The passport is assembled where the data lives — in your factory.

Every economic-operator role in EU product law traces back to one party: the manufacturer. Importers and distributors can only pass on, verify or guarantee what the manufacturer knows. The Digital Product Passport makes that dependency explicit, because almost every field it asks for — materials, components, substances of concern, repairability, recycled content — is held in design records, the bill of materials and supplier declarations. This page sets out what the manufacturer actually has to do, and what changes when the factory sits outside the EU.

Last updated: 31 July 2026

In one line: the manufacturer holds the data the passport is made of, so the duty to assemble it, keep it accurate, publish it through the data carrier and maintain it for the regulated lifetime starts with them — and non-EU manufacturers discharge it through an EU importer or authorised representative, not by opting out.

Why the heaviest duty sits with the manufacturer

The ESPR (Regulation (EU) 2024/1781) allocates obligations to economic operators, and places the passport duty on the operator placing the product on the EU market. For goods made in the EU that is the manufacturer — but the deeper reason the duty lands there is practical rather than legal: nobody else has the data.

A passport is not a marketing document. It is a structured record built from the bill of materials, component and sub-component specifications, supplier declarations and test evidence, material and substance composition, and design characteristics such as repairability, disassembly and recyclability. A distributor cannot derive any of that from a pallet. An importer can only relay what the factory sends. The passport is therefore assembled where the engineering record already exists.

What a manufacturer actually has to do

Assemble the data. Collect the fields the applicable delegated act requires for the product group, from your own records and from suppliers — including tier-2 and below where a field reaches that far.
Ensure it is accurate. A passport asserts facts about the product. Errors are attributable to the operator publishing them, and "our supplier told us so" is a commercial defence, not a regulatory one. Supplier declarations should be evidenced, dated and retained.
Keep it current. Passports are not a launch-day artefact. Component changes, substitutions, second-source suppliers, spec revisions and corrections all have to flow through to the published record.
Make it available through the carrier. In practice a GS1 Digital Link QR or Data Matrix on the product, packaging or accompanying documentation, resolving to the passport — and registered where the rules require it. The EU DPP registry opened for registration on 19 July 2026.
Keep it accessible for the required period. Passports must remain available for the product's regulated lifetime — in some cases up to 15 years — which means backup custody arrangements that survive a website migration, a system change or an insolvency.

EU-based versus non-EU manufacturers

If you manufacture inside the EU and place the product on the market yourself, the chain is short: the duty is yours end to end.

If you manufacture outside the EU, the obligations do not disappear — EU authorities need a party inside the Union they can address. In practice the duty is discharged through an EU importer, who carries manufacturer-level responsibility for the goods they place on the market, or through an authorised representative where the manufacturer appoints one by written mandate. Either way the data still has to come from you, and your EU counterparty will increasingly make passport-ready data a condition of the purchase order rather than a favour. Non-EU manufacturers that supply complete, structured data win shelf space; those that send a PDF and a shrug get replaced.

Delegating the work is fine. Delegating the accountability is not.

You can outsource almost every step — data extraction, hosting, carrier generation, registry filing. What you cannot outsource is being the operator whose name is on the record. If a field is wrong, the authority addresses the operator, not the software vendor. Two consequences follow.

First, treat passport data as engineering change management, not marketing content: the same discipline, versioning and sign-off you apply to a drawing revision. Second, choose tooling that leaves you in control of the underlying data rather than locking it inside a vendor. PassPer is built for exactly this shape of work — AI extraction from the documents you already hold (spec sheets, certificates, supplier declarations) with human review before anything is published, eIDAS qualified sealing on the result (QTSP onboarding), GS1 Digital Link carriers and EU-sovereign hosting. Start with a free readiness check to see how much of your existing documentation already maps to passport fields.

Frequently asked questions

We manufacture in the EU. Is the DPP obligation ours alone?

For products you place on the EU market yourself, yes — the passport duty starts and largely ends with you. Distributors downstream have a lighter verification duty, but they are checking your work rather than sharing the authorship.

Our suppliers will not give us composition data. What then?

This is the most common blocker, and it is a contractual problem before it is a technical one. Put passport data obligations into purchase terms, with delivery of data as a condition of acceptance. Suppliers who cannot answer today will be answering the same question from every EU customer soon.

Does a manufacturer outside the EU have DPP obligations?

The enforceable duty attaches to a party inside the Union — an EU importer, or an authorised representative acting under written mandate. In commercial reality the data burden still falls on the non-EU manufacturer, because no one else holds the bill of materials.

How long do we have to keep the passport live?

For the product's regulated lifetime, which can run to around 15 years for durable goods. That is longer than most CMS platforms, hosting contracts or internal systems survive, so plan backup custody rather than assuming your current website will still resolve the QR code.

See where you stand — three ways, all free.

Take the 2-minute readiness check, watch the 10-minute interactive walkthrough, or download the full 2026 compliance guide. No account needed.

Free readiness check → See it in action Get the guide (PDF)