TECHNICAL GUIDE
The Eight EU DPP Standards (EN 18216 to EN 18246): What Each Covers, What Presumption of Conformity Means and What to Ask Your DPP Provider
On 15 July 2026 the EU published the references of six harmonised standards for digital product passports in the Official Journal (Implementing Decision (EU) 2026/1736). Two more, EN 18239 on access rights and security and EN 18246 on data authentication and integrity, have been available from CEN and CENELEC since 16 September 2026 but are not cited yet. For a fashion brand, these standards matter mainly through the provider that builds and hosts its passports.
This guide sets out what each of the eight standards covers, what the presumption of conformity in ESPR Article 41(2) gives you and what it does not, and which questions to put to a DPP provider. It does not reproduce the standards themselves; they are sold by the national standards bodies.
6 of 8
DPP standards whose references are published in the Official Journal (Implementing Decision (EU) 2026/1736, 15 July 2026).
30.11.2026
Deadline for national standards bodies to implement the six cited standards nationally, by publication or endorsement (CEN-CENELEC date of publication).
2 pending
EN 18239 and EN 18246: available since 16 September 2026, citation in the Official Journal still expected.
Art. 41(2)
ESPR: passports that conform to cited standards are presumed to meet Articles 10 and 11, to the extent the standards cover them.
1. Six cited, two pending: the eight standards at a glance
All eight standards were drafted by the joint CEN and CENELEC technical committee CEN/CLC/JTC 24 (Digital Product Passport – Framework and System). The basis is the Commission's standardisation request to CEN, Cenelec and ETSI, Implementing Decision C(2024) 5423, as amended by C(2025) 8024 (recital 2 of Implementing Decision (EU) 2026/1736). Six of the standards have been assessed and their references published; the Commission found that they "satisfy the requirements set out in Articles 10 and 11 of Regulation (EU) 2024/1781" (recital 5).
| Standard | Title | What it covers (summary of the CEN scope) | Status on 16 October 2026 |
|---|---|---|---|
| EN 18216:2026 | Digital product passport – Data exchange protocols | Protocols and data formats for exchanging passport data securely, in a machine-readable and interoperable way. | Cited in the Official Journal on 15 July 2026 |
| EN 18219:2026 | Digital product passport – Unique identifiers | Unique product, operator and facility identifiers: global uniqueness, persistence, syntax and granularity at model, batch or item level. | Cited in the Official Journal on 15 July 2026 |
| EN 18220:2026 | Digital product passport – Data carriers | Data carriers used in a passport system: symbology, encoding, error correction, print quality, durability, placement and an indicator that makes the carrier recognisable. | Cited in the Official Journal on 15 July 2026 |
| EN 18221:2026 | Digital product passport – Data storage, archiving, and persistence | Storage and archiving of passport data, replication to back-up operators, and availability when the operator that created the passport is no longer active. | Cited in the Official Journal on 15 July 2026 |
| EN 18222:2026 | Digital Product Passport – Application Programming Interfaces (APIs) for product passport lifecycle management and searchability | The interfaces (APIs) used to find passports and to manage them over the passport's lifecycle. | Cited in the Official Journal on 15 July 2026 |
| EN 18223:2026 | Digital Product Passport – System interoperability | Semantic description of products, a common information model and metadata rules, so that data from different systems can be read together. | Cited in the Official Journal on 15 July 2026 |
| EN 18239:2026 | Digital product passport – Access rights management, information system security, and business confidentiality | Access-rights management, including IT security, data protection and the transfer of responsibility between economic operators; public passport data needs no access restriction to be read. | Available since 16 September 2026; not cited (CEN-CENELEC: citation expected) |
| EN 18246:2026 | Digital product passport – Data authentication, reliability and integrity | Integrity, authenticity and reliability of passport data exchange, with verification and integrity mechanisms to limit product fraud and counterfeiting, and a framework for trust and interoperability based on electronically signed data constructs. | Available since 16 September 2026; not cited (CEN-CENELEC: citation expected) |
Titles of the six cited standards as in the Annex to Implementing Decision (EU) 2026/1736; titles of EN 18239 and EN 18246 as in the CEN-CENELEC standards database. The scope summaries are ours, based on the abstracts in that database.
The announcement, publication and withdrawal dates in the CEN-CENELEC database are obligations of the national standards bodies, not of companies. For the six cited standards, the latest date to implement them nationally, by publishing an identical national standard or by endorsement, and to withdraw conflicting national standards, is 30 November 2026; for EN 18239 and EN 18246 it is 31 March 2027. Using these standards remains voluntary: under the EU regulation on European standardisation, a standard is a technical specification "with which compliance is not compulsory" (Article 2(1) of Regulation (EU) No 1025/2012).
2. What presumption of conformity means, and what it does not
ESPR Article 41(2) provides that digital product passports that conform to harmonised standards whose references have been published in the Official Journal "shall be presumed to be in conformity with the requirements set out in Articles 10 and 11 to the extent that those requirements are covered by such harmonised standards or parts thereof". Articles 10 and 11 are the essential requirements for every passport: a data carrier linked to a persistent unique product identifier, open and interoperable data formats without vendor lock-in, access rules, storage, availability after an insolvency, data integrity and security.
