Commission Implementing Regulation (EU) 2026/1778 of 16 July 2026 laying down the implementation arrangements for the digital product passport registry set up under Regulation (EU) 2024/1781

Article 1

1. This Regulation sets out implementation arrangements for the functioning of the digital product passport registry established in accordance with Article 13 of Regulation (EU) 2024/1781 including rules that apply to economic operators that place any of the following products on the market or put them into service, requiring the existence of a digital product passport and its registration in the registry:

2. Those implementation arrangements shall also include rules governing the use of the registry by value chain actors, competent national authorities, customs authorities and the Commission.The implementation arrangements and rules referred to in paragraph 1 of this Article relate to:

Article 2

For the purposes of this Regulation, the following definitions apply:

The definitions of ‘product’, ‘product group’, ‘digital product passport’, ‘digital product passport service provider’, ‘placing on the market’, ‘putting into service’, ‘economic operator’, as set out in Article 2, points (1), (5), (28), (32), (40), (41) and (46), respectively, of Regulation (EU) 2024/1781, apply.

For the purposes of this Regulation, ‘digital product passport’ includes the battery passport established by Article 77 of Regulation (EU) 2023/1542.

The definitions of ‘authentication’, ‘qualified electronic signature’, ‘qualified trust service provider’, ‘qualified electronic seal’, ‘qualified certificate for electronic seal’ and ‘electronic time stamp’, as set out in Article 3, points (5), (12), (20), (27), (30) and (33), respectively, of Regulation (EU) No 910/2014, apply.

The definition of ‘machine-readable format’, as defined in Article 2, point (13), of Directive (EU) 2019/1024 of the European Parliament and of the Council (12), applies.

The definition of ‘processing’, as set out in Article 3, point (3), of Regulation (EU) 2018/1725 of the European Parliament and of the Council (13), applies.

The definition of ‘incident’, as set out in Article 6, point (6), of Directive (EU) 2022/2555 of the European Parliament and of the Council (14), applies.

The definition of ‘controller’, as set out in Article 3, point (8), of Regulation (EU) 2018/1725, applies.

The definitions of ‘market surveillance’, ‘market surveillance authority’ and ‘release for free circulation’, as set out in Article 3, points (3), (4), and (25), respectively, of Regulation (EU) 2019/1020 of the European Parliament and of the Council (15), apply.

The definitions of ‘customs authorities’ and ‘customs controls’, as set out in Article 5, points (1) and (3), respectively, of Regulation (EU) No 952/2013, apply.

Article 3

The registry shall consist of the following:

Article 4

1. Economic operators that are natural persons acting as sole traders shall be qualified as ‘verified economic operators’ if one of the following conditions is satisfied:

2. Economic operators acting as legal persons shall be qualified as ‘verified economic operators’ if one of the following conditions is satisfied:

3. Without prejudice to other Union law, access to the digital product passport registry shall be granted to verified economic operators for the purpose of registering digital product passports. .

4. Economic operators shall retain the status as verified economic operators until their electronic identification means expire but no longer than three years from the date of verification in accordance with paragraph 1 or 2. Once such means expire or the three-year period has expired, whichever occurs first, economic operators shall no longer be able to register new digital product passports in the registry or modify any data referred to in Article 8. They may do so only if they successfully repeat the identity verification process in accordance with paragraph 1 or 2. The status of the digital product passport in the registry shall be updated accordingly.

5. Without prejudice to paragraph 4, where the digital product passport registry is integrated with another Union information system with an equivalent or identical identity verification process, the economic operator already registered in that information system is not required to undergo a new identity verification process in the digital product passport registry.

Article 5

1. A value chain actor who is a natural person acting as a sole trader shall obtain a verified status in the registry if one of the two following conditions is fulfilled:

2. A value chain actor acting as a legal person shall obtain a verified status in the registry if one of the following conditions is satisfied:

3. Only verified value chain actors shall have access to the registry and may perform, where specified in the relevant Union law, actions in the registry.

4. A value chain actor shall retain the status as verified until their electronic identification means expire and in any event no longer than three years from the date of verification in accordance with paragraph 1 or 2. Once such means have expired or once the three-year period has expired, whichever occurs first, these actors shall no longer be able to perform registrations or modify any data in the registry. They may do so only if they successfully repeat the identity verification process in accordance with paragraph 1 or 2.

