The digital product passport regulation in Europe is Regulation (EU) 2024/1781, the Ecodesign for Sustainable Products Regulation, known in German as the Ökodesign-Verordnung. It names six economic operator roles in Article 2, then spends eleven articles telling each of them what it owes. The duty does not land on a company because it makes things. It lands because of what that company does with a product on the EU market, and it can move to a different party in one commercial decision.
The DPPAutomate team read the obligations articles of the ESPR, Regulation (EU) 2019/1020 on market surveillance and Regulation (EU) 2023/1542 on batteries directly on eur-lex.europa.eu, and checked the Commission's Digital Product Passport pages, on 27 August 2026. Every duty below is cited to the article it comes from. Where the answer depends on a delegated act that does not exist yet, this article says so instead of guessing.
Which party, not which product
Two questions get blurred constantly. The first is which products need a digital product passport, and our companion guide Which Products Need a DPP? answers it product group by product group.
This article answers the second: given a product in scope, which party carries the duty. Manufacturer, authorised representative, importer, distributor, dealer, fulfilment service provider, online marketplace provider, and the non-EU seller who assumes none of it reaches them.
How EU product law decides who is responsible
Four ideas run underneath every role assignment.
1. The trigger is placing on the market, not manufacturing. Article 2 defines "placing on the market" as the first making available of a product on the Union market, and "making available" as any commercial supply there, paid or free. Article 9(1) makes a passport a condition of that act. Nothing in that chain asks where the company is registered.
2. Roles are functions, not job titles. Article 2 defines a manufacturer as anyone who makes a product, or has it made, and markets it under their own name or trademark; an importer as anyone established in the Union placing a third-country product on the Union market; a distributor as anyone else in the chain making it available. The transaction picks your role, not your org chart.
3. The framework sets the duty, the delegated act sets the content. Article 9(2) provides that each product group's delegated act specifies the data, the data carrier, whether the passport sits at model, batch or item level, who may access it, and in point (g) the actors that are to create a digital product passport or update the data in it. That last answer arrives with your delegated act, not before it.
4. The role can change hands. Article 34 is titled "Cases in which obligations of manufacturers apply to importers and distributors." Put your brand on someone else's product and you become the manufacturer for the purposes of the Regulation.
Responsibility by role: who owes what, and under which article
Every duty below is drawn from the article named in its row. The last column reflects Articles 69, 71 and 74 of Regulation (EU) 2024/1781, set out further down.
One qualifier applies to the whole table. Every ESPR row describes a duty that attaches to "a product covered by a delegated act adopted pursuant to Article 4." Batteries bind today under their own regulation, and toys, construction products and detergents have their own instruments. For the remaining ESPR product groups no delegated act had been adopted when we checked on 27 August 2026, so those rows describe the duty you will carry, not a duty that is enforceable against you this morning.
| Role | What triggers it | Core passport duty | Article | If the passport is missing or wrong |
|---|---|---|---|---|
| Manufacturer | Makes the product, or has it made, and markets it under its own name or trademark | Ensure a passport is available before placing on the market, plus a back-up copy held by a DPP service provider | 2024/1781 Art 27(1)(c), 9(1), 10(4) | Corrective action, withdrawal or recall without undue delay, and notify market surveillance authorities, Art 27(8) |
| Authorised representative | Written mandate from the manufacturer; must be established in the Union | Mandated tasks only. Art 27(1) and drawing up technical documentation cannot be mandated to it | 2024/1781 Art 28(1), 28(2) | Must cooperate with authorities and terminate the mandate if the manufacturer breaches, Art 28(2)(b) and (d) |
| Importer | Established in the Union, places a third-country product on the Union market | Verify the passport exists under Art 9 before placing on the market, and add its own name, address and electronic contact to the public part of the passport | 2024/1781 Art 29(2)(c), 29(3) | May not place it on the market until it conforms. Absent, false or incomplete Art 29(3) details are formal non-compliance, Art 71(1)(g) |
| Distributor | Makes the product available, other than manufacturer or importer | Verify the product is linked to a passport where the delegated act requires it, and that manufacturer and importer identification duties were met | 2024/1781 Art 30(2)(a), 30(2)(c) | Must not make it available until it conforms, Art 30(3); must ensure corrective action, Art 30(4) |
| Dealer | Offers products to end users for sale, hire or hire purchase, distance selling included | Ensure the passport is easily accessible to customers and potential customers, including in distance selling | 2024/1781 Art 31(2), via Art 9(2)(e) | Enforcement against the offer itself, including content removal orders, Art 35(2) |