The presumption applies from the date the reference is published (recital 6 of Implementing Decision (EU) 2026/1736). For the six cited standards that was 15 July 2026, the day the Decision was published and entered into force (Article 2).
What it does not do:
| Limit | Why |
|---|---|
| It is not an obligation | A passport may meet Articles 10 and 11 in another way; it then cannot rely on the presumption and has to show compliance by other means. |
| It covers only Articles 10 and 11, and only as far as a standard covers them | Article 41(2) applies "to the extent that those requirements are covered". A requirement that no cited standard covers gets no presumption. The Decision does not say which requirement each of the six standards covers; the two standards dedicated to access rights and security (EN 18239) and to data authentication and integrity (EN 18246) are still pending. |
| It does not decide what a clothing passport contains | The information requirements are set product group by product group in delegated acts under ESPR Article 4. For textiles, the Commission's indicative DPP timeline puts adoption in Q3–Q4 2027. |
| It is not a certificate | There is no EU certification of DPP systems or providers. Article 11 empowers the Commission to set requirements for DPP service providers by delegated act and, where appropriate, a certification scheme to verify compliance with them; no such act has been adopted (see section 4). |
If standards fail, the Commission can adopt common specifications by implementing act (ESPR Article 42). It may do so only where the standardisation request was not accepted, the standard was not delivered on time or does not comply with the request, and no reference to a harmonised standard for that requirement has been published or is expected within a reasonable period (Article 42(1)). For the requirements covered by the six cited standards, references have been published, so that condition is not met; for the two pending standards, the Commission's indicative timeline expects the implementing decision in November 2026.
3. The two standards still waiting: EN 18239 and EN 18246
CEN and CENELEC made EN 18239 and EN 18246 available on 16 September 2026; the CEN-CENELEC database lists their citation in the Official Journal as expected. On 16 October 2026 no implementing decision citing them had been published in EUR-Lex. The indicative DPP timeline on the Commission's DPP page (last updated on 15 October 2026) schedules the "Implementing Decision on the remaining two DPP standards" for November 2026.
The requirements these two standards address already apply to every passport, cited standard or not. Access to passport data is regulated by the access rights set for the product group (Article 10(1)(g)); the rights to introduce, modify or update data are restricted on the same basis (Article 11(f)); "data authentication, reliability and integrity shall be ensured" (Article 11(g)); and passports must be designed and operated so that a high level of security and privacy is ensured and fraud is avoided (Article 11(h)). Until the two standards are cited, a provider that builds to them can point to them as good practice, but not to a presumption of conformity. Our guide on DPP access rights covers these requirements in detail.
4. What to ask your DPP provider
Most brands will not implement these standards themselves; a DPP service provider will. ESPR makes the provider part of every passport: the economic operator placing the product on the market must "make available a back-up copy of the digital product passport through a digital product passport service provider" (Article 10(4)), and the passport may be stored by the operator or by such providers (Article 11(c)). These questions turn the standards and the related ESPR requirements into contract points:
| Ask | Why it matters |
|---|---|
| Which of the six cited standards does your system conform to, in their 2026 versions, fully or only in part? | The presumption applies only to the standards, or parts of them, a passport actually conforms to (Article 41(2)). |
| How do you show that conformity? | There is no EU certification yet. Article 11 empowers the Commission to set requirements for providers and, "where appropriate, a certification scheme to verify compliance with such requirements". The Commission's indicative timeline lists the delegated act for DPP service providers in Q2 2027 and again in Q3 2027. |
| What is your plan for EN 18239 and EN 18246? | They are published but not cited; the access, integrity and security requirements of Articles 10(1)(g) and 11(f) to (h) apply anyway. |
| Where is the back-up copy held, and by whom? | The back-up copy through a DPP service provider is a legal duty of the economic operator placing the product on the market (Article 10(4)). EN 18221 covers replication to back-up operators. |
| What happens to our passports if you, or we, stop operating? | The passport must remain available for the period set in the delegated act, including after an insolvency, a liquidation or a cessation of activity in the Union of the operator responsible for creating it (Article 11(e)). EN 18221 covers data persistence. |
| Which identifier and data-carrier schemes do you support? | The data carrier and the unique product identifier are covered by EN 18220 and EN 18219; ESPR Annex III, second paragraph, also requires the data carrier and the identifiers to comply, where relevant, with the ISO/IEC 15459 series. Your GTINs and labels have to fit. |
| Can we take our data to another provider? | Passport data must be based on open standards and, as appropriate, transferable through an open interoperable data exchange network without vendor lock-in (Article 10(1)(d)); EN 18216, EN 18222 and EN 18223 address exchange, interfaces and interoperability. |
| Will you use our data for anything else? | Providers "shall not sell, reuse or process such data" beyond what the storing or processing service requires, unless this is specifically agreed with the economic operator placing the product on the market or putting it into service (Article 11, second subparagraph). |
None of these answers settles what your clothing passports must contain. That depends on the textile delegated act, which the standards do not replace.