5. Without prejudice to paragraph 4, where the digital product passport registry is integrated with another Union information system with an equivalent or identical identity verification process, the value chain actor already registered in that information system is not required to undergo a new identity verification process in the digital product passport registry.

Article 6

1. Where provided by Union law, verified economic operators and verified value chain actors may delegate access rights to third party users acting on their behalf.

2. Any personal data which is entered as part of the user profile of a verified economic operator or a verified value chain actor shall be processed in accordance with Regulation (EU) 2018/1725.

3. Each economic operator and each value chain actor shall be responsible for managing their electronic verification process in accordance with Articles 4 and 5, respectively.

4. The verified economic operator and verified value chain actor shall be responsible for updating their data in the event of any relevant change.

Article 6a

Registered digital product passports may be transferred to another verified economic operator or, where applicable, to a verified value chain actor that takes over the obligations from the previous actor in relation to those digital product passports from the date indicated for the transfer.

Article 7

1. At the latest by 18 February 2027, Member States shall appoint a designated national administrator who shall act as the single official contact point for the Commission for the purposes of managing registry access rights for that Member State.

2. Member States shall communicate to the Commission the name and contact details of their respective designated national administrator and shall notify the Commission of any subsequent changes with regard to their designated national administrator.

3. The designated national administrator may delegate registry access rights to relevant national authorities within its Member State. Such delegation shall be carried out under the full responsibility of the Member State and in a way that ensures the security, integrity and confidentiality of the registry data accessed in accordance with this Regulation.

4. National authorities which have been granted access by their designated national administrator may delegate and manage registry access rights further within their respective authority.

5. Personal data contained in the user profiles and user accounts of the competent national authorities and customs authorities shall be processed by the Commission in its capacity as controller in accordance with Regulation (EU) 2018/1725.

Article 8

1. For products referred to in Article 1(1), point (a), a digital product passport shall be registered by a verified economic operator placing the product on the market or putting it into service at the level specified in the applicable delegated acts (model, batch or item level) adopted pursuant to Article 4 of Regulation (EU) 2024/1781.

2. For products referred to in Article 1(1), points (b) to (f), a digital product passport shall be registered by the relevant actor at the level (model, batch or item level) specified in the relevant Union law.

Where Union law provides for a third party to perform actions in the registry on behalf of the actors referred to in the first or second sub-paragraphs, such third party, once verified according to Article 19(4), will be allowed to perform registration actions in the registry.

3. Where the same product is subject to different Union rules requiring the registration of its digital product passport at different levels of granularity, the digital product passport shall be registered for that product at the most granular level required by the relevant Union legislation.

4. Where the digital product passport is created at item level, in accordance with paragraph 1, both batch and model identifiers shall be linked to that digital product passport where batch and model design exist for the product.

5. Where the digital product passport is created at batch level, in accordance with paragraph 1, the model identifier shall be linked to that digital product passport where model design exists for the product.

6. The relevant actor referred to in paragraph 1 shall register a digital product passport either through the secure user interface of the registry as provided for in Article 3, point (a), or through the API as provided for in Article 3, point (b).

7. Upon submission for registration, the Commission shall read the digital product passport content and automatically confirm:

8. Following a successful verification in accordance with paragraph 6, the registry shall generate and store a unique and persistent registration identifier as part of the registration data.

9. Additionally, the Commission shall store in the registry the following information as part of the registration data:

10. Upon successful submission by the relevant actor as referred to in paragraph 1, of the data in the registry, the Commission shall automatically communicate to that relevant actor the unique registration identifier for that specific product generated in accordance with paragraph 9. The unique registration identifier shall be communicated through the user interface or the API response, depending on the service used by the relevant actor during registration.

Article 9

1. An economic operator or, where relevant, a third party on behalf of the economic operator, that has registered a digital product passport in the registry in accordance with Article 8 shall be able to generate, at any given time, proof of registration for one or more digital product passports for which that economic operator is responsible.

2. The proof of registration shall serve as evidence, including vis-à-vis third parties, that the registration obligation for that digital product passport has been fulfilled. It shall be generated as a secure electronic document that can be downloaded by the actor that registered the digital product passport from the registry, and shall contain at least the following data:

3. Proof of registration shall be guaranteed by means of a qualified electronic seal as provided for in Article 38 of Regulation (EU) No 910/2014 and shall include the electronic time stamp of the Commission referred to in paragraph 2, point (d).

