'%3e%3cpath%20fill-rule='evenodd'%20clip-rule='evenodd'%20d='M6.99935%2012.8327C10.221%2012.8327%2012.8327%2010.221%2012.8327%206.99935C12.8327%203.77769%2010.221%201.16602%206.99935%201.16602C3.77769%201.16602%201.16602%203.77769%201.16602%206.99935C1.16602%2010.221%203.77769%2012.8327%206.99935%2012.8327Z'%20stroke='%23666666'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20d='M1.16602%207H12.8327'%20stroke='%23666666'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20fill-rule='evenodd'%20clip-rule='evenodd'%20d='M6.99935%2012.8327C8.28802%2012.8327%209.33268%2010.221%209.33268%206.99935C9.33268%203.77769%208.28802%201.16602%206.99935%201.16602C5.71068%201.16602%204.66602%203.77769%204.66602%206.99935C4.66602%2010.221%205.71068%2012.8327%206.99935%2012.8327Z'%20stroke='%23666666'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20d='M2.875%202.95898C3.93063%204.01461%205.38896%204.66754%206.99978%204.66754C8.61062%204.66754%2010.069%204.01461%2011.1246%202.95898'%20stroke='%23666666'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20d='M11.1246%2011.0425C10.069%209.98691%208.61062%209.33398%206.99978%209.33398C5.38896%209.33398%203.93063%209.98691%202.875%2011.0425'%20stroke='%23666666'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_1267_9109'%3e%3crect%20width='14'%20height='14'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Regulation (EU) 2024/1781
What ESPR requires for Digital Product Passport data
The EU's Digital Product Passport Regulation, adopted under the Ecodesign for Sustainable Products Regulation (ESPR), requires manufacturers, importers, and supply chain partners to create and maintain a digital record for each product placed on the EU market. These records must be authentic, tamper-evident, and traceable — which places new demands on the digital signing infrastructure that organisations use to issue and verify product data.
DPP first delegating acts in force
Scope: physical goods on the EU market
Digital signatures required for data integrity
What the Digital Product Passport requires
A DPP is a structured digital record that carries product information across its entire lifecycle — from manufacturing to repair, reuse, and disposal. The regulation specifies that this data must be authentic, secure, and verifiable.
Each product (or batch) receives a unique identifier. Data is linked to this ID through a standardised data carrier — typically a QR code, RFID tag, or NFC chip.
Product data must be signed by an authorised representative of the manufacturer or importer. The signature must ensure data origin authenticity and detect post-issuance tampering.
Different actors in the supply chain (manufacturers, importers, distributors, repairers, recyclers) have different read and write permissions. Data access must be controlled and auditable.
The DPP persists across the product's entire lifecycle. Updates, transfers, and retirements must be signed and logged, creating a continuous chain of custody.
Digital signature requirements for DPP data
The DPP regulation does not prescribe a single signature format, but it requires signatures that meet the evidentiary standards of eIDAS for data integrity and authenticity. Here's how the requirements map to eIDAS signature levels.
| DPP requirement | eIDAS mapping | |
|---|---|---|
| Data authenticity | Manufacturer must prove data origin | Advanced Electronic Signature (AES): uniquely linked to signer, capable of identifying signer |
| Data integrity | Tamper must be detectable | Technical and organisational controls that make unauthorised changes detectable; a digital signature or seal may be one implementation option |
| Non-repudiation | Signer cannot deny having signed | Evidence appropriate to the actor and use case; where a regulated workflow requires strong attribution, a qualified signature or seal may be considered |
| Timestamp | Signing moment must be provable | Qualified electronic timestamp per eIDAS Article 41 |
| Long-term validation | DPP persists for product lifecycle (years/decades) | PAdES/XAdES Long-Term Validation (LTV) format recommended |
| Machine-verifiable | Regulators and supply chain partners must verify automatically | Standardised signature formats (PAdES, XAdES, JAdES) enable automated verification |
How DPP signing connects to enterprise PLM and ERP systems
Manufacturers placing products on the EU market
The primary obligation falls on the manufacturer (or the importer for non-EU manufacturers). They must create the DPP, sign the data, and ensure it remains accessible throughout the product lifecycle.
Supply chain partners
Importers, distributors, and authorised representatives have obligations to verify DPP presence and relay data. Repairers and recyclers may have write access to update specific DPP fields — these updates must also be signed.
