Digital Product Passport, answered for importers

Three parts, because the regulation names them separately:

• The data carrier on the product: what a scanner touches. Its format is fixed by the delegated act for the product group.
• The unique identifier of the product, built on the ISO/IEC 15459 standard for unique identification.
• The registry: the EU-level database of identifiers. It does not store the passport data itself — it is the index that says "this identifier is valid, and here is where the data lives".

What goes into the passport depends entirely on the delegated act for the product group. That is why the honest planning answer below is "wait for the act, prepare the data relationships now".

The sequence matters for anyone tempted to "get compliant" this year:

• 18 July 2024: ESPR entered into force; most provisions apply since 18 July 2025.
• 16 April 2025: the Commission's working plan for 2025–2030 named the first product groups: textiles (apparel and accessories), furniture including mattresses, tyres, iron and steel, and aluminium, plus horizontal rules.
• 20 July 2026: the registry went live, ahead of any passport duty.
• Next: delegated acts per product group — iron and steel first, expected during 2026; textiles, tyres and aluminium expected 2027. Each act gives economic operators at least 18 months before it applies.

Do the arithmetic on your own category: a textiles delegated act adopted in 2027 means a passport duty no earlier than late 2028. An importer who spends heavily on passport tooling in 2026 is solving a data model that does not exist yet.

The battery passport carries its own data set, and parts of it phase in on their own schedule:

• Carbon-footprint declarations for the covered battery classes, phasing in from 2025–2026 before the passport itself.
• Supply-chain due-diligence policies for cobalt, lithium, natural graphite and nickel, required from 18 August 2025 for the largest companies first.
• The passport itself from 18 February 2027: composition, carbon footprint, due-diligence information, performance and dismantling data, readable through a QR code.

For an importer of finished goods this lands through the supplier: the manufacturer produces the data, but the importer placing the battery-containing product on the EU market has to be able to show it. Same pattern as the GPSR technical file — you hold it, they produce it.

Practically, this repeats a pattern the site documents elsewhere:

• The data flows from the factory. Composition, substances of concern, recycled content — only the manufacturer knows. No passport vendor can invent this; they can only structure what the supply chain produces.
• The duty lands on the importer of record. Marketplace sellers importing from outside the EU are importers, whatever their platform calls them.
• The contract is where this is won. A passport clause in a supply agreement costs a paragraph; scrambling for data after a delegated act lands costs a season.

This is the same asymmetry as the GPSR Responsible Person and the CBAM emissions data: the obligation is European, but the information sits in the country of origin. The importers who fare best treat it as a purchasing conversation, not a filing exercise.

Two things an importer can usefully check off early, because they are certain regardless of the final data model:

• Substances of concern. The passport will surface what REACH already restricts — a product that is clean under REACH today has little to fear; one that is not has a problem that predates the passport. See the REACH page.
• Operator identifiers. Every actor in the chain needs a unique ID. Your EU establishment, EORI and any producer-register numbers (EPR) are the same plumbing — see EPR.

Everything else — exact parameters, carriers, validation — is delegated-act territory. Prepare the relationships, not the file format.

In order of what pays off first:

• Map your exposure. Apparel, furniture and mattresses, tyres, steel and aluminium goods, anything with a battery over the thresholds: these are the front of the queue. Everything else can be watched, not worked.
• Ask your manufacturers one question in writing: "Can you supply composition, substances-of-concern and recycled-content data for what you ship us?" The answer is a supplier-quality signal you can act on years before any deadline.
• Write the clause. Future passports, carbon-footprint data, battery-passport inputs — as deliverables under the supply contract, with the supplier's duty to update.
• Watch the right thing. Not vendor newsletters — the delegated acts for your product group in the Official Journal. An act adopted means at least 18 months to apply. That is the clock that matters.
• Keep your money. There is no certification to buy yet, and no data model to build against. Anyone selling either in 2026 is selling certainty that does not exist.