4. The Commission shall make available in the registry to the requesting verified economic operator the proof of registration through the registry’s secure user interface or through the API, depending on the service chosen by the economic operator. That proof shall remain available for a period of 90 calendar days from the date of its generation.

Article 10

1. Any change to the digital product passport registration data, including its creation, modification and deletion, shall be logged in the log system of the registry in accordance with Article 14 and reflected in the status of the registration.

2. The registry shall support the versioning of the registered data, and storea timestamp of the Commission for each update.

3. Where Union law does not provide for a specific duration of availability of the digital product passport, digital product passport registration data, as referred to in Article 8(7) and (8), shall be deleted automatically from the registry 10 years after registration. Where Union law provides for a specific duration of availability of the digital product passport, the retention period of such data shall be aligned with the period of availability of the digital product passport.

4. Registry users shall have the right to request deletion of their respective account if they are no longer responsible for activities related to the registry.

Article 11

1. The data model applicable to each product group shall, where available, be based on the delegated acts adopted pursuant to Article 4 of Regulation (EU) 2024/1781 or on other applicable Union law.

2. Where appropriate, the data models may build on existing Union semantic assets, controlled vocabularies and reference data models.

3. All data contained within a digital product passport shall be structured in accordance with the common data models and semantic definitions published in the semantic repository referred to in Article 12.

4. Data models shall be versioned.

Article 12

1. The Commission shall establish and maintain a digital product passport semantic repository, which serves as an authoritative and machine-readable source for the data models, semantic definitions and vocabularies applicable to digital product passports across all product groups. The semantic repository shall be developed and maintained in accordance with Regulation (EU) 2024/903 of the European Parliament and of the Council (16).

2. The semantic repository shall contain at least the following:

3. The metadata as referred to in paragraph 2 point (c) shall be in conformity with the DCAT-AP (17) specifications.

4. The Commission shall ensure that, for any data model attributes newly introduced in the semantic repository, the multilingual labels and definitions as referred to in paragraph 2 point (e) are published in the semantic repository.

5. The semantic repository shall include a search service to allow any user to read, search and retrieve semantic definitions and data structures.

6. The Commission shall ensure that the content of the semantic repository is accessible through publicly documented APIs. These APIs shall support common data formats and provide machine-readable semantic assets to facilitate automated use by external systems.

7. Access to and use of the semantic repository and its APIs shall be provided free of charge.

Article 13

1. The Commission shall provide a helpdesk service to ensure that economic operators, value chain actors, competent national authorities and customs authorities are able to receive technical support upon request. The helpdesk service shall operate year-round from 08:00 to 20:00 Brussels time. Further operational details shall be made available on the Commission’s website. In addition, the Commission shall develop by February 2029 an automated technical support tool, which shall be accessible on a 24-hour basis throughout the year.

2. Written exchanges between economic operators, value chain actors, competent national authorities or customs authorities and the helpdesk shall be stored for six months after the technical support request referred to in paragraph 1 has been closed and made available to market surveillance authorities upon request.

Article 14

1. The Commission shall establish, maintain and run a log system. The Commission shall ensure the creation of a complete, accurate and reliable audit trail in the log system.

2. In the log system the Commission shall log events relating to all of the following categories of actions:

3. To ensure that the data stored in the registry is processed securely and in compliance with Union law, the Commission shall keep the logs for a period of:

4. In the case of suspected incidents and for the purposes of audits and random checks of security performed by competent national authorities and customs authorities, the Commission shall make the relevant logs referred to in paragraph 2 available to the relevant national authorities.

5. The Commission shall implement appropriate technical and organisational measures to guarantee the security of all logs and protect their integrity, in particular against unauthorised or unlawful processing, accidental loss, destruction or damage. Such measures shall, at least, ensure the immutability and confidentiality of the logs.

Article 15

1. The Commission shall make available on its website guidelines and instructions on how to register and manage data in the registry.

2. The registry shall be accessible at all times, except during necessary maintenance activities such as the deployment of new software releases, and without prejudice to paragraph 3. In those instances, the Commission shall issue an advance notice of inaccessibility on the public website of the registry.

3. The Commission may suspend the availability of the registry, without prior notice, where it is necessary due to a malfunction, a cyber-attack or a compelling urgent security need, until the issue is resolved.

