• Regulatory Guide

DPP Registry Implementing Regulation (EU) 2026/1778: A Plain-Language Guide

Last reviewed: July 2026 · PassoNext Team

Direct answer

Adopted on 16 July 2026 and entered into force on 6 August 2026, Commission Implementing Regulation (EU) 2026/1778 specifies the technical and administrative procedures for the EU Digital Product Passport (DPP) Registry. In particular, it sets the eligibility criteria (requiring eIDAS-qualified identification of economic operators), establishes procedures for automated processing, describes how to prove submission of documents to the platform, and sets requirements for retaining information. This act is applied to the portal opened to the public on 20 July 2026, under Article 13 of the Ecodesign for Sustainable Products Regulation (ESPR).

Key Takeaways
  • Enacted on 16 July 2026, released in the Official Journal on 17 July 2026, and legally active from 6 August 2026 (Article 24).
  • ​Regulates the central EU DPP Registry system, which opened for public user access on 20 July 2026.
  • ​Requires businesses to complete eIDAS identity verification—valid for up to three years—before registering any product passports.
  • ​Subjects incoming submissions to automated completeness and structural scans (which Recital 16 clarifies do not constitute legal product compliance certification).
  • Encompasses multiple regulatory categories—including batteries, construction goods, toys, detergents, and incoming ESPR product groups.

What This Regulation Actually Is

​Commission Implementing Regulation (EU) 2026/1778 provides the legal blueprint for the everyday operations of the EU’s Digital Product Passport Registry. Formally approved by the European Commission on 16 July 2026, published in the Official Journal on 17 July 2026, and entered into force on 6 August 2026 (in accordance with Article 24, which provides for a 20-day entry into force after publication), the legal text is titled: “Commission Implementing Regulation (EU) 2026/1778 of 16 July 2026 laying down the implementation arrangements for the digital product passport registry set up under Regulation (EU) 2024/1781 of the European Parliament and of the Council,” OJ L 2026/1778.

​You can view the complete statutory text on EUR-Lex at data.europa.eu/eli/reg_impl/2026/1778/oj in all 24 official EU languages. The EC maintains official user manuals, portal updates, and system documentation on its dedicated DPP Registry web portal.

Accuracy Check: The information below is current as of 17 July 2026. That said, the legislation was adopted on 16 July 2026 before the portal’s user launch on 20 July 2026, and practical implementation details may still evolve as technical corrigenda, commission instructions, and portal updates come to light. Please note that all the facts below derive from specific recitals/articles of the published law, against which they should be cross-referenced. This guidance provides a technical background only; it is not legal advice, and you are urged to always rely on the latest versions of the law by referring to the original resources and qualified legal counsel when making decisions.

​This guidance stems from Article 13(5) of the ESPR framework (Regulation (EU) 2024/1781), which required the Commission to establish the registry database by 19 July 2026 and adopt this implementing regulation on procedures and operations. The Commission’s official notices state that user account opening, trial features, and general guidelines went live on 20 July 2026. Although the law mandated the database creation deadline as 19 July, system-wide user deployment began on 20 July, and the regulation comes into force on 6 August, these milestones serve different purposes and legal functions.

Who It Covers: Not Just ESPR Products

The registry’s reach extends far beyond products governed strictly by future ESPR delegated acts. Article 1(1) alongside Recital 2 establishes the initial product scope:

  • ​Items regulated under future ESPR delegated rules via Article 4, Regulation (EU) 2024/1781.
  • ​Industrial batteries exceeding 2 kWh capacity, electric vehicle (EV) batteries, and light means of transport (LMT) batteries under Article 77 of the EU Battery Regulation (EU) 2023/1542.
  • ​Building materials and construction products governed by Article 76, Regulation (EU) 2024/3110.
  • ​Children’s toys under Article 19, Regulation (EU) 2025/2509.
  • ​Commercial detergents and consumer surfactants covered under Article 21, Regulation (EU) 2026/405.
  • Any future product category mandated by European Union legislation to utilize this centralized database.

​Furthermore, Article 2 specifies that the term “digital product passport” in this regulation explicitly incorporates battery passports established under Article 77 of the EU Battery Regulation. Consequently, all rules governing entity verification and registration protocols apply equally to battery supply chains.

The Registry’s Nine Components

Article 3 breaks down the technical infrastructure of the registry into nine integrated modules:

  1. ​A secure web portal catering to businesses, value chain members, national authorities, and customs officials.
  2. A direct API network for registering passport files and querying database records.
  3. ​A verification gateway that confirms a passport’s authenticity and completeness.
  4. An automated generator for assigning unique registration identifiers.
  5. ​A secure storage node for tracking unique product IDs and customs commodity codes.
  6. ​A public directory listing accredited digital product passport service providers.
  7. ​A semantic repository standardizing data schemas, attributes, and version control.
  8. ​An audit log system tracking system events and user actions.
  9. ​Identity and access management mechanisms regulating user permissions.

