The EU Digital Product Passport, explained for SMEs — what ESPR actually requires and when it applies to you · Compliance library

If you run a small or mid-sized manufacturing business in the EU, the Ecodesign for Sustainable Products Regulation — ESPR, formally Regulation (EU) 2024/1781 — is the single piece of EU law most likely to land on your desk between now and 2030. It establishes the framework for ecodesign requirements that physical products must meet to be placed on the EU market, and it creates the Digital Product Passport (DPP). The regulation entered into force on 18 July 2024.

This article answers the questions an SME manufacturer typically asks first: what is this regulation, does it apply to my product, what is a DPP, and what do I have to do.

What ESPR is, in one sentence

ESPR is a framework regulation. It does not, on its own, require you to do anything to a specific product. It sets the rules under which the European Commission can adopt delegated acts that place ecodesign and DPP requirements on individual product groups — textiles, tyres, furniture, ICT equipment, and so on. The obligation to comply with a DPP only kicks in when the delegated act for your product group is adopted and reaches its date of application.

ESPR Article 9(1) is the operative clause: a product can be placed on the market or put into service only if a DPP is available, “in accordance with the applicable delegated acts adopted pursuant to Article 4.” No delegated act for your sector yet, no DPP obligation yet. But once the delegated act is on the books, the obligation is hard.

Does ESPR apply to my product?

ESPR applies to any physical goods placed on the EU market, including components and intermediate products (Article 1(2)). The exclusions are narrow and specific: food, feed, medicinal products, veterinary medicinal products, living plants and animals and micro-organisms, products of human origin, certain reproductive plant and animal products, and vehicles for the aspects already covered by sector-specific vehicle law.

If your product is not on that exclusion list, ESPR’s framework applies. Whether the DPP requirement specifically applies depends on whether your product falls under a delegated act that has been adopted.

The Commission’s first working plan (Article 18(5)) prioritises these product groups for delegated-act work:

iron and steel
aluminium
textiles, in particular garments and footwear
furniture, including mattresses
tyres
detergents
paints
lubricants
chemicals
energy-related products (replacing or extending existing ecodesign measures)
information and communication technology products and other electronics

If your sector is on this list, you are in the first wave. If it is not, you will likely be in a later wave — but the broad scope of Article 1(2) means most physical products will be covered eventually. Cement is treated separately under Article 18(6): the Commission must set ecodesign requirements for cement no earlier than 31 December 2028 and no later than 1 January 2030, where the existing Construction Products Regulation does not already cover the relevant footprint.

What the DPP actually is

The DPP is two things stitched together: a piece of structured data, and a way to access it from the physical product.

The access mechanism is what most people see first. ESPR Article 10(1) requires that:

the DPP is connected through a data carrier — typically a QR code or similar — to a persistent unique product identifier;
the data carrier is physically present on the product, its packaging, or accompanying documentation;
the data is based on open standards, machine-readable, structured, and transferable through an open interoperable network “without vender lock-in” (verbatim from the regulation; the spelling is the OJ’s).

The data side is governed by Annex III. The Annex sets out a catalogue of elements a delegated act may require: the unique product identifier, a Global Trade Identification Number (GTIN) where applicable, TARIC commodity codes, the EU Declaration of Conformity and other compliance documentation, user manuals and safety information where required by other Union law, the manufacturer’s unique operator identifier, identifiers for other actors in the value chain, unique facility identifiers, importer information including the EORI number, and the reference of the DPP service provider hosting the back-up copy.

Two operational obligations sit underneath all of this and are easy to miss.

First, a back-up copy is mandatory. Article 10(4) requires that the economic operator placing the product on the market makes a back-up copy of the DPP available through a DPP service provider. This is not optional and not contingent on the delegated act.

Second, the DPP must outlive your business. Article 11(e) requires the DPP to remain available for the period set by the delegated act — at least the expected lifetime of the product, per Article 9(2)(i) — “including after an insolvency, a liquidation or a cessation of activity in the Union of the economic operator responsible for the creation of the digital product passport.” If you go out of business, the passport must continue. This is what the back-up service provider exists for.

The EU central registry

Article 13(1) requires the Commission to set up a digital registry by 19 July 2026 that stores at least the unique product identifiers and, for products being released for free circulation, the commodity code. The registry is run by the Commission. The economic operator placing the product on the market is responsible for uploading the relevant data (Article 13(4)).

The registry is not a place where the full DPP lives. The DPP lives on the manufacturer’s (or service provider’s) infrastructure. The registry stores the pointer.

How much warning will you get?

Article 4(4) gives a real answer to this. The date of application of any ESPR delegated act cannot be earlier than 18 months from its entry into force, except in narrowly justified cases. The same article requires the Commission to take “the needs of SMEs, in particular microenterprises” into account when setting compliance timelines.

Practically: when the delegated act for your sector is published in the Official Journal, the clock that starts ticking is at minimum 18 months long. That is your runway.

What non-compliance costs

ESPR does not set fine amounts. Article 74(1) requires Member States to lay down penalties that are “effective, proportionate and dissuasive,” and notify the Commission of those rules. Article 74(3) sets the floor: at minimum, Member States must be able to impose fines and time-limited exclusion from public procurement procedures.

The actual euro figures are set in national transposition law and vary by Member State. If your business sells into a specific Member State, the relevant penalty regime is that state’s, not the EU framework’s. As of mid-2026 several Member States are still working through their transposition; the regime is not yet uniform.

What an SME should actually do this quarter

Three concrete steps, in order:

Check whether your product is on the Article 18(5) priority list. If yes, you are in the first wave and the delegated act for your sector is in active development. If no, you have more time — but watch the working plan, which is updated periodically.
Map the Annex III data you already have. A surprising amount of the DPP catalogue — manufacturer identifier, EORI for importers, TARIC codes, compliance documentation, user manuals — is data your business already produces. The DPP work is largely making that data structured, machine-readable, and accessible from the product. Knowing what you have versus what you’d need to collect is the first hour of work.
Decide who your DPP service provider will be before the delegated act drops. The back-up requirement under Article 10(4) is not something you can leave until the deadline. The provider you choose has to be one you can stay with for at least the expected lifetime of every product you put on the market — which means this is a 10-year-plus decision, not a procurement quick-fix.

Beyond that, the regulation is designed to give SMEs the runway. Eighteen months from the delegated act is enough time to do the work properly, provided you know what’s coming.