Product data: what binds you and what equips you
A regulatory briefing on the Digital Product Passport (DPP) and the obligations that draw on the same data, with their deadlines.
What this briefing covers
The 4 layers of product regulation: what empowers, what equips, what binds and what confers a presumption of conformity.
Where each product category stands: the timeline of deadlines from May 2026 to 2030, and an entry for each category.
What is already known about the infrastructure: registry, semantic repository, web portal, enrolment and identity, standards.
The common product data foundation required by several texts.
The 4 common misreadings, and what can be prepared today.
The sources, with every date labelled (adoption, publication, entry into force, application or compliance date).
Facts verified at source on 28 September 2026. This document does not constitute legal advice.
Overview
Product data now calls for decisions. It sits at the heart of several compliance regimes moving forward in parallel, including the Digital Product Passport (DPP).
The coming period marks a turning point for businesses placing products on the EU market. The volume of data to be published is growing, but the main change lies elsewhere: product data must now be tied to a specific requirement, a date of application and a party entitled to request it.
Four families of instruments are at work, each with its own function: the framework empowers, the infrastructure equips, sectoral acts bind and standards confer a presumption of conformity. A published date is not necessarily an enforceable one: a text can be in force for years before it binds a business. The binding layer is already producing its first effects, and the infrastructure is falling into place, led by the registry and the standards. What is still missing is the sector-specific detail that comes with delegated acts.
Timelines differ from one text to the next, but the requirements converge on capabilities that include giving a product a stable identity, describing its composition, documenting its origin and exposing that information according to each reader’s rights. Together, these capabilities form a common foundation that serves compliance and also opens up opportunities such as circular business models and stronger consumer engagement.
Four misreadings come up repeatedly. They concern a text’s status, the scope of the categories covered, the sequencing of work, and who is accountable for the data.
Yet three workstreams need not wait for any delegated act: your data, your supplier contracts and your organisation.
Structuring product data is lengthy work, and it pays off regardless of when an obligation becomes enforceable.
4 dated developments between May and August 2026
Four dated developments took place in Europe between May and August 2026, two of them in the passport infrastructure:
Six technical standards were cited in the Official Journal of the European Union.
An EU registration infrastructure for product passports became operational.
Destroying unsold apparel, clothing accessories and footwear became prohibited for large enterprises.
The Packaging Regulation became applicable, with its single data carrier rule.
Although none of these four developments adds a passport obligation to a product category that did not already have one, each changes what can be prepared.
A single date can refer to four distinct events: a text’s adoption, its publication in the Official Journal, its entry into force, or its application, the point at which it becomes enforceable against a business. A specific obligation can carry its own, later date, referred to here as its compliance date.
A published text can therefore bind no one for 2 years, while a rule that already applies can go unnoticed.
The 4 layers of product regulation
Four families of instruments are at work. Naming each family by what it does shows you, when faced with a text, what it can tell you and what it never will.
What empowers. The framework regulation, ESPR (EU) 2024/1781, in force from 18 July 2024. Stand-alone sectoral legislation: each text empowers its own acts.
What equips. Implementing acts, registry, infrastructure: Implementing Regulation (EU) 2026/1778, in force from 6 August 2026. Registry operational since 20 July 2026, enrolment open in production, shared by the ESPR and four sectoral regulations: batteries, construction products, toys, detergents.
What binds. ESPR delegated acts, including Delegated Regulation (EU) 2026/296 on unsold apparel, clothing accessories and footwear, applicable from 19 July 2026. Stand-alone sectoral legislation: batteries ((EU) 2023/1542), construction products ((EU) 2024/3110), toys ((EU) 2025/2509), detergents and surfactants ((EU) 2026/405), vehicles ((EU) 2026/1738). Categories without a delegated act remain pending.
What confers a presumption of conformity. Harmonised standards, ESPR Article 41: 6 standards cited in the Official Journal on 15 July 2026 by Implementing Decision (EU) 2026/1736; 2 standards published by CEN-CENELEC on 16 September 2026, awaiting citation.
