Digital Product Passport (DPP): What It Is and Who Needs One

DPP in one paragraph

A Digital Product Passport (DPP) is a structured digital record that stores a product's identity, composition, compliance data, and sustainability information across its entire lifecycle — from raw material extraction to end-of-life recycling. Mandated by EU Regulation 2024/1781 (ESPR), the DPP is enforced through a central EU Registry: products without a valid passport cannot be placed on the EU market.

Feb 2027

First mandatory deadline — batteries

Jul 2026

EU DPP Registry live since

45.7%

Global market CAGR (2024–2030)

6 Aug 2026

Implementing Regulation in effect

What a DPP contains

A DPP links a unique product identifier to structured information maintained by the manufacturer. The EU Registry stores only an index — the full dataset remains on the operator's own servers, accessible via HTTPS.

01

A JTC 24-compliant HTTPS URL, max 50 characters, that locates the full DPP dataset on the manufacturer's server.

02

Substances, components, and materials used in manufacturing — enabling circularity and recycling decisions.

03

Environmental footprint, repairability attributes, and circularity information for regulators and consumers.

04

Conformity assessment results, CE marking references, and other regulatory approvals.

05

Current operator, ownership transfers, reuse status, and end-of-life handling data.

Regulatory framework and timeline

The DPP is established by the Ecodesign for Sustainable Products Regulation (ESPR), Regulation (EU) 2024/1781. Detailed rules are in Implementing Regulation (EU) 2026/1778, effective 6 August 2026.

Batteries first — February 2027

Under Regulation (EU) 2023/1542, all EV batteries, LMT batteries (e-bikes, scooters, motorcycles under 25 kg), and industrial batteries above 2 kWh must carry a valid Digital Battery Passport from 18 February 2027. Products without one will be blocked at EU customs.

Expansion from 2028

Textiles, footwear, steel, and aluminium follow in 2028. Electronics and household appliances in 2028–2029. Tyres, furniture, and mattresses in 2029–2030. The DPP framework will eventually cover nearly all physical products sold in the EU.

Registry status

The EU DPP Registry went live on 20 July 2026 at registry.product-passport.ec.europa.eu. Operator enrolment and sandbox testing are available now. Battery DPP registration modules are being activated — the gap between launch and the mandatory deadline is the integration window.

Where digital signatures enter the picture

Most DPP guides skip this. But qualified electronic signatures and seals are legal requirements embedded in the regulation.

Scenario 1: Operator registration (QSeal on PDF)

Before registering any product, a manufacturer must become a Verified Economic Operator. Step 4 of the 7-step enrolment requires applying a Qualified Electronic Seal (QSeal) — from a QTSP on the EU Trusted List — to a PDF declaration already bearing the European Commission's institutional seal. The result: exactly two signatures on one document. Certificate information must match the form data character-for-character, or automatic rejection.

Scenario 2: DPP content signing (XAdES-LTA)

Every product passport must be signed with a qualified signature. At production scale, this means XAdES-LTA or JAdES-LTA — the highest long-term archive level under eIDAS. ESPR requires DPP data to remain verifiable for up to 10 years. Standard certificates expire in 2–5 years; LTA embeds archive timestamps so signatures remain valid after certificates expire. LTA signatures receive automatic legal presumption under eIDAS Articles 35 and 41 across all 27 EU member states.

Registry vs customs verification

The DPP Registry does not validate signatures at submission — it checks structure, semantics, and link integrity. But customs authorities and market surveillance teams verify signatures during audits. Missing or invalid signatures are a legal violation, regardless of whether the Registry flagged them at upload time.

Who needs a DPP — and what it means for non-EU exporters

The DPP obligation applies to all products placed on the EU market, regardless of where they are manufactured. Non-EU exporters — battery makers in China, textile mills in Vietnam, electronics manufacturers in South Korea — must register as Verified Economic Operators, obtain a QSeal from a QTSP on the EU Trusted List, and complete the same enrolment flow as EU-based operators. Chinese organisations register with a 'CN'-prefixed national identifier; other non-EU operators use their respective country codes. The QSeal can be obtained directly from a QTSP or through a Registration Authority in the operator's home region. For battery manufacturers — CATL, BYD, SVOLT, CALB, Gotion, and hundreds of second-tier suppliers — the February 2027 deadline is fixed. The integration window is now.

DPP vs related concepts

01

A digital twin is a real-time virtual replica used for simulation and monitoring. DPP is a compliance record capturing regulatory data — not operational telemetry.

02

CE marking is a manufacturer's self-declaration of safety conformity. DPP covers lifecycle sustainability, materials, and circularity — CE data may appear inside a DPP.

03

A carbon label displays footprint to consumers. DPP includes carbon data but also covers materials, repairability, ownership, and end-of-life.

Common questions

18 February 2027 for EV, LMT, and industrial batteries above 2 kWh. Textiles and other categories follow from 2028. The obligation is tied to product placement on the EU market — not to EU origin.

How eSign.AI supports DPP compliance

eSign.AI operates as a Registration Authority for ANF AC (Spain), a QTSP on the EU Trusted List, providing QSeal issuance for operators across the Asia-Pacific region. The DPP compliance stack includes QSeal certificate issuance for operator registration, XAdES-LTA and JAdES-LTA signing APIs for DPP content files (batch signing of up to 100 DPPs per call, throughput exceeding 1,000 operations per minute), qualified timestamping embedded in LTA-level signatures, and PKCS#1 batch signing where only hash values leave the customer's server. For battery manufacturers targeting the 2027 deadline, the integration window between now and the battery DPP module activation is the optimal time for API setup and sandbox testing.

Qualified Electronic Seal (QSeal)SES, AES and QES: Signature Levels PAdES, XAdES and JAdES: Signature Formats