EN 18220: data carriers for digital product passports

EN 18220 is the European standard for data carriers in digital product passports: the thing on the product that a camera or reader scans to reach the passport. Usually that is a QR code, sometimes a Data Matrix code or an NFC or RFID tag. It is written for whoever designs labels, marks products or chooses the technology for the passport. It matters because ESPR requires the passport to be reached through a data carrier physically present on the product, its packaging or accompanying documentation, and since July 2026 EN 18220 is harmonised for that requirement.

The standard was drafted by CEN-CLC/JTC 24 under standardisation request M/604 and approved by CEN on 3 May 2026. SIS adopted it as SS-EN 18220:2026 on 27 May 2026; it has 38 pages. This article relies on the standard's scope, the legal texts and CEN-CENELEC's presentation of the standard, and has been checked against the licensed SS-EN edition.

What the standard covers

According to its scope, EN 18220 defines requirements for data carriers used in a digital product passport system. They cover:

• symbology characteristics and format;
• error correction codes and encoding methods;
• printing and production quality;
• durability.

It also sets requirements for graphical or other indicators that make a DPP data carrier easy to recognise, for indicating where the carrier is placed, for machine readability and quality checking, and for the link between the physical product and its digital representation.

Two things are explicitly out of scope: architecture and use cases, and secure elements or any other cryptographic security features. EN 18220 says how the code should look and work, not how to prove it is genuine.

Which carriers are meant

ESPR defines a data carrier broadly: a linear barcode symbol, a two-dimensional symbol or other automatic identification data capture medium that can be read by a device. CEN-CENELEC's presentation of EN 18220 on 25 June 2026 shows five technologies:

Carrier	How the presentation describes it
QR code	high-capacity 2D code readable by most cameras and smart devices
Data Matrix	high-density 2D code for direct part marking on a small print area
NFC	short-range contactless communication, tap to read
HF RFID	high-frequency RFID for short-range interactions
RAIN RFID	UHF RFID for long-range, fast identification in supply chains

The same slide says carriers need to work for consumers, businesses, repairers, recyclers, market surveillance and automated systems, and groups the requirements under data encoding, scannability, accessibility, carrier design, durability, quality, performance, and placement and marking. The public material says no more than that about the individual technologies, and neither do we.

What it requires in practice

The carrier has to lead to a passport

The basic function is the link between product and passport. Under §5.2.1 the carrier encodes a unique product identifier that gives access to the passport. Our validator uses that as a check that the address in the carrier actually leads to a passport and not to an error. A neatly printed QR code that points at a page that does not exist does not meet that requirement.

Data carrier on the productQR code, Data Matrix, NFC, HF or RAIN RFID

https://dpp.example.com/…The identifier it holdsa URL, or convertible to one (EN 18219)

The passportnot an error page (§5.2.1)

The right carrier for the product

Which carrier a product group uses is not decided by EN 18220 but by legislation. Under ESPR Article 9(2), the delegated act for a product group specifies one or more data carriers, the layout in which the carrier is presented and its positioning. Article 10(1)(b) requires the carrier to be physically present on the product, its packaging or accompanying documentation, as the delegated act specifies. EN 18220 then supplies the requirements for how the chosen carrier is designed and how long it lasts.

Durability and readability

Under ESPR Article 9(2)(i), the passport remains available for at least the expected lifetime of the product. A carrier that wears off after the first wash defeats that, which is why durability and production quality are in the standard's scope. The standard gives no number of washes or years. It asks the economic operator to assess what affects the carrier's durability (§5.4.4) and points to industry standards; time requirements may come in the product group's act.

A digital copy for online sales

ESPR Article 10(3) requires the economic operator to give dealers and online marketplaces a digital copy of the data carrier or unique product identifier, so customers who cannot handle the product can still reach the passport. The copy or a webpage link is provided free of charge, within five working days of a request.

The QR code and ISO/IEC 18004

The QR code itself is defined by ISO/IEC 18004, and EN 18220 requires QR codes to conform to the 2024 edition (§6.2.3). The current edition, ISO/IEC 18004:2024, is the fourth and was published in August 2024. It covers, among other things, symbology characteristics, data encoding methods, symbol formats, dimensions, error correction rules, a reference decoding algorithm and production quality requirements.

The Batteries Regulation is the act that most clearly requires a QR code. Under Article 13(6), from 18 February 2027 all batteries are marked with a QR code as described in Annex VI Part C. For LMT batteries, industrial batteries above 2 kWh and electric vehicle batteries, the code gives access to the battery passport; for other batteries it gives access to other information the regulation lists. Annex VI Part C requires high contrast against the background and a size easily readable by a commonly available QR reader, such as one in a phone. Article 13(7) requires the code to be printed or engraved visibly, legibly and indelibly, and where that is not possible on the battery, on the packaging and accompanying documents. The regulation's recitals say the QR codes should respect the guidelines of ISO/IEC 18004:2015.

How it relates to the other standards and the law

EN 18220 is one of the six standards listed in Commission Implementing Decision (EU) 2026/1736 of 14 July 2026, published in the Official Journal and in force on 15 July 2026. Under ESPR Article 41(2) it confers presumption of conformity with Articles 10 and 11 to the extent it covers them. Until that publication, Article 10(1)(c) pointed to the standards in Annex III, that is ISO/IEC 15459, or equivalent ones.

Within the series, EN 18220 pairs with EN 18219: the carrier holds the identifier, and the identifier leads to the passport. CEN-CENELEC presents the two as the modules for unique identifiers and for data carriers and the links between physical product and digital representation, drafted by the same working group. Fetching the passport is then governed by EN 18216 and EN 18222.

Carrier security is not here. Both EN 18220 and EN 18246 leave secure elements for data carriers out of scope. CEN-CENELEC's presentation lists QR fraud ("quishing") among the threats JTC 24's security work starts from.

For batteries, Article 77(3) refers today to ISO/IEC 15459 or equivalent.

Common misunderstandings

"EN 18220 requires a QR code"

The standard covers several carriers. Which one is used is set by the delegated act for the product group, or for batteries by the Batteries Regulation, which does require a QR code.

"RFID is enough for consumers"

CEN-CENELEC's presentation says carriers need to work for consumers as well as automated systems. A tag that only industrial equipment can read does not reach the consumer. What a given product needs is set by its act.

"A QR code on the box is always fine"

ESPR lets the act decide whether the carrier goes on the product, the packaging or the documentation. The Batteries Regulation allows packaging and documents only where marking the battery itself is not possible or not warranted.

"The carrier protects against counterfeits"

EN 18220 leaves cryptographic security features out. Authenticity and integrity are dealt with in EN 18246, which is not cited in the Official Journal.

How this looks in practice

DPP Agent, built by Blippa, prints labels straight from the passport. For a Lindex shell jacket, for example, there is a 50 × 80 mm hang tag and a 60 × 35 mm sewn-in care label, both with a QR code that leads to the jacket's passport. The validator at dppagent.com/validate checks that the address in the carrier leads to a passport and not to an error.