DPP Series | Part 3: From eCoC to QSeal: How eSign.AI Supports DPP Readiness

The Digital Product Passport (DPP) is becoming more than a product-data project. On 17 July 2026, the European Union published Commission Implementing Regulation (EU) 2026/1778, establishing detailed implementation arrangements for the DPP registry under the Ecodesign for Sustainable Products Regulation. The regulation makes identity, authorization, APIs, verification and durable proof part of the operating picture.

For manufacturers and exporters, this changes the readiness conversation. The question is no longer only whether product data exists. Companies also need to know which legal entity submits it, how an authorised actor is verified, how systems exchange it, and what evidence proves that registration and submission events occurred.

This final article in the eSign.AI DPP series explains how electronic Certificates of Conformity (eCoC), QSeal delivery, long-term signatures and API workflows combine into a practical DPP readiness solution.

What the July 2026 DPP registry rules add

Regulation (EU) 2026/1778 describes how the Commission will operate the DPP registry and verification platform. It covers access control, economic operator registration, verification, unique registration identifiers, API-based interfaces, logs and proof of registration.

For natural persons, the regulation provides high-assurance identity paths that can include qualified electronic signatures, high-assurance electronic identification schemes or qualified electronic attestations of attributes. For legal persons, it provides paths including a qualified electronic seal supported by a qualified certificate issued by a qualified trust service provider, or an electronic attestation route.

The regulation also states that verified economic operators remain responsible for the data they submit. Technology can establish a controlled process and preserve evidence, but it does not transfer the legal responsibility for product information away from the operator.

The official text of Commission Implementing Regulation (EU) 2026/1778 should be used when designing registry-facing controls.

Why eCoC experience is relevant

An electronic Certificate of Conformity and a Digital Product Passport are different instruments. eCoC supports vehicle conformity and registration processes, while a DPP provides product information under the legislation applicable to a product group. The data models, authorities and legal requirements are not interchangeable.

However, both expose the same operational challenge: regulated product data must move from authoritative business systems into an external digital process while preserving identity, integrity and evidence. A company that has already connected manufacturing data, approval workflows and trusted signing to an eCoC process has useful building blocks for DPP readiness.

Those building blocks include controlled master data, clear legal-entity ownership, role-based approval, API monitoring, exception handling, evidence export and long-term retention. Reusing the controls is more valuable than trying to reuse an entire product-specific solution.

QSeal is a trust service, not a software label

A qualified electronic seal, commonly shortened to QSeal, is an electronic seal that meets the eIDAS requirements for qualified status. It is created using a qualified electronic seal creation device and is based on a qualified certificate for an electronic seal. Under eIDAS, it benefits from a presumption of data integrity and correctness of origin.

Qualified status cannot be created by a marketing claim or a workflow setting. A provider and its qualified service must appear in the applicable EU national trusted list. eSign.AI addresses this requirement through its Registration Authority service and integration with ANF AC, which issues the qualified electronic seal and is listed as a qualified provider in the EU trust framework.

For customers, this means eSign.AI can deliver the QSeal application and issuance journey as part of the DPP or eCoC solution: organisation-document collection, identity-verification coordination, certificate-data matching, seal activation and integration into the signing workflow. The customer does not need to assemble the overseas trust-service path separately.

How eSign.AI can support QSeal-related readiness

The first capability is QSeal onboarding. eSign.AI can guide the organisation through the application package and verification process, coordinate the Registration Authority steps and connect the ANF AC-issued QSeal to the required business workflow.

The second capability is trusted signing. eSign.AI supports PAdES workflows for PDF documents and XAdES/JAdES long-term signature profiles for structured XML or JSON data. Qualified timestamps and retained validation evidence help keep records verifiable beyond the original certificate lifecycle.

The third capability is system integration. A DPP or eCoC process may begin in PLM, ERP or another system of record. eSign.AI can receive the business event, validate required workflow fields, route approvals, apply the QSeal or signature through SaaS, SDK or API, and retain the signed object, timestamps, transaction logs and completion evidence.

