EU Digital Product Passport Registry
Full citation: Commission Implementing Regulation (EU) 2026/1778 of 16 July 2026 laying down the implementation arrangements for the digital product passport registry set up under Regulation (EU) 2024/1781 of the European Parliament and of the Council.
Published in the Official Journal of the European Union on 17 July 2026 (OJ L, 2026/1778). Entered into force: 6 August 2026 (the 20th day following publication, per Article 24).
This documentation is informational only and does not constitute legal advice. This is a newly adopted implementing regulation. Consult qualified legal counsel for compliance decisions specific to your products and supply chain, and monitor the Official Journal for any corrigenda or amending acts.
In Plain English
The European Commission will operate one central, EU-wide registry for digital product passports. Its legal and technical operating rules were adopted on 16 July 2026 and enter into force on 6 August 2026 — this page describes how that registry is designed to work as it becomes operational. Think of it less like a filing cabinet full of passport data, and more like an index card system: for every product that needs a digital product passport, the registry stores a small set of identifying details — not the full passport content itself — so that customs officers, market surveillance authorities, and other authorised parties can quickly confirm "yes, a passport for this product exists and was registered by this company."
Three things to know before anything else:
- This registry is a separate, EU Commission‑run system. It is not part of Traceable, and logging in to Traceable does not log you in to it. To register a passport in the EU registry, your company has to go through its own one‑time identity check with the Commission — using tools like an EU-recognised digital signature or seal, not a Traceable username and password.
- This regulation does not change when your passport becomes mandatory. It only sets out how the registry works once a passport is required. For batteries, the passport deadline is still 18 February 2027 for LMT, industrial (>2 kWh), and EV batteries, exactly as set out in Article 77(1) of the EU Battery Regulation.
- Traceable does not yet submit passports to this registry automatically. The registry's own registration API only became legally defined this week (the implementing regulation was only adopted on 16 July 2026). Traceable is tracking this development; see Where Traceable Fits Today below.
The rest of this page is a detailed, article-by-article reference for compliance and legal teams who need the specifics.
What the Registry Is and Why It Exists
Article 13(1) of ESPR (Regulation (EU) 2024/1781) already required the European Commission to establish a central digital registry for digital product passports, to securely store — at minimum — each passport's unique identifiers. Commission Implementing Regulation (EU) 2026/1778 is the act that actually lays down how that registry works: its technical components, who can use it, how they prove who they are, and what the Commission, national authorities, and economic operators are each responsible for.
Importantly, the registry is not limited to ESPR products. Recital 2 and Article 1(1) of the implementing regulation state explicitly that the registry also covers:
| Product category | Legal basis requiring registration | Reg. Reference |
|---|---|---|
| Products covered by future ESPR delegated acts | Article 4, Regulation (EU) 2024/1781 | Art. 1(1)(a) |
| Batteries (LMT, industrial >2 kWh, EV) | Article 77, EU Battery Regulation (EU) 2023/1542 | Art. 1(1)(b) |
| Construction products | Article 76, Regulation (EU) 2024/3110 | Art. 1(1)(c) |
| Toys | Article 19, Regulation (EU) 2025/2509 | Art. 1(1)(d) |
| Detergents and end-user surfactants | Article 21, Regulation (EU) 2026/405 | Art. 1(1)(e) |
| Any future product Union law requires to register | — | Art. 1(1)(f) |
For Traceable's battery customers, this means: the digital product passport registry — including everything about identity verification and the "login" process described below — applies to battery passports too. Article 2 of the implementing regulation defines "digital product passport" to explicitly include the battery passport established by Article 77 of the Battery Regulation.
The registry stores identifying data about a passport's existence — unique identifiers, commodity codes, and registrant information (Article 8(9)) — not the full passport content itself. It is also legally distinct from two other things operators sometimes confuse it with: the national producer registers each Member State runs under Battery Regulation Article 55, and the Member-State-to-Commission aggregate reporting under Battery Regulation Article 76. Those obligations still exist separately and are not replaced by this registry.