| Fulfilment service provider | Offers at least two of warehousing, packaging, addressing, dispatching without owning the goods | Handling conditions must not jeopardise compliance. Becomes the responsible EU operator where no EU manufacturer, importer or authorised representative exists | 2024/1781 Art 33; 2019/1020 Art 3(11), 4(2)(d) | Inherits the Art 4(3) tasks of 2019/1020, including producing documentation on reasoned request |
| Online marketplace provider | Lets consumers conclude distance contracts with traders | Articles 11 and 30 of Regulation (EU) 2022/2065 apply; cooperate with authorities and run a single contact point for them | 2024/1781 Art 35(1), 35(3) | Ordered to act against or remove listings; that content counts as illegal content, Art 3(h) of 2022/2065 |
| Non-EU manufacturer, no EU establishment | Its products are placed on the EU market by someone | An EU-established operator must exist and be named: EU manufacturer, importer, authorised representative or fulfilment service provider, in that order | 2019/1020 Art 4(1), 4(2); 2024/1781 Annex III point (k), Art 36(1)(b) | No compliant route to market. Customs verification bites at release for free circulation, Art 15 |
| Private-label importer or distributor | Sells under its own name or trademark, or modifies the product so compliance is affected | Treated as the manufacturer, so the full Art 27 set applies, passport included | 2024/1781 Art 34(a), 34(b) | The whole manufacturer consequence set, including 10-year retention, Art 27(3) |
| Battery: operator placing on the market | Places an LMT, EV or industrial battery above 2 kWh on the market from 18 February 2027 | Ensure battery passport information is accurate, complete and up to date; may authorise another operator in writing | 2023/1542 Art 77(1), 77(4) | Battery-specific enforcement, plus Art 44 reassignment to private-label importers and distributors |
Manufacturers: the party that must make the passport exist
Article 27(1) is the load-bearing provision: when placing a covered product on the market, manufacturers must ensure a digital product passport is available in accordance with Article 9, including a back-up copy of the most up-to-date version stored by a digital product passport service provider in accordance with Article 10(4).
The back-up copy is not the same file as the live passport, and Article 11(e) requires the passport to stay available for the period the delegated act sets even after insolvency, liquidation or cessation of activity in the Union of the operator that created it. Article 27(6) puts the manufacturer's name, address and electronic contact on the public part of the passport as well as on the product.
Article 27(10) sets the deadline nobody plans for: on a reasoned request from a competent national authority, everything needed to demonstrate conformity must be produced within 15 days. The same window binds authorised representatives under Article 28(2)(c), importers under Article 29(8) and distributors under Article 30(5).
Authorised representatives: what a mandate can and cannot carry
Article 2 defines an authorised representative as a person established in the Union holding a written mandate from the manufacturer. Article 28(1) draws the line non-EU manufacturers get wrong: "The obligations laid down in Article 27(1) and the drawing up of technical documentation shall not form part of the authorised representative's mandate."
Article 27(1) is the article containing the passport obligation, so appointing a representative does not move that duty. What the mandate must cover under Article 28(2) is document retention for 10 years, cooperation with national authorities, reasoned requests answered within 15 days, and termination if the manufacturer acts contrary to its obligations. Article 5(3) of Regulation (EU) 2019/1020 adds that the representative must have the appropriate means to perform its tasks, which a nameplate on a serviced office does not.
Importers: the verification duty you inherit at the border
Article 29 gives importers a verification duty rather than a creation duty, then makes them visible on the artefact. Before placing a covered product on the market, Article 29(2) requires the importer to ensure the manufacturer carried out the conformity assessment and drew up the technical documentation, and that a passport is available under Article 9 including the Article 10(4) back-up copy.
Article 29(3) then requires the importer's own name, address and electronic contact on the public part of the digital product passport and on the product, packaging or accompanying document, and Annex III point (j) lists importer information including the EORI number among the data a passport may carry. Article 71(1)(g) makes absent, false or incomplete Article 29(3) information a finding of formal non-compliance on its own, whether or not the product is technically sound.
Distributors and dealers: due care and access
Article 30(1) sets a lighter standard for distributors: act with due care in relation to the applicable delegated acts. Article 30(2) makes it concrete. Before making a product available, verify it carries the CE marking and, where relevant, is labelled or is linked to a digital product passport in accordance with that delegated act, and that the manufacturer and importer met Articles 27(5), 27(6) and 29(3).