Non-EU exporters to the EU
Companies outside the EU may need to coordinate DPP responsibilities with an EU importer or authorised representative. The relevant delegated act and product-specific rules determine who creates, updates, and can access the passport; eIDAS tools may support evidence, but ESPR does not impose a universal QES requirement.
IT and signing infrastructure owners
Teams responsible for identity, access control, data provenance, signing APIs, and records must ensure that DPP data remains authentic, reliable, available, and protected against unauthorised change. The control set should follow the applicable delegated act and system architecture.
How signing teams should prepare
DPP readiness is a data-governance and systems exercise. Signing or sealing may be useful controls, but teams should begin with the applicable product rules, data responsibilities, access rights, and evidence requirements.
Inventory affected product lines
Identify which products your organisation places on the EU market and map them to the relevant DPP delegating acts. Priority sectors include batteries, textiles, electronics, construction products, and furniture.
Assess current signing capabilities
Map how the system authenticates data contributors, controls updates, detects changes, records provenance, and preserves evidence. Where digital signatures or seals are selected, confirm the required format, certificate status, timestamping, and validation period.
Engage a QTSP
If the risk assessment or a product-specific rule calls for qualified trust services, verify the exact service on the EU Trusted Lists and test certificate issuance, automation, throughput, revocation checking, and long-term validation.
Design the DPP signing workflow
Map the full lifecycle: creation (manufacturer signs), updates (supply chain partners sign amendments), transfers (ownership changes require new attestations), and retirement (final decommissioning signature).
Plan for long-term archival
DPPs must persist for the product's entire lifecycle — potentially decades. Ensure your signature format supports Long-Term Validation, and plan for cryptographic algorithm migration as old algorithms weaken over time.
Manufacturer action plan for DPP compliance
Manufacturers placing products on the EU market must prepare for DPP requirements under the ESPR.
Audit product scope
Determine which of your products fall under the ESPR DPP requirements. The first product categories with mandatory DPP are batteries (from 2027), followed by textiles, electronics, and construction materials. Check the EU Commission delegated acts for your product category.
Map data sources
Identify where the required DPP data lives in your organisation: ERP for materials and bill of materials, PLM for specifications, LCA tools for environmental impact, supply chain management for supplier data. Plan how to aggregate this data into the DPP format.
Provision signing capability
Choose controls proportionate to the use case. If an organisational seal is selected, obtain the appropriate certificate from a verified provider, configure secure key use, and test sealing and validation with representative product data.
Register with the EU DPP system
Prepare the passport and data carrier according to the applicable delegated act and the technical interfaces available for the product group. ESPR provides for a DPP registry and unique identifiers, but implementation teams should not assume a universal submission workflow before the relevant specifications are final.
Common questions from compliance teams
The DPP regulation requires data authenticity and integrity but does not explicitly mandate QES for every record. However, eIDAS-aligned QES provides the strongest legal presumption of authenticity and non-repudiation, which is valuable when product data is challenged in disputes or regulatory inspections. Many organisations are adopting QES as a risk-management choice rather than a strict legal minimum.
How eSign.AI can support DPP evidence workflows
eSign.AI can support electronic-signature and digital-seal steps within a broader DPP evidence workflow. The customer remains responsible for confirming the applicable product rules, registry interfaces, trust-service configuration, and system integrations.
Qualified electronic seal via API
Where a deployment includes an organisational seal, an enterprise system can invoke a configured signing service through an API. Before production use, verify the certificate holder, trust-service provider, key custody, throughput, revocation handling, and audit evidence.
ERP and PLM integration
ERP, PLM, MES, and supplier systems can provide source data to an integration layer, while eSign.AI handles the configured signing or sealing step. Connector availability, field mapping, delegated-act schemas, and registry submission must be validated for the customer's actual environment.
Multi-party supply chain signing
DPP data often comes from multiple parties. A workflow can capture who supplied or approved each contribution and preserve associated evidence. Whether every contributor should sign or seal its data is an architecture and legal decision, not a general ESPR requirement.
Audit-ready evidence
Every DPP submission generates a complete evidence package: sealed data payload, QSeal certificate chain, timestamp token, and EU registry submission receipt. This evidence is stored for the product retention period and can be exported for market surveillance audits.