How the Registry Works: Its Nine Components
Article 3 sets out the registry's structure:
- A website providing a secure user interface for economic operators, value chain actors, competent national authorities, and customs authorities
- An API for registering digital product passports and receiving information back from the registry
- A verification platform that confirms a given passport exists and is complete (this checks structure, not substantive legal compliance — see Registration and Automatic Checks)
- A scheme for generating unique registration identifiers
- A storage component for unique identifiers and, where relevant, the commodity codes used for customs release into free circulation
- A public list of verified digital product passport service providers
- A semantic repository — the authoritative reference for how DPP data fields are named, structured, and versioned
- A log system recording operations for accountability
- Identification and authorisation schemes for registry users
Becoming a "Verified" User: The Identity Check
This is the part of the regulation most relevant to the "login" question, and the part most likely to be confused with logging in to a platform like Traceable — so it is worth being precise.
To register a passport (or modify a registered one), a company or individual first has to become a "verified economic operator" (or, for repairers, refurbishers, remanufacturers, and recyclers, a "verified value chain actor") in the EU's own registry. This is a one-time identity-verification process run by the European Commission, governed by the EU's trust-services framework (Regulation (EU) No 910/2014, the "eIDAS" regulation) — not by any credentials issued by Traceable or any other software vendor.
Under Articles 4 and 5, the accepted methods differ by whether the applicant is a natural person (sole trader) or a legal person (company), and whether they are established in the EU:
| Applicant type | Established in the EU | Accepted proof of identity |
|---|---|---|
| Natural person (sole trader) | Yes | A qualified electronic signature with a qualified certificate (eIDAS), or an eID means meeting eIDAS "high" assurance level, or an electronic attestation of attributes under Union law |
| Natural person (sole trader) | No | A qualified electronic signature with a qualified certificate, or an electronic attestation of attributes |
| Legal person (company) | Yes | A qualified electronic seal with a qualified certificate, issued by a qualified trust service provider, or a qualified electronic attestation of attributes |
| Legal person (company) | No | A qualified electronic seal with a qualified certificate, or an electronic attestation of attributes |
A few practical points that follow directly from the regulation's text:
- Verified status expires. It lasts until the underlying electronic identification means expires, but never longer than 3 years from the date of verification (Article 4(4), Article 5(4)). After that, the operator must repeat the process to keep registering or modifying passports.
- No double verification where an equivalent system already exists. If the registry is integrated with another EU system that uses an equivalent identity-verification standard (the regulation names EPREL, the EU's energy-labelling product registry, as an example in Recital 11), an operator already verified there does not need to repeat the process (Article 4(5), Article 5(5)).
- Only verified operators can register or edit passport entries. Access to actually create or change a registration is gated on holding "verified" status (Article 4(3), Article 5(3)).
- A third party can register on your behalf, but you stay responsible. If you authorise someone else (an agent, a consultancy, a software provider) to register passports for you, that third party must itself complete the value-chain-actor verification process under Article 5 (the same eIDAS-based standard, applied to the third party), and you as the economic operator remain fully responsible for the accuracy of what they submit (Article 19(4)).
- Registered passports can be transferred. If a company is sold, merges, splits, or stops operating, its registered passports can be transferred to another verified economic operator or value chain actor, who then takes over responsibility for them (Article 6a).
Registration and Automatic Checks
Once verified, an operator registers a passport through the registry's secure website or its API (Article 8(6)) at the level of granularity — model, batch, or item — required by the applicable law for that product. Where a passport is created at item level, the corresponding batch and model identifiers must also be linked, if a batch or model design exists for that product (Article 8(4)–(5)).
On submission, the Commission runs an automatic check covering (Article 8(7)):
- Whether the data conforms to the required semantic structure
- Coherence between mandatory data fields and their values
- Whether the granularity (model/batch/item) matches what's required
- Validity of the commodity code, where relevant
- The link to any backup hosted by a digital product passport service provider
This automatic check is not a compliance check. Recital 16 is explicit that it verifies structure and completeness only — it is not proof that the passport's underlying data is substantively correct or that the product complies with the regulation that requires the passport. Substantive verification remains the job of market surveillance authorities.
