Digital product passport: who can make the environmental data reliable?

Around a single digital product passport (DPP), the EU ecodesign regulation brings in up to 5 parties. Suppliers pass on their data, the manufacturer calculates the values or has them calculated and is solely accountable for them, and a notified body verifies them where the rules for the product require it. A service provider holds a copy of the passport, and the authorities carry out checks.

The term "DPP provider" therefore covers trades that do not provide the same service. The right contact depends on the question being asked: calculating a value, proving it, or keeping it available throughout the life of the product. The calculation method itself is covered in our article on how to calculate the data in the passport.

1Who does what in a digital product passport?

The digital product passport comes from the Ecodesign for Sustainable Products Regulation (ESPR), under which each delegated act will specify, product family by product family, who creates the passport and who may update it.

The manufacturer, solely responsible for the data

Article 9 of the ESPR sets out the rule: passport data must be accurate, complete and up to date. Article 27 places that duty on the manufacturer. Before placing the product on the market, the manufacturer applies the conformity assessment procedure set by the delegated act, draws up the technical documentation and the EU declaration of conformity, then keeps them for 10 years.

The manufacturer may hand the calculation to an engineering consultancy, hosting to a software vendor or registration to a third party, but responsibility does not move with the task. For registration, the implementing regulation on the registry says so: an operator that authorises a third party to act on its behalf remains fully responsible.

Suppliers, required to respond where the delegated act provides for it

Most of the data in a passport originates with suppliers: the composition of a foam, the origin of a steel, the electricity used by a spinning mill. Article 38 of the ESPR gives them 3 obligations, where the delegated act for the product provides for it:

• They provide, free of charge and on request, the information available on what they supply to the manufacturer, notified bodies and the competent national authorities.
• Where information is lacking, they allow the manufacturer to assess their products or services, and give access to the relevant documents and premises.
• They allow notified bodies and authorities to check the accuracy of the information on their own activities.

Until a delegated act has activated these obligations for a product, only the purchase contract makes a supplier answerable, as with the carbon data a customer asks for (in French) (in French).

The passport service provider

The manufacturer may keep its passport itself or entrust it to such a provider. One rule is not up for discussion: it must make a backup copy of the most up-to-date version available through a service provider (Articles 10 and 27). The passport must remain accessible even after the operator's bankruptcy, and the provider may neither sell nor reuse the data beyond its service, unless the operator has agreed otherwise in a specific agreement (Article 11).

The requirements for becoming a provider, and where relevant a certification scheme, will come from a Commission act whose adoption is planned for the fourth quarter of 2026, with no draft published as at 17 October 2026. The EU registry provides for a list of "verified" providers, but that status proves their identity, not the quality of their service.

2Does a third party have to verify the data?

Not as a general rule. The ESPR leaves it to the delegated act for each product to choose the conformity assessment procedure, and therefore the decision on whether a third party is involved or not (Article 4(5)).

The module chosen by the delegated act

The lightest procedure is module A, internal production control: the manufacturer ensures and declares, on its sole responsibility, that its product complies with the delegated act (Annex IV). Modules B to H1 involve a notified body, which certifies the product or the factory's quality system. Article 43 asks the Commission to choose according to the type of product, the requirements and the risks.

As at 17 October 2026, no product-specific ecodesign delegated act has been published in the Official Journal of the European Union: only Delegated Regulation (EU) 2026/296, on unsold goods, supplements the ESPR. Nobody yet knows whether the footprint of a garment or a piece of furniture will go through a third party, and the ESPR and passport timeline gives the planned order.

Batteries and construction, 2 cases already written

The Batteries Regulation has settled the matter for the carbon footprint and the recycled content: its Article 17 admits only modules D1 or G, the 2 of which involve a notified body. The footprint declaration is still waiting for its calculation act, in draft as at 17 October 2026, while the passport for these batteries arrives on 18 February 2027. The independent review of a battery life cycle assessment (LCA) details what the body verifies.