Becoming a “Verified” Operator: The Identity Check

Before lodging passport data, companies must complete an identity validation process under Articles 4 and 5 to attain “verified economic operator” status (or “verified value chain actor” for repairers, refurbishers, remanufacturers, and recyclers). The European Commission conducts this authentication directly, relying on the EU’s eIDAS trust framework (Regulation (EU) No 910/2014) rather than credentials generated by third-party DPP software vendors.

Required credentials vary based on organizational structure and location:

  • ​EU Sole Traders: Must present a qualified electronic signature, high-assurance eID, or electronic attribute attestation.
  • ​Non-EU Sole Traders: Must supply a qualified electronic signature or attribute attestation (as high-assurance eIDs are unavailable outside the EU).
  • ​EU Corporate Entities: Prove identity and registration using a qualified electronic seal issued by an accredited trust service provider, or an attribute attestation.
  • ​Non-EU Corporate Entities: Must provide a qualified electronic seal or attribute attestation (without requiring proof of EU establishment).

​Once approved, verified status mirrors the lifespan of the underlying electronic ID mechanism, capped at three years. Upon expiration, operators must re-authenticate to maintain write access (Articles 4(4) and 5(4)). To avoid redundant checks, Recital 11 notes that operators already verified through connected EU databases meeting equivalent standards (such as the EPREL energy-label platform) do not need to repeat the process. The authorized representative can submit data in respect of a client, including, where appropriate, the relevant information relating to those clients, but the third-party sender shall authenticate itself under the eIDAS scheme, and the primary operator shall be fully liable for all data submitted (Article 19(4)). Where a company is merged, acquired, split up, or restructured in any other way, the passport ownership can be transferred to another entity (Article 6a).

How Registration Actually Works

After obtaining verified operator status, entities may report individual passport data via the web interface or API at the product level established by applicable law for their sector: model, batch, or item (Article 8(6)). Operators registering items should link each item to the corresponding batches and models, if applicable (Article 8(4) and (5)).

​Upon lodging a record, the system automatically screens the data for structural compliance, mandatory field completion, target granularity, commodity code validity, and active links to the host server storing the passport data (Article 8(7)). Crucially, Recital 16 emphasizes that this automated scan checks only data formatting—it does not evaluate physical product compliance.

Market surveillance authorities remain solely responsible for enforcing actual product compliance. Submissions that pass the validation check are issued a persistent, unique registration identifier (Article 8(8)).

Registrants may at any time download a proof of registration in the form of an official document. The Commission seals the document with an electronic qualified seal and time-stamps it. It contains information on the product identification code(s) and customs codes applicable to the product, the data of the registrant, the date of registration, and a hash value of the passport file (see Article 9). You may always download this certificate again within 90 days after issue.​Registry files will be deleted after 10 years, unless the relevant product regulation provides a different retention period (see Article 10(3)). This aligns with the common practice in the EU, reflected for example in the Commission’s 2022 Blue Guide.

​Who’s Responsible for What

Verified businesses and value chain partners remain legally accountable for ensuring their submissions are accurate, complete, updated, and securely managed—even when outsourcing submission tasks to external contractors (Articles 19 and 20). The European Commission owns and operates the central registry architecture, overseeing system availability, software updates, data hosting, and cybersecurity (Article 21). Individual Member States oversee national interfaces connected to the system, serve as primary GDPR data controllers for locally processed registry records, and must designate a single national administrator by 18 February 2027 to manage national user access rights (Articles 7 and 22).
​
This 18 February 2027 milestone coincides directly with the mandatory enforcement date for battery passports under Article 77(1) of the EU Battery Regulation, aligning national oversight readiness with the launch of the first mandatory passport category.

Data Protection

The European Commission controls the personal data processed by the portal under Regulation (EU) 2018/1725. The personal data processed include users’ names, their access credentials, authentication data, address, their corporate email, and government-issued identification number (passport, ID, or tax ID, depending on the type of proprietor) (Article 18). However, national competent authorities that process data extracted from the portal for their own national law enforcement activities are controllers of that data under standard GDPR rules (Regulation (EU) 2016/679) (Article 22(4)).

Availability, Logging, and Support

The portal is designed to provide uninterrupted service 24/7. The Commission will schedule maintenance work in advance and publish it on the portal. Nevertheless, the Commission may decide to temporarily interrupt the portal’s functioning in cases of cyberattacks, technical malfunctions, and other force majeure events (Article 15). The Commission will store access and authentication data for six months, data processing and modification logs for the entire passport entry’s lifecycle, and exchange data for five years (Article 14). The helpdesk address is EC-HELPDESK-DPP@ec.europa.eu, +32 2 296 0431, available Monday-Friday, eight am to eight pm Brussels time, and provides support in English, French, and German. An automated self-service portal will launch in February 2029, providing around-the-clock assistance (Article 13).

