The EU DPP Registry Is Live: What the Rulebook Actually Says

The EU DPP Registry stopped being a deadline and started being infrastructure. It went live on 20 July 2026, and on 6 August 2026 the binding rulebook that governs it, Commission Implementing Regulation (EU) 2026/1778, entered into force. Anyone building Digital Product Passports now has something concrete to build against for the first time.

This post covers what the registry actually does, what the implementing regulation requires of you, and the one sentence in the ESPR that most vendors would rather you did not read.

What the registry is, and what it is not

It is an index, not a database of your product data. The registry stores unique identifiers and metadata about where a passport lives. The passport payload itself stays decentralised, held by the economic operator or by a DPP service provider acting for it. If you were expecting to upload your material compositions to Brussels, you were not reading the same regulation.

One registry serves several regimes at once: ESPR delegated-act products, batteries under Reg. (EU) 2023/1542, construction products under Reg. (EU) 2024/3110, toys under Reg. (EU) 2025/2509 and detergents under Reg. (EU) 2026/405 (IR 2026/1778 Art. 1(1)). For a platform, that means one integration covers many verticals. For a manufacturer with a mixed catalogue, it means one place to look.

What Implementing Regulation (EU) 2026/1778 requires

This is the part worth reading closely, because it is binding and specific.

• Verification with an eIDAS seal (Arts. 4-5). A legal person verifies itself with a qualified electronic seal; a natural person uses a qualified electronic signature or a high-assurance eID. The verification is valid for at most three years, then it has to be redone.
• Granularity is a first-class field (Art. 8). Registration happens at model, batch or item level, whichever the applicable law requires, with parent identifiers submitted where they exist. Battery passports are item level. Toy passports are model level. This is not a detail you can retrofit later.
• Automatic validation (Art. 8(7)-(8)). The registry rejects submissions that fail semantic conformity, data coherence, granularity, commodity code or the link to your DPP service provider. You get a unique and persistent registration identifier back.
• Proof of registration (Art. 9). Contains the unique product identifier, the commodity code, the verified operator identity, a timestamp, and a hash of the registered version of the passport, sealed under Art. 38 of Reg. (EU) No 910/2014. It is available for 90 days.
• Ten-year deletion (Art. 10(3)). Registry records are deleted after ten years. Note that this is a registry retention rule, not a passport retention rule. There is no horizontal 10-year passport retention requirement in ESPR; Art. 9(2)(i) leaves the availability period to product-specific delegated acts, requiring only "at least the expected lifetime".

Who does the registering, and with whose identity

This is where a lot of platform marketing quietly overstates itself. Registration is the customer's own act, performed with the customer's eIDAS credential. A platform can prepare, structure and submit the data, and most manufacturers will never call the API by hand. But your legal identity is not something a SaaS can supply on your behalf, and whether a service provider may broker or hold those credentials at all is an open question that IR 2026/1778 does not resolve.

There is a related wrinkle for batteries. DG GROW has said that DPP service providers are not an actor in the battery regime. The mechanism there is a written authorisation under Art. 77(4) of the Battery Regulation for another operator to act on the responsible operator's behalf. Different regime, different contract wording.

The standards picture, honestly

On 15 July 2026 Commission Implementing Decision (EU) 2026/1736 cited EN 18216, 18219, 18220, 18221, 18222 and 18223:2026 in the Official Journal. Conformity with those gives a presumption of conformity with ESPR Arts. 10 and 11 under Art. 41(2). They cover data exchange protocols, identifiers, data carriers, storage and persistence, APIs and system interoperability.

Two standards are conspicuously not cited: EN 18239 on access rights, security and business confidentiality, and EN 18246 on data authentication, reliability and integrity. That means no presumption of conformity attaches to the access-control or integrity layer today. If you are choosing a platform, ask how adjustable its access tiers are, because that layer is still moving.

A caution on the carrier standards: EN 18219 and EN 18220 are paywalled. We have not bought the texts, so we make no claims about their specific requirements for symbology, error correction, quiet zones or RFID. Be sceptical of anyone who does without citing the clause.

The nearest binding date is not a passport date

On 27 September 2026, five weeks from now, Directive (EU) 2024/825 applies. It inserts into UCPD Annex I a ban on displaying a sustainability label that is not based on a certification scheme or established by public authorities (point 2a), a ban on generic environmental claims (4a), on whole-product claims derived from one aspect (4b), on offsetting-based climate-neutrality claims (4c), and on presenting legally required features as a distinctive advantage (10a).

A public passport page is a commercial communication aimed at consumers. If your passport tool stamps a green "compliant" badge on that page based on its own score, that badge becomes an unfair commercial practice in September. LabelEU does not put a self-issued compliance badge on the passports it hosts. Details are in our green claims explainer.

And while we are correcting the record: the separate Green Claims Directive proposal, COM(2023) 166, is not law. The Commission announced its intention to withdraw it on 20 June 2025 and we cannot verify that the withdrawal was formally completed. Either way there is nothing there to comply with. Do not let a vendor sell you a product against it.

Where the dates actually sit

For textiles, furniture and electronics there is still no adopted rule at all. The full picture, with sources, is in our deadline timeline.

What to do now that the registry is real

1. Decide your granularity before you generate identifiers. Model, batch or item is a structural choice, and the registry validates it. Batteries are item level, one passport per physical battery. Toys are model level. Getting this wrong means reissuing identifiers.
2. Sort out your eIDAS credential. A qualified electronic seal for your legal entity is a procurement task with a lead time, and it expires after three years. Start it before the month you need it.
3. Structure the product data. Material composition, origin, recycled content and supplier documentation are still the slow part, and no registry change makes that faster.
4. Audit your passport page against the September ban. Uncertified badges, "eco-friendly" phrasing, offset-based neutrality claims and legally required features dressed up as advantages all become unfair commercial practices on 27 September 2026.

Frequently asked questions