The Construction Products Regulation created a 3+ system: a notified body validates the manufacturer's environmental input data, assumptions and calculation, then inspects the factory. Its implementing acts will say which products go through it.

What customs and the authorities check

Once the EU registry is linked to their systems, customs will check the product identifier and its commodity code. Release for free circulation is not deemed to constitute proof of compliance (Article 15). The registry checks only the form of the data. Their material accuracy is a matter for the market surveillance authorities, which may, in the event of non-compliance, make the operator pay the cost of testing (Article 66). An error in a passport is therefore discovered after the product has been placed on the market.

3What can each party in a passport attest to?

The legislation breaks reliability down into distinct guarantees: a correct value, real input data, up-to-date data, a passport that is intact and available, a registered product. Each has its own guarantor, and the table below shows that no single party covers them all.

What a verifier attests

A notified body, or a verifier chosen voluntarily, attests that a value complies with a method, over a given scope and at a given date. For a battery, that means one model in one given factory; for a carbon footprint verified at a customer's request (in French) (in French), it is the scope written into the declaration. Its opinion covers neither the other models in the catalogue nor the next version of the product.

Its independence is written into the legislation. A notified body can be neither the designer nor the supplier of the product it assesses, and Article 52 prohibits it from activities that would threaten its judgement, in particular consulting services. The engineering consultancy that calculated a footprint therefore cannot validate it, any more than a critical review of an LCA (in French) (in French) is entrusted to its author.

Promises that guarantee nothing

Some commercial formulas have no basis in the legislation as at 17 October 2026. They can be spotted from their wording:

• A platform that is "ESPR-certified" or a "DPP certificate": the certification scheme for providers does not exist yet, and the "verified" status in the registry covers identity only.
• A platform that "guarantees compliance" of the data: it can guarantee the integrity and availability of the passport, not the correctness of a footprint it did not calculate.
• A critical review under the ISO 14044 standard presented as a regulatory verification: it does not replace the notified body where the delegated act requires one.

4How to choose the right digital product passport providers?

A passport calls on 3 trades, which are chosen on different criteria. Keeping them separate guarantees independence, and it is a requirement where a notified body is involved.

The engineering consultancy that does the calculation

It must know the method that the delegated act will impose, most often the European Product Environmental Footprint (PEF) method and its rules by product category, and know how to work with supplier data rather than averages. Its report must be able to go as it stands into the technical documentation, with the databases cited and their version.

The platform and the service provider

The platform formats and distributes the passport; the backup copy goes through an independent service provider. The ESPR requires data that can be transferred without dependence on any particular provider (Article 10) and a passport available throughout the life of the product. A passport that complies with the 6 European standards cited in the Official Journal on 15 July 2026 (EN 18216 and EN 18219 to EN 18223) is presumed to meet these requirements (Article 41).

The verifier

For a regulatory verification, only a notified body designated under the product's rules will do. For a voluntary verification requested by a customer, a verifier independent of whoever did the calculation and competent in the sector is enough, as for an FDES (the French environmental product declaration for construction products) or a Product Environmental Profile (PEP) (in French) (in French) or for the audit of environmental claims. The questions to ask are the same for all 3 providers:

• What exact scope does the work cover: one model, one batch, one factory or a product family, and at what reference date?
• Which method and which version are applied, and what will happen when the delegated act for the product is published?
• Who calculated and who verifies, and are the 2 people or the 2 companies independent of each other?
• How can all the data be recovered, in an open format, if the platform is changed or the provider ceases trading?
• What happens to the data beyond the service, and does the contract expressly prohibit its resale or reuse?

On budget, the calculation follows the price of an LCA: of the order of €5,000 to €10,000 excl. VAT for a streamlined LCA and €10,000 to €25,000 excl. VAT for the full LCA of an everyday product. These are orders of magnitude observed in 2026, with no official price list, and a first product LCA then serves as the basis for later ones. For the platform, the backup and the notified body, no public price list exists: only quotes on the same scope can be compared.

