The Ecodesign for Sustainable Products Regulation — Regulation (EU) 2024/1781, in force since 18 July 2024 — is the text that creates the Digital Product Passport. Two pieces of its machinery are now taking shape and matter for anyone preparing a passport: the central registry the Commission has to operate, and the data carrier that links a physical product to its passport. This article looks at both, and at GS1 Digital Link, the syntax most likely to tie them together.
None of this replaces the product-specific rules. The exact fields a passport must contain are set by a delegated act for each product group. What follows is the common plumbing that applies regardless of the group.
The central registry
Article 13 of the ESPR requires the Commission to set up and run a registry that stores the unique identifiers carried by products placed on the EU market. The registry does not hold the full passport; it holds the identifiers and the references needed to find it, so that market surveillance authorities and customs can check, at the border or on the shelf, that a product which is supposed to carry a passport actually has one.
The registry is expected to become operational around 19 July 2026. Customs authorities get their own interface, linked to the EU Single Window environment, so that imported goods can be verified against their declared identifiers. The practical consequence for a brand is simple: the identifiers you assign to your products and your operations have to be real, unique and registered — not generated at the last minute for a label.
Three identifiers, not one
The ESPR works with a set of identifiers that often get collapsed into "the product ID". They are distinct. There is a product identifier that designates the item or batch; an economic-operator identifier that designates the company responsible for placing it on the market, tied to the EORI number used for customs; and a facility identifier for the relevant site. Getting these right early is the part most often underestimated, because they touch master data and ERP records, not just packaging.
One QR code for two audiences
The passport is reached through a data carrier on or with the product. For most product groups this is a QR code following ISO/IEC 18004, pointing to the passport and carrying the unique identifier. The same carrier has to work for a consumer with a phone and for an inspector with a scanner, which is where the encoding standard becomes important.
GS1 Digital Link — standardised as ISO/IEC 18975:2024 — expresses GS1 identifiers such as the GTIN as a web address. A single QR code can then resolve to different destinations depending on who asks and what they need: the public passport for a consumer, a machine-readable record for a system, the registry reference for an authority. One carrier, several services, no second barcode to manage. This is why GS1 Digital Link is the front-runner for DPP data carriers, even though the legislation does not yet name a single mandatory syntax.
What about secure NFC
A QR code identifies a product; it does not, on its own, prove the product is genuine, because a QR code can be copied. Where physical authenticity is part of the requirement — luxury goods, sensitive components, anything exposed to counterfeiting — a cryptographic NFC seal carries the same Digital Link identifier while also proving, on each tap, that the tag is the original and not a clone. The passport and the anti-counterfeiting function then ride on one carrier. The choice between a plain QR code and a secure NFC tag is made product by product, against the value at stake.
What to put in place now
Three things are worth starting before the product-specific deadlines arrive. First, clean up your identifiers: GTINs, the operator identifier behind your EORI number, and the facility references, so they are consistent across your systems. Second, decide on a resolver — the service that turns a scanned Digital Link into the right destination — and keep the destinations versioned, because passports are expected to stay reachable for years. Third, resist hard-coding fields that the delegated act for your product group has not defined yet; build the carrier and the identifier layer now, and add the regulated content when the act is published.
The registry, the identifiers and the data carrier are the foundation every passport sits on, whatever the product. Getting them right is work you can do today, and it makes every product-specific obligation that follows far less painful.
Preparing a Digital Product Passport and not sure where the carrier and identifiers should live? We can map it against your product range in a short call. Talk to us.