A conceptual economic operator onboarding flow

Workflow note: this Word-source diagram is a conceptual illustration rather than the EU DPP Registry interface. In eSign.AI's delivery model, the qualified seal is issued through ANF AC and incorporated into the customer workflow through eSign.AI's Registration Authority and integration services. Actual identity methods, proof formats and authorisation steps follow applicable EU rules and the final registry design.

An onboarding workflow can begin with legal-entity information and supporting records collected from the relevant corporate source. An authorised representative reviews the registration package, and the configured trust-service step applies the required signature or seal where the governing rule calls for it.

The system then submits the package through the applicable interface and retains the response. Under Regulation (EU) 2026/1778, successful registry registration results in a unique registration identifier and proof of registration in a secure electronic document protected through Commission trust services.

This flow must keep three records separate: proof of the organisation's identity, proof that the actor was authorised, and proof that the external system accepted or registered the submission. Combining them into one generic “signed” status makes later audit and troubleshooting much harder.

API integration and batch processing

Manufacturers may need to register many products or entities and maintain passport data at scale. Manual portal work cannot be the primary operating model for high-volume programmes. API integration should support authenticated requests, deterministic identifiers, idempotency, validation, response tracking and controlled retries.

Batch processing should not mean one opaque bulk job. Each item needs a traceable status and evidence trail so failed records can be isolated without resubmitting successful ones. Monitoring should distinguish data-quality errors, authorization failures, trust-service failures and external platform availability.

eSign.AI connects customer business systems, qualified signing and sealing services, and registry-facing submission workflows. The European Commission operates the DPP Registry; eSign.AI provides the customer-side QSeal, signature, integration and evidence capabilities needed to prepare and execute those processes.

A readiness architecture companies can implement now

Companies do not need to wait for every delegated act before improving the foundations. They can establish a product-and-rule register, map source systems, define identifier governance, document legal-entity ownership and build reusable approval and evidence controls.

A sensible architecture separates product data from workflow control while connecting both to trusted signing services. Product data remains in authoritative systems or a governed data service. eSign.AI coordinates validation and approval, delivers the ANF AC QSeal path, applies the required PAdES/XAdES/JAdES signature or qualified timestamp, and preserves the result and context.

This separation avoids vendor lock-in and allows different product groups to use different legal paths while sharing integration, monitoring and evidence capabilities.

Three checks before selecting a solution

First, ask whether the solution distinguishes ordinary electronic signatures or seals from qualified services. If every trust action is presented as equivalent, legal and procurement teams cannot make an informed decision.

Second, ask whether the solution provides both the qualified-service path and documented APIs. A DPP programme should not force the customer to coordinate certificate issuance, signing and product-data submission across disconnected providers and portals.

Third, ask whether evidence can be exported and independently validated. Compliance records must remain usable if the workflow platform, trust provider or internal system changes.

The role of eSign.AI in DPP readiness

eSign.AI provides an end-to-end customer solution for the trust layer around DPP and eCoC: QSeal application and issuance support through its Registration Authority service and ANF AC integration, PAdES/XAdES/JAdES signing, qualified timestamps, SaaS/SDK/API connectivity, batch-oriented processing and long-term evidence retention.

For manufacturers, the practical advantage is one delivery path from organisation verification to recurring product-data signing. The customer can use the same QSeal foundation across eCoC and DPP onboarding, add long-term structured-data signatures where required, and connect the process to production systems without building a separate trust-service stack.

Complete the DPP series

Start with Part 1: Why Chinese Exporters Need to Prepare for the EU Digital Product Passport for scope, timelines and sector context.

Then read Part 2: DPP Deep Dive: How Companies Use It, Plan Usage, and Integrate for a practical operating and integration model.

Part 3: From eCoC to QSeal: How eSign.AI Supports DPP Readiness (this article)