Dealers get their own article. Article 31(2) requires the passport to be easily accessible for customers and potential customers, including in the event of distance selling, and Article 2 defines a dealer broadly enough to cover most retailers and webshops. Article 10(3) makes that workable: the operator placing the product on the market must give dealers and online marketplace providers a digital copy of the data carrier or unique product identifier, free of charge, within five working days of a request.
Fulfilment service providers and online marketplaces
This is where "our marketplace handles it" breaks.
Fulfilment service providers. Article 2 of the ESPR imports the definition from Article 3(11) of Regulation (EU) 2019/1020: a person offering at least two of warehousing, packaging, addressing and dispatching without owning the goods, excluding postal, parcel-delivery and freight services. Article 33 gives them a narrow duty about handling conditions. Article 4(2)(d) of Regulation (EU) 2019/1020 does something much larger: where no EU-established manufacturer, importer or authorised representative exists, the EU-established fulfilment service provider becomes the responsible economic operator for the products it handles and inherits the Article 4(3) tasks.
Online marketplaces. Article 35(1) applies Articles 11 and 30 of Regulation (EU) 2022/2065 for ESPR purposes. Article 11 is "Points of contact for Member States' authorities, the Commission and the Board"; Article 30 is "Traceability of traders," which obliges platforms to collect trader identity data before a trader may offer products to consumers in the Union. Article 35(3) adds a single contact point for market surveillance authorities.
Read what is not in that list: none of it makes the marketplace create, populate or host your passport. Article 35(2) requires Member States to empower authorities to order a marketplace to act against listings referring to a non-compliant product, and treats such content as illegal content within the meaning of Article 3(h) of Regulation (EU) 2022/2065. The marketplace's realistic role in your non-compliance is deleting your listing, not fixing your data.
Article 6 of Regulation (EU) 2019/1020 closes the loop: products offered through distance sales are deemed made available on the market if the offer is targeted at end users in the Union. Shipping from outside the EU does not put you outside the EU market.
When an importer or distributor legally becomes the manufacturer
Article 34 is two lines long and reassigns everything. An importer or distributor is considered a manufacturer where they place a covered product on the market under their name or trademark, or modify a product already on the market in a way that affects compliance. Point (a) captures every private-label programme in European retail; point (b) captures kitting, re-configuration, firmware changes and repackaging that touch a compliance-relevant characteristic. Once it bites, the full Article 27 set applies, passport and back-up copy included. Article 44 of Regulation (EU) 2023/1542 does the same for batteries, with a third trigger the ESPR lacks: modifying the purpose of a battery already on the market.
Selling into the EU from the UK, Switzerland or a third country
The obligation follows the product onto the EU market, not the company's letterhead. A manufacturer in Manchester, Zurich, Chicago or Shenzhen whose goods reach an EU customer is inside the scope of the European digital product passport rules, and the only real question is which EU-established party carries the paperwork.
The controlling provision is Article 4(1) of Regulation (EU) 2019/1020: a product subject to the legislation listed in Article 4(5) may be placed on the market only if there is an economic operator established in the Union responsible for the tasks in Article 4(3). Article 4(2) lists who that can be, in a fixed order of substitution. Article 4(5) lists Directive 2009/125/EC among the covered instruments; Article 79(1) of the ESPR repealed that Directive with effect from 18 July 2024, and Article 79(3) provides that references to it are construed as references to the ESPR per the correlation table in Annex VIII.
The ESPR then makes that operator visible twice. Article 36(1)(b) requires the offer itself, in distance selling where the manufacturer is not established in the Union, to show that operator's name, postal and electronic address and telephone number. Annex III point (k) requires its name, contact details and unique operator identifier inside the passport.
| Route into the EU | Who becomes the responsible EU operator | What the non-EU manufacturer keeps |
|---|---|---|
| Sell to an EU importer | The importer, 2019/1020 Art 4(2)(b) and ESPR Art 29 | All of ESPR Art 27(1), including making the passport exist |
| Appoint an authorised representative | The representative, 2019/1020 Art 4(2)(c) and Art 5 | Art 27(1) and technical documentation, which ESPR Art 28(1) bars from the mandate |
| Ship direct via an EU fulfilment centre | The fulfilment service provider, 2019/1020 Art 4(2)(d), where none of the above exists | Art 27(1), with a partner that did not price this duty into its fee |
| Establish an EU entity | That entity, 2019/1020 Art 4(2)(a) | Art 27(1) moves inside the group and the operator identifier is yours |
Digital Product Passport UK: what a UK seller actually owes
There is no Great Britain requirement to comply with today. The UK Department for Business and Trade published a call for evidence on digital product records policy on 27 July 2026 stating that "with respect to Great Britain, the UK government has not yet determined its approach to DPRs." The same document confirms the two facts UK exporters need: the EU regime "mandates that certain products on the EU and Northern Ireland market should carry an EU DPP," and "UK businesses exporting to the EU, or selling in Northern Ireland, will need to comply with ESPR's requirements." The Northern Ireland limb runs through the Windsor Framework, so a UK business can be inside the EU regime without shipping across the Channel.
