available relevant information related to the products they supply or the services they provide; (b) allow, in the absence of information referred to in point (a), manufacturers to assess the products they supply or the services they provide and give access to relevant documents or facilities to those manufacturers; and (c) enable notified bodies and competent national authorities to verify the accuracy of relevant information related to their activities."
Note the word "when specified" — unlike a "manufacturer's" obligations under Article 27, which apply automatically once a product is covered by a delegated act, a supply chain actor's Article 38 duties only bite once the relevant delegated act actually specifies them for that product category. ESPR itself doesn't formally define "supply chain actor" with the same precision it gives "manufacturer" — the term is used operationally rather than pinned down in Article 2's definitions list, which is itself worth knowing rather than assuming a stricter legal boundary exists than actually does.
The recital accompanying Article 38 explains why this provision exists at all — brands frequently don't hold the underlying production data themselves:
ESPR Recital 77
"...the Commission should be empowered to require, where duly justified, that supply chain actors provide, free of charge, information on what they supply, such as the quantity and type or chemical composition of materials used or the production process employed, or information on the conditions of the provision of their services. It should also be possible to allow manufacturers to have access to the documents containing such information or to the actual facilities of the supply chain actors so that they can access directly the necessary information if the supply chain actors do not provide the information requested within a reasonable time."
In plain terms: the law expects the brand to need data that only the factory has — fibre composition, chemical inputs, the actual production process — and builds in both a free-of-charge information-sharing duty and, as a backstop, a facility-access right if that information isn't forthcoming.
4. How the passport itself keeps these identities separate
This split between legal "manufacturer" and actual production facility isn't just a conceptual distinction — it's built directly into the Digital Product Passport's own data structure. Annex III, which lists the data a passport may or must contain, keeps three related but distinct fields:
| Annex III point | What it records |
|---|---|
| (g) | "information related to the manufacturer, such as its unique operator identifier" — the legal brand, per the Article 2(42) test. |
| (h) | "unique operator identifiers other than that of the manufacturer" — room for the actual factory, subcontractor, or other supply chain actor's own identity. |
| (i) | "unique facility identifiers" — the specific production site, which can differ from both the manufacturer's and any other operator's registered identity. |
A passport built only around the brand's own identity is incomplete by this structure's own logic — the law anticipates naming the facility and other operators involved, not collapsing everything into one "manufacturer" field. This lines up with what the Regulation says the passport is for in the first place: the recitals describe it as expected to "significantly enhance end-to-end traceability of a product throughout its value chain," available to "economic operators, namely manufacturers, authorised representatives, importers, distributors, dealers and fulfilment service providers, and other value chain actors" (Recital 32) — a purpose that only works if production-side identities are actually captured, not just the brand's.
5. When the factory itself becomes the legal "manufacturer"
The Article 2(42) test is about a role, not a fixed identity. The same factory can sit on both sides of this line for different products at the same time: a "supply chain actor" for the private-label lines it produces under a retailer's own brand, and the legal "manufacturer" in its own right for any product it designs, produces, and sells under its own name or trademark. A manufacturer that both runs a white-label production business for other brands and sells a smaller line of its own carries ESPR "manufacturer" obligations — Article 27 in full, not the lighter Article 38 duties — for that second line, the moment it markets those specific products under its own name.
This distinction has to be tracked product by product, and sometimes SKU by SKU, rather than assumed to apply uniformly across a company's whole output.
6. What this means in practice
For a brand: outsourcing production never outsources the legal "manufacturer" role or its Article 27 duties — what can genuinely move to a manufacturing partner is the practical work of testing, data collection and documentation, not the underlying obligation to ensure compliance. For a factory or private-label producer: the absence of a "manufacturer" label doesn't mean the absence of obligations — Article 38 creates real duties to share data and, where necessary, facility access, once a delegated act specifies them, and any product sold under the factory's own name shifts it into the full "manufacturer" role for that line specifically.
In both directions, the practical bottleneck is usually the same: the party legally responsible for the passport (the brand) frequently doesn't hold the underlying production data (the factory's fibre sourcing, chemical inputs, facility details) in a structured, DPP-ready format — and building that pipeline between the two parties, rather than any single provision of the law, is where most of the real compliance work sits.
BUILD & HOST
Someone else's factory data, one live passport.
Build & Host turns fragmented brand and factory data — fibre composition, facility identifiers, substances of concern — into production-ready passports connected to the EU DPP Registry, scoped after a Full Collection Audit and maintained on a monthly retainer for the 10-year horizon the regulation requires.
Get Your Price →Frequently asked questions
We're a factory making product for a brand that puts its own label on it. Are we the "manufacturer" under ESPR?
Does that mean the factory has no legal obligations at all?
Can a brand outsource the actual compliance work to its manufacturing partner?
Does the Digital Product Passport itself have a way to show which factory actually made the product?
Can a manufacturer become the legal "manufacturer" under ESPR for its own product lines?
Who actually needs to be involved for a private-label product's Digital Product Passport to be accurate?
Sources
- ESPR — full textRegulation (EU) 2024/1781 of the European Parliament and of the Council of 13 June 2024 establishing a framework for the setting of ecodesign requirements for sustainable products, amending Directive (EU) 2020/1828 and Regulation (EU) 2023/1542, and repealing Directive 2009/125/EC. Article 2 (definitions, point 42: manufacturer), Article 27 (obligations of manufacturers), Article 38 (requirements on supply chain actors), Annex III, points (g)–(i) (manufacturer, operator and facility identifiers in the Digital Product Passport), recitals 32 and 77. CELEX 32024R1781 ↗
All sources were accessed and verified directly on EUR-Lex on 28.09.2026, and re-verified a second time before publication. This is general information, not legal advice; brands and manufacturers should confirm how these roles apply to their specific supply-chain structure with qualified counsel.