A text’s status does not prejudge whether it is enforceable against a given business. For any announced deadline, the first check is therefore to identify the family it belongs to and establish whether it concerns the passport or something else.
The four layers do not move forward in the order in which they are read. For batteries, the sectoral regulation was published in 2023, so the obligation came before the infrastructure and the standards.
For categories that will fall under an ESPR delegated act, the order is reversed: the registry and the standards exist before the obligation is written.
A business may therefore feel that nothing is happening for its category, even though three of the four layers saw a dated development between May and August 2026.
Where each product category stands
Not every product category will be affected at the same time. The categories named are those for which an instrument is dated or announced: apparel, clothing accessories and footwear, batteries, construction products, toys, detergents and surfactants, iron and steel, textiles, tyres, aluminium, furniture, mattresses and vehicles. Timelines announced by the Commission are flagged as indicative.
The common foundation
These obligations all concern product data: its nature, origin, composition and fate. Several of them predate the framework regulation by several years and are already in place in businesses in France. The data itself becomes the question to examine, before the text that requires it.
The obligations that require this data. ESPR: digital product passport, ban on destroying unsold products. Sectoral legislation: batteries, construction, toys, detergents, vehicles. AGEC (France): consumer information. PPWR: packaging. EUDR: deforestation. ECGT: environmental claims. REACH information and SCIP notification: substances of concern.
What the texts ask for. Product and operator identifiers, composition and materials, origin and supply chain, compliance and technical documentation, repairability and end of life.
Value beyond the texts. After-sales customer relationship, use and service history, second life and resale.
What these capabilities unlock. Administrative simplification; customer insight and engagement; circularity, refurbishment and second-hand; services linked to the product life cycle; authentication and anti-counterfeiting for high-value products; AI-assisted uses of product data.
Each text has its own scope, timetable and enforcement authority, and a business that handles them one by one risks opening as many workstreams as there are regulations. Yet the capabilities they require overlap heavily: identifying the product and its components, documenting material composition, locating the required data in the systems of the business and its partners, producing compliance documents. The quality of these common capabilities drives the cost of everything that remains specific to each text.
The 4 common misreadings
1. Status
Common assumption. The standard is published, so it applies. The registry is running, so its legal framework is in force.
In practice. An unlabelled date is no basis for a decision. The question to ask of any deadline is which of the four it refers to: adoption, publication, entry into force or application.
2. Scope
Common assumption. The framework regulation will in time say what the passport must contain. Every obligation arising from the framework is a passport obligation.
In practice. A framework regulation rule has applied to apparel, clothing accessories and footwear since 19 July 2026, though no passport is required for them. For a large enterprise, it turns AGEC-compliant recycling into prohibited destruction, outside the 10 cases of Delegated Regulation (EU) 2026/296.
3. Sequence
Common assumption. Work will start when the category’s delegated act is adopted.
In practice. The only period the text guarantees runs from the delegated act’s entry into force to its date of application. From that date, a non-compliant product exposes the operator placing it on the market under the passport rules. Waiting for the delegated act concentrates the workload into this period, the shortest one, when providers are likely to be most in demand and contract negotiations least favourable.
4. Accountability
Common assumption. Compliance is a property of the chosen system, or the provider’s responsibility.
In practice. The operator placing the product on the market answers for passport availability and for accurate, complete and up-to-date data (Articles 9 and 27 of the framework regulation), even if hosted by a provider. The issue to examine is which third parties hold the data, and its portability. The choice of system comes next, and the allocation of roles is settled with suppliers.
What can be prepared today
Your data. Keeping unique identifiers and item master data clean pays off whichever text ends up requiring them. Knowing which data will be required and who holds it is a mapping exercise that carries over from one text to the next.
Your contracts. Write exit provisions and data portability into the DPP service provider’s contract before signature. The framework regulation supports this point, as its Article 10 requires interoperability, open standards and no vendor lock-in.
Your organisation. First establishing which means of identification the business already holds, then launching the operator’s identity verification, takes one dependency off the critical path. Costing the internal workload, in resources and skills, then changes the nature of the decision, whereas the provider’s price alone shifts it without settling it.