DPP standards: an overview

A digital product passport is a set of data about a product that can be reached electronically through a data carrier, such as a QR code, on the product or its packaging. The EU Ecodesign for Sustainable Products Regulation, ESPR (EU) 2024/1781, says what a passport must achieve. How a passport system is built to achieve it is described in a series of European standards from CEN and CENELEC.

This overview is for people responsible for product data, IT or compliance at a brand or manufacturer who want to know which standards exist, what their status is and how they fit together. Each standard has its own article that goes further.

Why the standards exist

ESPR sets out the passport requirements in two articles. Article 10 says, among other things, that the passport must be connected through a data carrier to a persistent unique product identifier, that the carrier must be physically present on the product, its packaging or accompanying documentation, and that the data must be based on open standards and be machine-readable, structured, searchable and transferable without vendor lock-in. Article 11 covers technical design and operation: passports must be fully interoperable, be stored by the economic operator or by a digital product passport service provider, remain available after an insolvency or liquidation, and data authentication, reliability and integrity must be ensured.

The regulation says what, not how. To fill that gap the Commission sent a standardisation request to CEN, CENELEC and ETSI in 2024: Implementing Decision C(2024) 5423 of 31 July 2024, amended by C(2025) 8024 of 28 November 2025. The request is known as M/604 and covers passports both for ecodesign and for batteries. The work was done in the joint technical committee CEN-CLC/JTC 24.

The reward for following the standards is in ESPR Article 41(2): a passport that conforms to harmonised standards whose references have been published in the Official Journal of the European Union (OJ) is presumed to meet the requirements of Articles 10 and 11, to the extent the standards cover them. This is called presumption of conformity.

The eight standards

JTC 24 has produced eight standards. Six were published in May 2026; SIS adopted them as Swedish standards on 27 May 2026. The two on security were adopted on 16 September 2026.

Standard	Subject	Cited in the OJ
EN 18216:2026	Data exchange protocols and data formats	Yes, 15 July 2026
EN 18219:2026	Unique identifiers for products, operators and facilities	Yes, 15 July 2026
EN 18220:2026	Data carriers	Yes, 15 July 2026
EN 18221:2026	Data storage, archiving and persistence	Yes, 15 July 2026
EN 18222:2026	APIs for passport lifecycle management and searchability	Yes, 15 July 2026
EN 18223:2026	System interoperability	Yes, 15 July 2026
EN 18239:2026	Access rights management, information system security and business confidentiality	No
EN 18246:2026	Data authentication, reliability and integrity	No

The numbers are not a continuous range. EN 18217 and EN 18218 are not part of the set, so writing "EN 18216–18223" counts two standards that do not belong and leaves out the two most recent. Cite them one by one.

Cited, or only published

A standard can be published without being cited. Publication is done by CEN-CENELEC and the national bodies, SIS in Sweden. Citation is done by the Commission, by publishing the standard's reference in the OJ, and only then does the presumption in Article 41(2) apply.

For the first six this happened through Commission Implementing Decision (EU) 2026/1736 of 14 July 2026, published in the OJ and in force on 15 July 2026. The Decision finds that EN 18216, EN 18219, EN 18220, EN 18221, EN 18222 and EN 18223 satisfy the requirements of Articles 10 and 11 of ESPR.

EN 18239 and EN 18246 are adopted but not cited. They give no presumption of conformity yet. Following them is a choice to use the committee's considered answer to the security and integrity requirements in Article 11, not a legal defence today.

CEN-CENELEC itself points out that harmonised standards remain voluntary. Nobody has to follow them. Anyone who chooses a different solution has to show in some other way that Articles 10 and 11 are met.

How they fit together

At the CEN-CENELEC webinar on 25 June 2026 the standards were presented in the order of what an economic operator has to do. That order makes a good map:

1. Create a unique identifier for the product: EN 18219.
2. Create a data carrier holding the identifier and attach it to the product: EN 18220.
3. Store the passport data for the product, at model, batch or item level: EN 18221. The levels themselves are defined in EN 18219.
4. Store a back-up with a service provider: also EN 18221.
5. Register the passport and make the data reachable through the identifier and an API: EN 18222.
6. Manage access and access rights: EN 18239.
7. Ensure the data is authentic and unaltered: EN 18246.