DPP AUDIT
Choosing a DPP provider? Know what your passports will need first.
We map your product data, identifiers and supplier information against the ESPR requirements, so you can brief a provider on the standards and the legal duties that matter for your products. Under NDA.
Start Your DPP Audit5. Dates to watch
| Date | What happens | Source |
|---|---|---|
| 15 July 2026 | References of EN 18216, EN 18219, EN 18220, EN 18221, EN 18222 and EN 18223 published; the presumption of conformity applies from that day | Implementing Decision (EU) 2026/1736, Articles 1 and 2, recital 6 |
| 31 August 2026 | Latest date for national standards bodies to announce the six cited standards | CEN-CENELEC standards database (date of announcement) |
| 16 September 2026 | EN 18239 and EN 18246 made available | CEN-CENELEC standards database (date of availability) |
| 30 November 2026 | Six cited standards to be implemented as national standards (by publication or endorsement); conflicting national standards withdrawn | CEN-CENELEC standards database (dates of publication and withdrawal) |
| November 2026 (indicative) | Implementing decision on the remaining two standards | Commission DPP timeline |
| 31 December 2026 | Latest date to announce EN 18239 and EN 18246 nationally | CEN-CENELEC standards database (date of announcement) |
| 31 March 2027 | EN 18239 and EN 18246 to be implemented as national standards (by publication or endorsement); conflicting national standards withdrawn | CEN-CENELEC standards database (dates of publication and withdrawal) |
| Q2 2027 and Q3 2027 (indicative) | Delegated act for DPP service providers (the timeline lists it in both quarters) | Commission DPP timeline |
| Q3–Q4 2027 (indicative) | ESPR delegated act for textiles | Commission DPP timeline |
Frequently asked questions
Are the EU DPP standards mandatory?
Which DPP standards are cited in the Official Journal?
Do the standards decide what goes into a clothing passport?
What if my DPP provider does not follow the standards?
Where can I get the standards?
Sources
- Implementing Decision (EU) 2026/1736Commission Implementing Decision (EU) 2026/1736 of 14 July 2026 on harmonised standards for digital product passports drafted in support of Regulation (EU) 2024/1781 of the European Parliament and of the Council (OJ L, 2026/1736, 15.7.2026). Recitals 1 to 6; Articles 1 and 2; Annex. CELEX 32026D1736 ↗
- ESPRRegulation (EU) 2024/1781 of the European Parliament and of the Council of 13 June 2024 establishing a framework for the setting of ecodesign requirements for sustainable products, amending Directive (EU) 2020/1828 and Regulation (EU) 2023/1542 and repealing Directive 2009/125/EC (OJ L, 2024/1781, 28.6.2024). Articles 4, 10, 11, 41(2), 42(1) and 42(5); Annex III. Read in the Official Journal version as corrected by the corrigenda of 7 August 2024 (Articles 77 and 78) and 28 April 2025; the latter, in the English version, changes "vender lock-in" to "vendor lock-in" in Article 10(1)(d). CELEX 32024R1781 ↗
- Regulation (EU) No 1025/2012Regulation (EU) No 1025/2012 of the European Parliament and of the Council of 25 October 2012 on European standardisation, amending Council Directives 89/686/EEC and 93/15/EEC and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 98/34/EC, 2004/22/EC, 2007/23/EC, 2009/23/EC and 2009/105/EC of the European Parliament and of the Council and repealing Council Decision 87/95/EEC and Decision No 1673/2006/EC of the European Parliament and of the Council (OJ L 316, 14.11.2012, p. 12), consolidated version of 13 December 2024. Article 2(1). CELEX 02012R1025-20241213 ↗
- CEN-CENELECCEN-CENELEC standards database, technical committee CEN/CLC/JTC 24, project pages for EN 18216:2026, EN 18219:2026, EN 18220:2026, EN 18221:2026, EN 18222:2026, EN 18223:2026, EN 18239:2026 and EN 18246:2026: titles, abstracts, status, citation in the Official Journal and implementation dates. CEN-CENELEC standards search ↗
- CEN-CENELECCEN-CENELEC news of 15 July 2026, Digital Product Passport, the cornerstone for the implementation of sustainability and circularity on the European Single Market. cencenelec.eu ↗
- European CommissionEuropean Commission, Digital Product Passport: indicative DPP timeline (page last updated on 15 October 2026). single-market-economy.ec.europa.eu ↗
The legal acts were read in the Official Journal versions published by the Publications Office of the European Union (EUR-Lex) and Regulation (EU) No 1025/2012 also in its consolidated version, a documentation tool without legal effect; the Publications Office records were searched for later decisions, amendments and corrigenda. The CEN-CENELEC database, the CEN-CENELEC news and the European Commission page were accessed on 16.10.2026 in English; the news and the Commission page are available in English only. This is general information, not legal, financial or investment advice.