What This Means for Manufacturers

This regulation does not specify when your products must bear a passport; sector-specific delegated acts or laws, such as the Battery Regulation, determine that. Instead, this regulation sets out the procedural requirements you must follow when registering passports by your deadline, including authentication standards, automated checks, validation certificates, and data retention.

Two operational priorities stand out:

  1. Secure eIDAS Authentication Early: Determine how your organization will obtain eIDAS credentials—a qualified electronic signature for sole traders or a qualified electronic seal for corporate entities. Because authentication takes place directly between your firm and the Commission, no software vendor can complete this step for you. Any provider claiming they can handle eIDAS verification on your behalf has misinterpreted Articles 4 and 5.
  2. ​Build and Host Compliant Data Models: The EU Registry functions as a central index; it stores metadata pointers to passport records hosted on external servers rather than generating passports itself. You are tasked with compiling technical documentation, finding any missing information from suppliers, and then making it publicly available at a URL the registry can find (see article 8(7): automated checks). Since data collection can take months from a wide range of suppliers, you need to prioritize this task. Software solutions like PassoNext handle this heavy lifting—structuring product data into standardized models, coordinating supplier inputs, and publishing records via standards-compliant GS1 Digital Link URIs — so final Commission registration becomes a quick, seamless administrative task.

Official Sources

Every detail in this guide is derived directly from official public sources. In the event of any discrepancy between this summary and official publications, the Official Journal text takes precedence:

What This Means For Your Business

PassoNext does not apply passport entries directly to the EU DPP Registry at this time since the registration portals and category-specific guidelines are still rolling out across industries. Instead, we prepare your supply chain for future compliance: our platform walks you through building complete sets of structured data which directly apply to the official EU models. When mandatory registration opens for your product category, your data will already be organized and validated for immediate deployment. By using this preparatory window, your product data will be up to date, compliant, and ready well ahead of the statutory deadlines.

Action Steps

  1. ​Review the published regulation on EUR-Lex (OJ L 2026/1778) and bookmark the Commission’s DPP Registry portal for ongoing operational updates.
  2. Prepare your organization’s eIDAS credentials: secure a qualified electronic signature if operating as a sole trader, or a qualified electronic seal from a certified trust service provider if registering a corporate entity.
  3. ​Verify that your product passport files match required semantic models and are hosted at reliable, publicly resolvable endpoints.
  4. ​Monitor the release of delegated acts specific to your industry to pinpoint exact compliance enforcement dates.
EU DPP Regulatory Hub
Battery Passport
Days
Feb 18, 2027

Frequently asked questions

What is Commission Implementing Regulation (EU) 2026/1778?

It is the implementing act adopted July 16, 2026, and entering into force August 6, 2026, that sets out the detailed procedures for operating the Digital Product Passport Registry under Article 13 of the ESPR (Regulation (EU) 2024/1781). This includes the registry’s structure; the identification procedure for economic operators applying for registration; the registration process and proof; logging procedures; and data storage in the registry.

The Regulation was adopted on July 16, 2026, and published in the Official Journal on July 17, 2026. Under Article 24, it enters into force twenty days after publication, i.e., on August 6, 2026. This date is different from the launch of the registry portal for user access, which the Commission plans to open on July 20, 2026.

Only an economic operator whose qualification as such has been verified may register in the registry by virtue of his qualified electronic signature under the eIDAS Regulation or qualified electronic seal issued by a qualified trust service provider. Verification of the qualified signature or seal is valid for the period up to the expiry date of the operator’s qualified identification document, but in any case, not more than three years.

No. By virtue of Article 8, upon submission of the application, the Commission checks the structure of the passport data, their detail level, the correct allocation of commodity codes, and the hyperlink to the relevant data hosted by the applicant. As stated in Recital 16, these checks are purely formal and do not confirm the substantive compliance of the product with the applicable legislation; this falls under the competence of market surveillance authorities.

Under Article 1, the registry covers products subject to future delegated acts under the ESPR, batteries under the Battery Regulation (with a storage capacity of more than 2 kWh, electric vehicles, and light transport vehicles), construction products, toys, and detergents and surfactants. In addition, other goods may be subject to a digital product passport if this is established by subsequent Union legislation. For the purposes of this Regulation, the term “digital product passport” includes the battery passport.

Ready to start your product passport?

Start free. No credit card required. Your first 10 passports stay free, even after the trial ends.

Start Free on Shopify
View Live Demo →