Two standards run through every step. EN 18216 sets the protocols and data formats systems use to exchange passport data. EN 18223 provides the common information model, the metadata models and the rules for using them when data models for a product group are developed, so that passports from different systems can be read the same way.

1. 1Create a unique identifier for the productEN 18219
2. 2Attach a data carrier holding the identifierEN 18220
3. 3Store the passport data at model, batch or item levelEN 18221
4. 4Store a back-up with a service providerEN 18221
5. 5Register the passport; reach the data via identifier and APIEN 18222
6. 6Manage access and access rightsEN 18239not cited
7. 7Ensure the data is authentic and unalteredEN 18246not cited

Through every stepEN 18216 protocols and data formatsEN 18223 information model, metadata and rules

All eight are product-agnostic. They do not say what a sweater, a battery or a sofa must carry in its passport. That is set in the delegated acts per product group, which under ESPR Article 9(2) specify, among other things, the data to include, the data carrier to use, whether the passport is at model, batch or item level, and how long it must remain available.

The standards underneath

The European standards build on older identification and symbology standards, and the legal texts name some of them directly.

• ISO/IEC 15459 covers unique identification and the registration of issuing agencies. ESPR Annex III says the data carrier and the identifiers must comply with ISO/IEC 15459-1 to -6 where relevant, and ESPR Article 10(1)(c) keeps those standards in force until harmonised standards are published in the OJ. Battery Regulation Article 77(3) requires the same for the battery passport's QR code and identifier.
• GS1 Digital Link turns a GTIN, with variant, batch and serial number, into a web address. EN 18219 refers to GS1 Digital Link for users of GS1 Application Identifiers.
• IEC 61406 Identification Link describes an identifier that is both a unique identity and a link, with no issuing agency needed.
• The QR code is specified in ISO/IEC 18004. EN 18220 requires the 2024 edition; the Battery Regulation's recitals refer to the 2015 edition. More on codes and tags in the article on EN 18220.

Batteries have their own rules

The battery passport comes from the Battery Regulation (EU) 2023/1542, not from ESPR. Under Article 77(1), each LMT battery, each industrial battery with a capacity above 2 kWh and each electric vehicle battery placed on the market from 18 February 2027 must have a battery passport. Portable and SLI batteries are outside the passport requirement. The passport is reached through the QR code required by Article 13(6), and under Article 77(3) the code and the identifier must comply with ISO/IEC 15459-1 to -6 or their equivalent.

Article 78(a) requires the battery passport to be fully interoperable with the passports required under ESPR, and standardisation request M/604 covers batteries too. The reference to ISO/IEC 15459 in Article 77(3) applies until the regulation is amended.

Common misunderstandings

"The standards are mandatory"

No. The requirements in ESPR Articles 10 and 11 become mandatory when a delegated act makes the passport mandatory for a product group. The standards are a voluntary way to show those requirements are met, with presumption of conformity for the six that are cited.

"You have to use GS1"

No. EN 18219's own scope says it describes identification schemes that use issuing agencies, self-issuing systems or a combination of both. GS1 Digital Link is one accepted route, not the only one.

"The standards say what data the passport holds"

No. They describe the system around the data. The content per product group comes from the delegated acts, and for batteries from Annex XIII of the Battery Regulation.

"All eight give presumption of conformity"

No. Only the six cited by Decision (EU) 2026/1736 do. EN 18239 and EN 18246 will not until the Commission publishes their references in the OJ.

How this looks in practice

Blippa is the company behind DPP Agent, where every passport gets a GS1 Digital Link address when the product has a GTIN, for example https://lindex.dpp.dppagent.com/01/07314781685466/21/002 for a Lindex jacket at item level. DPP Agent's validator at dppagent.com/validate checks any passport, including other publishers', against requirements in seven of the eight standards and reports the result per standard and clause. EN 18239 is about access control inside a system and can hardly be tested from outside, so it is not checked there.