Digital product passport: six harmonised standards in the EU Official Journal, and an archive that must outlive the company

The technical office choosing a new PLM this autumn, or the one that has just finished migrating its bills of materials into a new ERP, is quietly taking a decision about duration: that data will have to stay readable by a market surveillance authority, by a recycler and by a repairer who does not yet exist, for the whole expected lifetime of the product — and even if the company itself has ceased trading in the meantime. This is not a cautious scenario: it is the wording of Regulation (EU) 2024/1781, which since July has had a technical apparatus of six standards.

Six references, and everything we are able to tell you about them

Commission Implementing Decision (EU) 2026/1736 of 14 July 2026, “on harmonised standards for digital product passports drafted in support of Regulation (EU) 2024/1781”, has been in the Official Journal of the European Union, L series, since 15 July 2026, and entered into force the same day. Article 1 does one thing: it publishes the references listed in the Annex, which we reproduce with the titles they carry there.

EN 18216:2026 — “Digital product passport – Data exchange protocols”
EN 18219:2026 — “Digital product passport – Unique identifiers”
EN 18220:2026 — “Digital product passport – Data carriers”
EN 18221:2026 — “Digital product passport – Data storage, archiving, and persistence”
EN 18222:2026 — “Digital Product Passport – Application Programming Interfaces (APIs) for product passport lifecycle management and searchability”
EN 18223:2026 — “Digital Product Passport – System interoperability”

That is where what we can tell you ends: these are paid-for CEN standards, the number and title are public, the content is not. The rest sits in the regulation.

What the presumption of conformity actually buys

Recital 1 recalls Article 41(2) of the ESPR: “Digital product passports which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the requirements set out in Articles 10 and 11 to the extent that those requirements are covered by such harmonised standards or parts thereof”. Three limits in a single line: it covers Articles 10 and 11, not Article 9 nor the contents of the category delegated act; only to the extent that those requirements are covered; and it remains a choice, not an obligation — the only one, though, whose outcome is predictable before an inspection.

The six standards come from Commission Implementing Decision C(2024) 5423 of 31 July 2024 — the request, recital 2 says, to “the CEN, Cenelec and ETSI for drafting harmonised standards in support of the requirements that are set out in Article 10 and Article 11” — as amended by Decision C(2025) 8024 of 28 November 2025.

Articles 10 and 11: the real obligation is duration

Article 10 sets out the essential requirements: a data carrier physically present on the product, connecting it to “a persistent unique product identifier”; data “based on open standards” and “transferable through an open interoperable data exchange network without vendor lock-in”. Paragraph 4 adds an obligation almost nobody has budgeted for: on placing the product on the market, the operator shall make available “a back-up copy of the digital product passport through a digital product passport service provider”.

Article 11 governs technical design and operation, and it is where the passport stops being a label: “fully interoperable with other digital product passports” as regards the “technical, semantic and organisational aspects of end-to-end communication and data transfer” (point a); freely accessible to customers, repairers, recyclers, market surveillance and customs authorities according to their respective rights (point b), with the rights to update data themselves restricted (point f).

Point (e) is the line that changes the project: “the digital product passport shall remain available for the period specified in delegated acts adopted pursuant to Article 4, including after an insolvency, a liquidation or a cessation of activity in the Union of the economic operator responsible for the creation of the digital product passport”. That period, under Article 9(2), point (i), “shall correspond to at least the expected lifetime of a specific product”: for a structural section or a piece of furniture, that is not months. That the list contains data storage, archiving and persistence and system interoperability tells you where the problem lies: not issuing the passport, but keeping it readable by third parties once the system that generated it has been decommissioned twice over.

The two that are missing are the ones about confidentiality

CEN-CENELEC states that the joint committee JTC 24 standards number eight: six are cited in the Official Journal. The two missing ones are, according to the same source, EN 18239 — access rights management, information system security and business confidentiality — and EN 18246 — data authentication, reliability and integrity: the two that police the boundary between publishable data and trade secret, which we wrote about last week.

What is not yet enforceable

No delegated act under Article 4 making the passport mandatory for a product group has been adopted. The Commission’s indicative timeline places the iron and steel act in the fourth quarter of 2026, textiles, aluminium and tyres in 2027, furniture in 2028 and mattresses in 2029, with at least eighteen months of transition. No date obliges you tomorrow: there is a working window that almost nobody is using.

One thing can be settled straight away, and it is contractual before it is technical. The second subparagraph of Article 11 forbids the service provider from processing your data “beyond what is necessary for the provision of the relevant storing or processing services”, but with one derogation — “unless specifically agreed” — which is a contract clause: you either write it now or live with it later.

Why a closed system

This archive has an awkward geometry. Its sources are the most confidential material you hold — bills of materials, dimensioned drawings, supply terms, process parameters — while the result has to stay queryable for years by authorities, recyclers and repairers, each to their own slice. A generic external service inverts that geometry: to assemble the passport it has to read the secret side, while what needs publishing is a tiny fraction of what you have shown it. The right way round is the opposite: assembly inside the perimeter, on open-weight models running on machines under our own watch, with only the record leaving it, field by field, access rights already applied. It is also the only shape compatible with two requirements the regulation writes down: no vendor lock-in, and a passport that survives the company’s insolvency. Under a proprietary subscription format it does not die with the company: it dies with the contract.

This is the control we put into operation: a system that reads bills of materials and conformity files, assembles the record with its fields and their access rights, and keeps the trail — date, field, source document — to show market surveillance. The same system holds PLM, ERP, quality and supplier data together in one operating model, on which AI agents keep the passport aligned with engineering changes, with an operator in command: on-premise on self-contained machines, or on a dedicated cloud with an Italian data centre staffed by us.

Could you say where the passport of the product you ship tomorrow will be in fifteen years, and who will still be able to read it? Half an hour with one of our engineers is enough to start.

Sources

What we do not know

We do not know the technical content of the six standards: they are paid-for documents, and we report only the number, title and edition as they appear in the Annex. That is honesty, not reticence: anyone telling you what they prescribe without having bought them is guessing. The same goes for EN 18239 and EN 18246, whose citation decision has not yet been published: the Commission’s timeline places it in September 2026, and the official harmonised standards page still lists only Decision 2026/1736. Nor do we know how Article 10(1), point (c), will now operate, which applied to data carriers and identifiers “until the references of harmonised standards are published in the Official Journal of the European Union”: they now are, and our reading is that the transitional window closed on 15 July 2026, but no Commission document confirms it.