4. Where registration is prevented by the temporary unavailability or malfunctioning of the registry, the Commission shall record the date and time of unavailability and make such information available to economic operators, value chain actors, competent national authorities and customs authorities upon request for no less than five years.

Article 16

1. The Commission shall ensure the security of the registry and its components as referred to in Article 3. To that end, the Commission may conduct technical audits and random checks on the components of the registry.

2. For the purposes of paragraph 1, the Commission shall take the necessary measures in order to:

Article 17

Where the Commission identifies an inappropriate or fraudulent activity in the registry, including any such activity linked to massive data download, it shall take the necessary measures to prevent and counter that activity and mitigate the effects thereof.

Any user who becomes aware of, or has reasonable grounds to suspect, malicious behaviour in or against the registry shall immediately inform the Commission and, where appropriate, the Member States concerned.

Article 18

1. The Commission shall store the following personal data in the registry to ensure the verification of the identity of all users:

2. In the case of natural persons, it shall also be required to store personal identifiers, such as a passport number, national identity card number or national eID number, civil registry number, tax identification number issued by the relevant national authority of the respective Member State, or any third-country identifier that is assigned to a person or any documentation that identifies that person.

3. Personal data collected shall be processed in accordance with Regulation (EU) 2018/1725.

Article 19

1. A verified economic operator registering a digital product passport shall provide the Commission as manager of the registry with all information necessary for the registration, as provided for in Article 8. The verified economic operator shall be responsible for the accuracy and completeness of the information submitted at the time of registration.

2. The verified economic operator shall ensure that the information stored in the registry of the digital product passport is kept accurate, complete and up to date at all times.

3. The verified economic operator shall be responsible for implementing appropriate technical and organisational security measures for its IT systems and credentials used to access the registry, to prevent unauthorised access to or modification of registration data through its IT system.

4. Where a verified economic operator authorises a third party to perform registration actions in the registry on its behalf, the third party actor needs to follow the verification process in accordance with Article 5. The verified economic operator shall remain fully responsible for compliance with the obligations set out in this Regulation.

5. Each verified economic operator shall be responsible for the data it submits to the Commission as manager of the registry and shall be considered as the controller of the data it submits.

Article 20

1. Where a verified value chain actor authorises a third party to act on its behalf, the verified value chain actor shall remain responsible for compliance with the obligations set out in this Regulation.

2. A verified value chain actor shall be responsible for implementing appropriate technical and organisational security measures with regard to its IT systems and credentials that are used to access the registry, in order to prevent unauthorised access to or modification of registration data through its IT system.

3. Where Union law provides for value chain actors to upload any information to the digital product passport registry, each verified value chain actor shall be responsible for the data it submits to the Commission as manager of the registry and shall be considered as the controller of the data it submits.

Article 21

1. The Commission shall ensure that the data stored in the registry is processed securely and in compliance with Union law, including applicable rules on the protection of personal data.

2. The Commission shall be the owner of the registry and responsible for its management, including its development, availability, monitoring, updating, maintenance and hosting.

3. The data that the Commission can obtain from the registry may be transmitted to the relevant services within the Commission or to competent national authorities for the purposes of carrying out measures required under other Union legislative acts, including market surveillance, consumer protection and customs compliance.

Article 22

1. Where Member States create an interconnection with the registry, they shall be considered the respective owners of their information systems, including any components developed by Member States for the interconnection. Member States shall be responsible for the establishment, development, availability, monitoring, updating, maintenance and hosting of the components used to access the registry under their responsibility.

2. Member States shall ensure an appropriate level of security of the national components used to access the registry, in accordance with Union law. Member States shall inform, without undue delay, the Commission of changes and updates to the components under their responsibility that may affect the functioning, availability and reliability of the registry.

3. Member States may process the data from the registry. Where the Member States process data obtained from the registry, such data shall be processed in accordance with Union law.

4. When processing personal data for the purposes of carrying out their duties defined in Union law or under national law in compliance with Union law, Member States shall be regarded as controllers as defined in Article 4, point (7), of Regulation (EU) 2016/679.

5. Member States shall be responsible for any data processing activities carried out within their sphere of control, including:

Article 23

Within the monitoring and evaluation of Regulation 2024/1781 of its contribution to the functioning of the internal market, the Commission shall, by the end of 2032, and every six years thereafter, carry out an evaluation of this Regulation to take into account the functioning of the digital product passport registry and if appropriate present a draft proposal for revision.

Article 24

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.