5What to prepare so the data holds up under scrutiny?

A reliable passport is built before the choice of tool, in the way each value is documented. The record below, built on a fictitious chair, shows what a value must carry to stand up to a verification or an inspection.

The chain of evidence

Each value points back to its source: the supplier's declaration, the meter reading, the database and its version. These documents go into the technical documentation, kept for 10 years after the product is placed on the market. The files that hold up a verification almost always have the same flaw: a correct figure that nobody can trace back any more. The same work is already done for the technical documentation for packaging. Each value is also linked to the events that trigger its recalculation, because data that is accurate at launch can become wrong by the second batch (Article 27).

Supplier clauses

Until the delegated act activates Article 38, the purchase contract does the job. 4 clauses avoid most gaps, and checking supplier data (in French) (in French) is then done on the documents:

• Transmission of the component's environmental data, in an agreed format, for each new product reference and then at each annual update.
• A right of access to documents and sites for the manufacturer, for its verifier and, where applicable, for the notified body.
• An obligation to give notice before any change of material, subcontractor, process or source of electricity at the production site.
• Retention of supporting documents for the whole retention period of the product's technical documentation, that is 10 years as a general rule.

For us at Projet Celsius, the useful question to put to a platform is not "are you compliant?" but "what do you guarantee, and over what?". We recommend keeping the 3 roles separate: a calculation documented by an engineering consultancy, a verification by a third party that did not do the calculation, and a reversible backup with an independent provider. The longest workstream remains supplier data, and it starts before the choice of tool, which our digital product passport offer organises from the scoping stage.

6Key takeaways

• The manufacturer alone answers for the accuracy of the passport data, even when it entrusts the calculation, hosting or registration to a third party.
• The passport service provider is an independent third party that keeps a backup copy; it guarantees integrity and availability, not correctness.
• A notified body steps in only if the rules for the product require it: this is already written for the carbon footprint of batteries.
• Whoever calculated a value cannot verify it, and the "verified" status in the EU registry covers only the identity of the provider.
• Reliability is prepared in the chain of evidence and the supplier contracts, before the platform is chosen.

To find out whether and when your product will have a passport, our 2-minute tool and the guide to the digital product passport cover it family by family.

Further resources

Frequently asked questions

1Can a DPP platform certify my data?

No. A platform formats, hosts and distributes the passport; it can guarantee the integrity and availability of the data, not their correctness. Accuracy remains the manufacturer's responsibility, and only verification by a notified body, where the delegated act for the product requires it, attests to it before the authorities.

2What is a digital product passport service provider?

It is an independent third party, authorised by the operator that places the product on the market, that processes the passport data to make it accessible to those entitled to it. The manufacturer must entrust it with a backup copy of the latest version. The detailed rules for this role will come from a Commission act planned for the end of 2026.

3Do I need a notified body for the digital product passport?

Not as a general rule. Each delegated act chooses the conformity assessment procedure: internal control by the manufacturer, or a module involving a notified body. For the carbon footprint and recycled content of batteries, the 2023 regulation already provides for a notified body, even though the footprint declaration is still waiting for its calculation act.

4Can the firm that calculated the footprint also verify it?

No. A notified body must be independent of the product it assesses and may not provide consulting services. For a voluntary verification, customers and verification schemes expect the same separation: whoever calculates and whoever verifies are 2 separate companies.

5Are my suppliers required to send me their data?

Only if the delegated act for the product activates Article 38 of the ESPR: they would then have to provide the available information free of charge and open their sites to checks. Until then, the purchase contract sets what they send, in what format and how often.

6How much does a digital product passport provider cost?

There is no public price list as at 17 October 2026 for platforms, backup or notified bodies. The price depends on the number of product references, the level of the passport (model, batch or item) and the retention period. The footprint calculation follows the price of an LCA, from €5,000 to €10,000 excl. VAT for a streamlined LCA.

Ask Guillaume your questionA personal reply within 24 working hours

Send my questionor: guillaume@projetcelsius.com