The digital passport every product you manufacture will need (and why you should prepare now)

What is the DPP and why it's showing up now

I'll be direct. The European Union wants every product sold in its market to carry linked digital documentation with verifiable data: what it's made of, how much carbon it emitted, how much recycled material it contains, how to repair it, and what to do with it at end-of-life. That documentation is called the Digital Product Passport.

The legal foundation is the EU Regulation on Ecodesign for Sustainable Products, ESPR (EU) 2024/1781, in effect since July 2024. But that regulation is a framework—it doesn't specify your product's exact requirements. Those come through delegated acts, released sector by sector. That's why the DPP isn't landing all at once: it arrives in phases, with each sector on its own timeline.

The timing is straightforward: in July 2026 the Commission launched the central European registry where all passports must be registered. Without that registry, it was just theory. With it operational, the real countdown starts for each industry.

Does this apply to me, or just the big operators?

This is the most common misunderstanding, so let me clear it up. The DPP doesn't distinguish between large and small companies by headcount: it distinguishes by product. If you manufacture, import, or distribute a product falling under a delegated act, you're obligated, regardless of size.

And responsibilities are distributed along the chain:

• Manufacturers: primarily responsible for creating and maintaining the passport for products they place on the market.
• Importers: must verify that goods imported from outside the EU already have a valid DPP before selling them.
• Distributors: must verify the passport exists and is accessible before selling.

For an industrial SMB anywhere in a manufacturing zone, this means one concrete thing: if you make steel or aluminum components, or if you're a supplier to a larger company that is obligated, the DPP will flow down the chain to you. Your customer will ask for the data. And if you don't have it structured, you're out of the order.

The actual timeline, with realistic dates

There's a lot of fear around this topic and plenty of wrong dates floating around. Let me separate what's legally locked in from what's still an estimate.

The key rule: there's a minimum of 18 months between the delegated act for your sector and the actual obligation. That's your warning window. The real challenge isn't being blindsided on the due date—it's arriving unprepared because your data isn't organized, which is where the actual work lies.

What data you'll need to provide

Each sector will get its exact list in its delegated act, but the pattern repeats. Looking at what's already confirmed for batteries and proposed for textiles and steel, a typical DPP requires:

• Unique product identifier at model, batch, or unit level as appropriate.
• Material composition with detailed breakdown.
• Carbon footprint declaration.
• Proportion of recycled material.
• Durability and performance data.
• Repair, recycling, and end-of-life information.
• Country of manufacture and compliance documentation.

Notice something: you probably already have most of that data somewhere. In a production manager's Excel, in supplier datasheets, in your ERP, or in the head of your quality person. The challenge isn't inventing information—it's getting it structured, current, and exportable into a format you can upload to the registry when required.

This ties directly to another pressure point already hitting industry: CBAM and carbon emissions reporting. If you're already calculating your footprint for the carbon border adjustment mechanism, you're partway through the data work the DPP needs.

Three myths to discard

"I absolutely need blockchain"

No. The regulation doesn't mention or require blockchain. What it demands is a unique identifier, machine-readable data storage, and accurate, accessible information. A well-configured ERP or product information system qualifies. Some vendors will try to sell you blockchain because it benefits them; for most SMBs it's overspending on something the law doesn't require.

"I must use GS1 or a specific QR code"

Also no. The ESPR allows an "or equivalent" approach for identifiers. GS1's GTIN is practical and widely used, and if you already work with standard barcodes it's a sensible starting point. But it's not the only legal system.

"I can already claim DPP compliance"

Be skeptical of anyone saying this today. For nearly all sectors the delegated act doesn't exist yet, so nobody can claim full compliance. What you can demonstrate is readiness: organized data and clear intent. And to a customer or auditor, that already carries weight.

How to start without going crazy

If you run an industrial SMB and all this sounds like another regulatory headache on top of your already full plate, I hear you. But you can tackle it step by step, and none of these steps requires a huge upfront investment.

First, find your deadline. Look up which product category your manufacturing falls under and find its milestone in the Commission timeline. That tells you how much real time you have and keeps you from running when you don't need to or getting complacent when you should act.

Second, inventory your product data. Where does your material composition live? Who has the carbon footprint calculation? Is recycled content documented or just "from memory"? This map shows you the gaps before a customer does.

Third, centralize. If your data lives across five spreadsheets and in three people's heads, it will eventually break. A properly sized ERP or product information system brings order and lets you export when the obligation arrives.

Fourth, talk to your suppliers. Some DPP data you don't generate yourself—it comes from upstream. If your steel or component supplier won't give you carbon footprint data, you can't complete your passport. Starting that conversation now saves you a bottleneck later. A good supplier management system helps here.

Don't just treat this as a burden. A company with organized sustainability data sells better, survives audits better, and aligns better with its major clients' ESG agendas. I cover this in more detail in the guide to sustainability and ESG for SMBs.

Grants to cover the digital infrastructure

The biggest DPP cost isn't paperwork—it's data infrastructure. Software, integration, sometimes labeling hardware. And there is public money available. The Digital Kit still offers grants to freelancers and SMBs under 50 employees, and programs like the Circular Economy PERTE finance traceability and industrial digitalization projects. In Galicia specifically, also check regional digital transformation grants before spending your own money.

The classic mistake is waiting until the obligation hits, then trying to do it all at once at rush rates. Preparing your data with breathing room is cheaper and less stressful.

Frequently asked questions

When will the DPP be mandatory in my sector?

It depends on your product category. Batteries under EU Regulation 2023/1542 have been mandatory since February 18, 2027. The Commission timeline points to 2028 for steel and iron, and 2028-2029 for aluminum, textiles, and tires. Each date is confirmed in the delegated act for that sector, which appears at least 18 months before the obligation.

What happens if I don't have a passport when it's mandatory?

You can't sell the product legally in the EU. For customs and market surveillance, the registry entry and proof of registration are evidence of compliance. Without a valid DPP, the product doesn't enter or doesn't sell lawfully.

Can I reuse data from my CBAM reporting or energy labels?

Largely yes. If you're already calculating carbon footprint for CBAM, that data carries over. And if your product has an energy label and is in an EU product database, that system can serve as an equivalent for your product category unless the Commission decides otherwise. No need to duplicate effort.

Are small SMBs exempt?

There's no blanket exemption by company size. The obligation is product-based, not headcount-based. Some specific rules (like the ban on destroying unsold goods) start with large companies and extend to mid-size later, but the passport logic applies by product category regardless of company size.

How much does DPP preparation cost?

Heavily depends on how disorganized your data is to start. The registration itself isn't expensive; the infrastructure is. Building solid data systems—especially if you don't have one now—is where the cost is. Grants like the Digital Kit or the Circular Economy PERTE can cover much of that investment.