So the answer has two halves. For goods sold in Great Britain: no EU obligation, and no UK equivalent adopted at the time of writing. For goods sold into the EU or in Northern Ireland: the ESPR applies exactly as it does to a French or Polish manufacturer, and a UK manufacturer needs an EU-established responsible operator under Article 4(2) of Regulation (EU) 2019/1020.
Switzerland and other third countries
Switzerland is neither an EU nor an EEA member, so a Swiss manufacturer placing goods on the EU market is a third-country manufacturer under Article 2 of the ESPR, which defines an importer as a person established in the Union placing a third-country product on the Union market. The same reading applies to US, Turkish, Indian and East Asian manufacturers. The route matters, not the postcode: distributor networks usually put an EU importer in the chain, direct-to-consumer webshops usually do not.
Third-country sellers underestimate one enforcement point. Article 15(1) requires anyone placing a covered product under the customs procedure "release for free circulation" to give customs the unique registration identifier from Article 13(5), and Article 15(2) allows release only after customs verify that the identifier and commodity code match the registry. Article 13(4) makes the registry upload the duty of the economic operator placing the product on the market. The Commission launched the Digital Product Passport Registry on 20 July 2026, with a testing environment.
The rules for using it are now written down, and they change who can act. Commission Implementing Regulation (EU) 2026/1778 of 16 July 2026, in force since 6 August 2026, lays down the registry's implementation arrangements. Article 8(1) requires the passport to be registered by a verified economic operator placing the product on the market, at the granularity the delegated act sets. Article 4 defines "verified" through eIDAS: a legal person qualifies by submitting evidence of identity, and of establishment where establishment is required, via a qualified electronic seal or a qualified electronic attestation of attributes. Article 4(4) makes that status expire when the electronic identification means expires or after three years, whichever comes first, and until the operator re-verifies it can register nothing new and modify nothing. Article 19(4) lets a third party act in the registry on the operator's behalf, after that third party is itself verified, but the operator "shall remain fully responsible for compliance." Article 19(1) and 19(2) put accuracy and completeness on the operator at registration and keep them there.
One more provision repays a compliance lead's attention. Article 9 lets the registering operator generate a proof of registration: a time-stamped document under a qualified electronic seal that serves as evidence, including against third parties, that the registration obligation was met, available for 90 calendar days from generation.
Which EU-established operator sits behind each product line, and its unique operator identifier for Annex III point (k), is the record that breaks in a spreadsheet the first time a distributor changes. In DPPAutomate that operator is a field on the workspace, and it travels with every passport issued under it.
What happens when the passport is missing or wrong
Three mechanisms bite, and only one of them is a fine.
Formal non-compliance, Article 71. Article 71(1) lists findings that oblige a Member State to require the operator to end the non-compliance: no CE marking, no declaration of conformity, technical documentation unavailable, incomplete or containing errors, Article 27(6) or Article 29(3) information that is absent, false or incomplete, and in point (h) any other administrative requirement under Article 27, Article 29 or the applicable delegated act that is not fulfilled. Article 71(2) escalates to restriction, prohibition, recall or withdrawal where it persists.
Corrective action and notification. Articles 27(8), 29(6) and 30(4) each require the operator, on reason to believe a product does not conform, to act without undue delay and immediately inform the market surveillance authorities of every Member State where the product was made available.
Penalties, Article 74. Member States set the rules. Article 74(1) requires them to be effective, proportionate and dissuasive, Article 74(2) lists the factors including the economic benefit derived from the infringement, and Article 74(3) requires Member States to be able to impose at least fines and time-limited exclusion from public procurement procedures. The ESPR sets no EU-wide percentage-of-turnover figure, so any number you have seen quoted comes from national law or a different instrument.
None of this depends on intent, or on knowing you were the responsible party. The 15-day evidence window starts when the reasoned request arrives, not when your data model is finished. Holding supplier declarations, passport versions and lifecycle events in one place, with a read-only window you can point an authority at, is the difference between answering that request and asking for an extension.