If the check succeeds, the registry generates a unique, persistent registration identifier and returns it to the registrant through whichever channel — website or API — they used to submit (Article 8(8), (10)).
Proof of registration
At any time, the operator that registered a passport (or an authorised third party) can generate a downloadable proof of registration — a secure electronic document, sealed with a qualified electronic seal and Commission timestamp, containing the unique product identifier, the commodity code (if relevant), the registrant's identity, the registration date and time, and a cryptographic hash of the passport version it corresponds to (Article 9). This proof stays available for 90 calendar days from generation and can be regenerated if needed.
How long registration data is kept
Registration data is deleted automatically 10 years after registration, unless the specific product law requires a different retention period, in which case that period applies instead (Article 10(3)). This 10-year default follows the same rule used elsewhere in EU product law (the Commission's 2022 "Blue Guide").
Who Is Responsible for What
| Party | Responsibility |
|---|---|
| Verified economic operator / value chain actor | Accuracy and completeness of everything they submit; keeping registry data up to date; securing their own credentials and IT systems; remaining responsible even where a third party registers on their behalf (Articles 19–20) |
| European Commission | Owns and manages the registry: development, availability, monitoring, updates, maintenance, hosting, and security (Article 21) |
| Member States | Own and secure any national systems they connect to the registry; act as GDPR controller for their own processing of registry data; appoint a single national administrator, at the latest by 18 February 2027, as the sole point of contact with the Commission for managing that Member State's access rights (Articles 7, 22) |
That 18 February 2027 national-administrator deadline is worth noting: it is the same date as the Battery Regulation's single battery-passport start date (Article 77(1)), which suggests the Commission has deliberately aligned registry operational readiness with when battery passports first become mandatory.
Data Protection
The Commission is the registry's data controller for the personal data it stores (under Regulation (EU) 2018/1725), which includes: each user's name, login credentials and authentication tokens, postal address, email address, and — for natural persons — a national identifier such as a passport, national ID, or tax identification number (Article 18). Where Member States process data they've obtained from the registry for their own national duties, they act as controller under the general GDPR (Regulation (EU) 2016/679) instead (Article 22(4)).
Availability, Logging, and Security
- Uptime: the registry is meant to be accessible at all times. Planned maintenance gets advance notice on a public website; in an emergency (malfunction, cyberattack, urgent security threat) the Commission can suspend access without notice (Article 15).
- Logs: the Commission logs access/authentication attempts (kept 6 months), data modifications (kept for as long as the registration exists), and administrative actions and data-exchange events (kept 5 years) (Article 14).
- Support: a Commission helpdesk operates year-round, 08:00–20:00 Brussels time; the Commission is required to build an automated, 24/7 support tool by February 2029 (Article 13).
Where Traceable Fits Today
Traceable helps you build, structure, and host the underlying digital product passport data — for batteries, that means mapping your product data to the EU Battery Regulation's requirements (see DPP Requirements and Annex XIII).
Registering that passport in the EU Commission's central registry described on this page is a separate step, governed entirely by the Commission's own systems and identity-verification process outlined above — it is not something any DPP platform, including Traceable, can do on your behalf without your company first completing its own verified-economic-operator status directly with the Commission.
This implementing regulation was only adopted on 16 July 2026, so its practical, day-to-day registration workflow is brand new. Traceable is monitoring how the registry's website and API become operational and expects to support registry-registration workflows as they become available. No specific date is committed for this yet — check the Changelog for updates as this develops.
Further Reading
| Page | Contents |
|---|---|
| EU Battery Regulation Overview | Battery-specific obligations under Regulation (EU) 2023/1542 |
| Enforcement Timeline | The 18 February 2027 battery-passport start date and other key dates |
| ESPR Overview | The broader ESPR framework this registry was established under |
| ESPR and Battery Regulation Intersection | How the two regulations coexist |
| Compliance Overview | How all of Traceable's supported regulations interrelate |