Digital Product Passport Requirements Checklist

What this checklist covers

A Digital Product Passport (DPP) is not just a QR code. It is a structured, machine-readable record with defined data fields, a physical carrier, tiered access rules, and a verification trail. This checklist walks through every block you need to satisfy under the ESPR framework and the Battery Regulation, so you can audit your own readiness before a delegated act forces the timeline.

The exact fields depend on each product group's delegated act. The categories below are the common backbone that ESPR Article 9 and Annex III establish, plus the battery-specific items.

1. Product identification and the data carrier

Every DPP starts with identity and a way to reach it.

• Unique product identifier - a persistent ID, typically built on GS1 standards (GTIN plus serial or batch where required).
• Data carrier - a QR code, NFC tag, or other machine-readable carrier physically on the product, packaging, or documentation.
• Resolver / link - the carrier resolves to the live passport, not a static PDF.
• Registry registration - where the relevant act requires it, the identifier is registered in the EU registry.
• Economic operator details - manufacturer, importer, or authorised representative responsible for the passport.

2. Mandatory data fields

The common ESPR data backbone spans these categories. Your delegated act will specify which are mandatory versus recommended.

• Each mandatory field is populated with verifiable data, not placeholders.
• Units and methodologies are stated (for example, kg CO2e and the calculation standard).
• Data is machine-readable and interoperable, not free text only.

3. Access tiers

Not all DPP data is public. The model is tiered transparency, also called role-based access. Plan which audience sees what:

• Public - basic identity, headline sustainability data, end-of-life guidance. No login.
• Legitimate-interest actors - repairers, recyclers, and others with a defined need get deeper data.
• Authorities and notified bodies - market surveillance authorities and the Commission get the fullest access, including commercially sensitive fields.

The Battery Regulation's Annex XIII is the clearest worked example of this tiered structure. Design your data model so that sensitive fields are gated, not exposed.

4. Verification and data integrity

A passport is only as trustworthy as the data behind it.

• Source traceability - each field can be traced to a supplier disclosure, test report, or system of record.
• Versioning - changes are logged so you can show what the passport said at any point in time.
• Update obligations - dynamic fields (for batteries, state of health) are kept current through life.
• Third-party verification - where required, an independent assessment confirms the data.
• Retention - the passport remains available for the legally required period, including after the product leaves the market.

Our compliance audit runs exactly these checks against your current data and flags the gaps.

5. Battery-specific additions

If your product is an EV, LMT, or industrial battery above 2 kWh, the binding 18 February 2027 battery passport adds:

• Carbon footprint per kWh over the battery's useful life.
• State of health (SoH) - dynamic, unit-level data updated through use.
• Chemical composition and recycled-content figures for key materials.
• Due-diligence and sourcing information for critical raw materials.

These are detailed in our battery passport guide.

How to use this checklist

1. Inventory your products and map each to its likely delegated act or the Battery Regulation.
2. Score each product against the blocks above - green where you hold verifiable data, red where you do not.
3. Prioritise the red items with the longest lead time, usually supplier carbon data and material composition.
4. Assign owners for data collection, verification, and ongoing updates.
5. Choose tooling that can store, verify, gate, and serve the passport. Our DPP buying guide compares what to look for.

The hardest part is the data, not the QR code

Generating a QR code is trivial. Gathering verifiable carbon, material, and sourcing data across a multi-tier supply chain is the real work, and it is where most timelines slip. Start the data collection now, even before your act is final, because the fields above will not change much regardless of the exact delegated act wording.

Where DPPAutomate fits

DPPAutomate turns this checklist into a workflow: it collects supplier data, validates each field against the requirements, enforces the access tiers, maintains the verification trail, and generates the carrier and passport. You work from a live readiness score instead of a spreadsheet.

Ready to score your products against this checklist? Start a free audit or read the DPP buying guide.