EU Digital Product Passport: access rights are a governed data layer, not a commercial workflow

External-source research synthesis, not an OfferSignal client result. Based on the retained October 2026 research and source-specific dates.

A manufacturer, distributor or repairer may be able to scan a product identifier and find a useful record, yet still lack the drawing revision, certificate scope, compatibility evidence or commercial authority needed to act. That is the central lesson of the European Union’s Digital Product Passport (DPP) architecture. The Registry is designed to connect a persistent product identifier and data carrier to registration metadata, route authorised access to decentralised product data and support a customs identifier check. It is not a catalogue, enterprise resource planning system, configure-price-quote tool, request-for-quote system or autonomous decision-maker. 1 2

What the live Registry actually does

The European Commission announced the Registry operational on 20 July 2026, with user-interface and application-programming-interface registration, a public testing environment, a proof-of-registration document, free access to its semantic repository through documented APIs and six published harmonised standards. The first mandatory battery deadline cited in the announcement is 18 February 2027. These are infrastructure and timetable facts, not evidence of broad adoption, data correctness or a successful commercial workflow. 5

The Registry stores identifiers, registration data and high-level metadata. Full detailed DPP content remains with the economic operator or a DPP service provider. Under the Ecodesign for Sustainable Products Regulation, the product must use a persistent unique identifier and interoperable, machine-readable data. The responsible operator must provide dealers or online marketplaces a carrier or identifier copy free of charge, promptly and no later than five working days after request, and maintain a backup through a service provider. 1 2 3

The implementing regulation specifies a secure interface, API, verification platform, registration-identifier scheme, customs identifier and commodity-code store, verified-provider list, semantic repository, logs, versioning and identity/authorisation controls. Automatic checks can assess semantic conformity, relevant mandatory-field coherence, model/batch/item granularity, commodity-code validity and the provider-backup link. They do not establish that an engineering record is correct, a certificate is valid, a product is safe, a price is current or capacity is available. 4

Permissions change by role and product group

A producer or importer remains responsible for the completeness, accuracy and currency of its registration and credentials. A distributor, retailer or online marketplace may receive the carrier and the fields needed by its legal role, but not unrestricted access to confidential drawings, process data, capacity or price assumptions. Repairers, refurbishers, remanufacturers and recyclers must be verified, while the information and actions available to them depend on the applicable delegated act and other Union law. Consumers may see information relevant to purchasing, use, repair or disposal; “public portal” does not mean identical visibility for every user. 2 4

Verified status ends when the electronic identification means expires and in any event after three years unless verification is repeated. A proof-of-registration document is available for 90 calendar days from generation, with regeneration possible. Unless Union law specifies another period, Registry data is retained for 10 years after registration. These are legal control periods, not uptime, adoption or performance results. 4

For imported covered products released for free circulation, customs can check that the registration identifier and commodity code correspond to Registry data. The EU customs interconnection, CSW-CERTEX, is required to become operational within four years of the relevant implementing act’s entry into force. That statutory deadline does not show that every national customs workflow was connected by 27 October 2026. 3

Illustrative application for a custom workshop

This is an illustrative application, not a reported deployment. A workshop without standard stock-keeping units could use a DPP as a permissioned evidence pointer for a model, batch or item: released drawings, material and tolerance records, certificates, repair instructions, provenance and lifecycle state where the sector rules permit those fields and the operator has published them.

The workshop should retain source, revision, effective date, item-versus-batch applicability, units, operator and facility identity, certificate validity, permissions and revocation. A Registry registration should not be used to infer manufacturability, select a capable supplier, check live capacity, create a price, approve an offer, substitute a component or declare customs compliance. Engineering, quality, commercial and customs owners remain authoritative. A useful test would replay representative records containing stale revisions, mismatched model and batch identifiers, wrong commodity codes, expired certificates and changed provider links, then measure retrieval and permission errors—not merely whether a registration succeeded.

What remains unproven

The retained evidence found no public customer case with a denominator, baseline, intervention and realised revenue, quality or lead-time outcome; no complete custom no-SKU workflow from drawing through quotation, order and aftersales; no provider price list; and no evidence that Registry permissions automatically synchronise enterprise resource planning, product-lifecycle, quality, warehouse or invoicing systems. The provider market, service levels, certification costs and portability commitments also remained undisclosed. The Commission’s 2024 call for evidence describes a future provider framework and possible certification scheme, not a completed commercial market. 6

The practical conclusion is narrow but useful: treat the DPP Registry as a decentralised index, metadata and verification layer. Keep the full authoritative records and entitlement controls with the operator or provider, and require human review before a quote, substitution, repair action or customs declaration. Product-specific delegated acts will determine the fields and access rights that make the architecture useful in each sector; those future permissions should not be presented as realised commercial results. 1 3 6

Sources and next reading

• Production DPP Registry — official production endpoint; enrolment and registration require identity verification and were not represented as tested in the retained research.
• DPP Registry acceptance/testing environment — separate environment for safe test workflows; it does not affect live data or real processes.
• DPP Registry User Guide for Economic Operators — public operational guide, not a substitute for the regulation or sector acts.

Explore OfferSignal · Focused Business & AI Workshop · All research

References