Is the digital product passport mandatory yet, and for whom?
For batteries, yes, and the date is in the instrument. Article 77(1) of Regulation (EU) 2023/1542 requires a battery passport from 18 February 2027 for each LMT battery, each industrial battery above 2 kWh and each electric vehicle battery placed on the market, and Article 77(4) puts accuracy, completeness and currency on the economic operator placing the battery on the market. That makes 2027 the first live digital product passport deadline in Europe; our battery passport pillar and the EU Battery Regulation 2027 deadline tracker cover it.
For ESPR product groups, on 27 August 2026 the framework is in force and the group obligations are not. Article 9(1) conditions placing on the market on a passport, but only "in accordance with the applicable delegated acts adopted pursuant to Article 4," and the Commission's Digital Product Passport page, checked the same day, still describes those delegated acts as foreseen and labels its schedule "indicative and subject to publication requirements." No binding ESPR passport date exists for textiles, furniture, electronics, tyres or packaging until that group's delegated act is adopted.
Some product groups do not wait for an ESPR delegated act, because their own instrument carries the requirement. Article 1(1) of Commission Implementing Regulation (EU) 2026/1778 names construction products under Article 76 of Regulation (EU) 2024/3110, toys under Article 19 of Regulation (EU) 2025/2509, and detergents and end-user surfactants under Article 21 of Regulation (EU) 2026/405 as registry-covered alongside batteries. Check the instrument that governs your product before you assume the ESPR timetable is the one that binds you. Our DPP timeline tracks what has landed, and the digital product passport requirements checklist covers what a passport has to contain once it does.
What to do if you have just realised this is you
Six steps, in order. The first is not software.
- Classify your role per product line, not per company. Apply the Article 2 definitions literally. One legal entity is routinely the manufacturer for its own brand, an importer for a sourced range and a distributor for a resold one, with different duties on each.
- Run the Article 34 test over your private label. For every SKU sold under your name or trademark, or modified after being placed on the market, assume the full manufacturer set applies until you can show it does not. This is the most common reassignment and the most expensive one to find late.
- Name your EU-established responsible operator in writing. Work down Article 4(2) of Regulation (EU) 2019/1020: EU manufacturer, importer, authorised representative, fulfilment service provider. If nobody in your chain fits and you ship into the EU, you have a gap, not an opinion. Check the mandate covers the Article 4(3) tasks and that the Article 5(3) means exist.
- Confirm delegated-act status per product group. For batteries, work to 18 February 2027 under Article 77(1) of Regulation (EU) 2023/1542. For ESPR groups, watch for adoption, because Article 9(2)(g) is what will name the actors that create and update the passport for your products. Check whether your group is instead covered by its own instrument, as construction products, toys and detergents already are.
- Fix the contracts you assumed covered this. Ask your marketplace in writing what it does under Articles 11 and 30 of Regulation (EU) 2022/2065 and what it does not. Ask your fulfilment partner whether it accepts the Article 4(2)(d) position. Put into supplier terms the data you will need under Article 38 of the ESPR, which obliges supply chain actors to give manufacturers relevant information free of charge where the delegated act says so.
- Get verified for the registry, then build the 15-day evidence trail. Registry verification under Article 4 of Commission Implementing Regulation (EU) 2026/1778 needs a qualified electronic seal and lapses after three years, so start it before a deadline depends on it. Then hold unique product and operator identifiers under Article 12, the passport and its Article 10(4) back-up copy, technical documentation and the declaration of conformity on the Article 27(3) 10-year clock, and the registry upload under Article 13(4).
Conclusion: the duty follows the market, not the letterhead
Three decisions set your exposure. Which role each product line puts you in under Article 2 of Regulation (EU) 2024/1781. Whether Article 34 has quietly promoted you to manufacturer. And whether a mandated, EU-established operator stands behind every product you send into the Union under Article 4 of Regulation (EU) 2019/1020.
The rest is data work against a known date, and that is what DPPAutomate is for: issuing passports at scale, capturing the supplier declarations Article 38 makes you go and ask for, logging lifecycle events, and handing an auditor a read-only window instead of a folder of screenshots. It does not make you compliant, and no software can. It gives you the record an authority asks for, inside the 15 days the Regulation allows.
Not sure the rules reach your products yet? Check your readiness in under five minutes, then start free in a Sandbox workspace.
This article is general information about EU product regulation, not legal advice. Delegated acts change what applies to your products and when. Confirm your own obligations against the current text of the instruments cited above, or with your legal counsel.
