Regulatory compliance

When you leave this page, you will know which European digital passport obligations weigh on your products today, which ones do not exist yet, and which dates are written into a legal text. You will also know, requirement by requirement, what SealTrust covers and what it does not.

#Two texts, two logics

Brands almost always ask us the same question: by what date do we have to be ready. The answer depends on which text concerns you, because the two main ones work in opposite ways.

#The ESPR sets a framework, then switches it on category by category

Regulation (EU) 2024/1781 on ecodesign for sustainable products, known as the ESPR, has been in force since July 18, 2024. It targets almost every physical product placed on the Union market, whatever the size of the company and its country of establishment.

It is a framework regulation. It creates the digital product passport, then switches it on product group by product group. Each group gets its own delegated act, generally with a transition period of about eighteen months. There is therefore no single switch-on date for the ESPR passport.

The consequence is direct. As long as the delegated act for your category is not adopted, no list of mandatory fields applies to you. No supplier can hand you the compliant list for textiles, electronics or construction today, because that list is not written yet.

#The battery regulation carries its date in its own text

Regulation (EU) 2023/1542 on batteries works differently. The passport obligation is written into article 77, with a firm date: the battery passport is required from February 18, 2027. The expected content is described in Annex XIII of the same regulation.

The scope covers three families: electric vehicle batteries, industrial batteries above 2 kWh, and light means of transport batteries, for example those of electric bikes and scooters. Portable batteries and starter batteries stay outside this scope.

It is also the only category whose passport level is known to date: each battery carries its own.

#The dates, firm and indicative

The table separates what is written in a legal text from what remains a forecast. The "Status" column is the only one that matters when arbitrating a budget.

The console renders six of these entries, without the row on the European registry. It picks them according to the passport template attached to your product model: a battery model displays the battery regulation, a textile model displays the textile delegated act and the ESPR framework, an electronics model displays the smartphone regulation and the EEE part of the ESPR. The state of the European registry is displayed elsewhere, in the "Readiness" tab.

#The passport level decides your budget

The ESPR provides, in its recital 33, that delegated acts examine the establishment of information requirements through a digital passport at the level of the model, the batch or the item. The level is therefore decided act by act, product family by product family.

Today, only batteries have a known level, and it is the item. For every other category, the level is not set.

This point drives your labeling bill. A model passport calls for one record per catalog reference. An item passport calls for a unique identifier per manufactured piece, so unit-level marking across the whole production run. The gap is counted in factors of one hundred or one thousand.

SealTrust attaches a passport to a product model, to a production batch, or to one specific item. The three levels of the text are served.

• The reference passport, attached to the model, is shared by every item of that model. It is read at /01/{gtin}.
• The batch passport is shared by every item of one batch. It is attached to the model through the batch, starts from the model's data, and carries what is specific to the batch: substances, sites, operators. It is read at /01/{gtin}/10/{lot}, where 10 is the GS1 application identifier of the lot number. It is sealed and anchored on chain like the others, without any token being created.
• The item passport carries the data specific to one unit, for example the state of health of a battery.

#Requirement by requirement, what SealTrust covers

#A unique identifier carried by a data carrier

The ESPR provides that the delegated act of each product group specifies one or more data carriers. Carrying both a QR code and a chip is therefore provided for by the text.

Every item created in SealTrust receives a public serial number of twelve characters, drawn at random. That number resolves at https://sealtrust.io/p/{serial}, where {serial} is the number itself. That is the address printed in the QR code.

The QR code alone is enough to identify a product and reach its passport. An NFC seal is added when you want a proof of originality carried by the chip itself. The battery passport template shipped with SealTrust declares the QR code as the carrier, which is what the battery regulation requires.

#Machine-readable data, in standardized vocabularies

The ESPR requires, in its article 10, paragraph 1, point (d), that the passport rely on standardized vocabularies.

SealTrust renders the passport in JSON-LD, with the Schema.org and GS1 Web Vocabulary vocabularies. You get this format by adding format=jsonld to the public read of an item.

curl "https://api.sealtrust.io/v1/passport/000000000000?format=jsonld"

const response = await fetch(
  "https://api.sealtrust.io/v1/passport/000000000000?format=jsonld"
);
const passport = await response.json();
console.log(passport["@context"]);

import requests

response = requests.get(
    "https://api.sealtrust.io/v1/passport/000000000000",
    params={"format": "jsonld"},
    timeout=30,
)
passport = response.json()
print(passport["@context"])

The rendered document declares three namespaces: https://schema.org/ by default, gs1 for https://gs1.org/voc/, and espr for https://data.europa.eu/espr/.

#Layered access, according to who is reading

The ESPR names fourteen categories of actors who must have free and easy access to the passport, among them customers, professional repairers, refurbishers, recyclers, market surveillance authorities and customs authorities (Article 11, point b). The list ends with "and other relevant actors", so it is open.

⚠️ The regulation itself sets no access tier. It defers the split of rights to the delegated acts specific to each product group (Articles 9(2)(f) and 10(1)(g)), and none of those acts is published to date.

SealTrust therefore ships six default tiers, aligned on the five-tier model proposed by the Commission Joint Research Centre's DPP methodology (JRC145830, Annex 8), with the public tier split into anonymous access and end-user access. That report is a scientific document with no legal force. Our tiers are reconfigurable field by field, which is exactly what is needed while the final matrix does not exist. They are asked for through the access_tier parameter:

The end_user tier, the three professional tiers and the authority tier require authentication. An anonymous call that asks for one of them receives 401. An authenticated call without the matching accreditation receives 403.

The three professional tiers, repairer, recycler and upstream, are different audiences. None of them contains the others. Each of them inherits the public tier and the end user tier, then adds what its trade calls for, and nothing more: a repairer does not see the recycler's substances, a recycler does not see the manufacturing origin. That is the only property that makes need-to-know hold up.

upstream deserves a clarification, because it surprises people: no partner accreditation opens it. It is reserved for the accounts of the brand itself and for surveillance authorities. The two accreditations you can grant to a partner are repairer and recycler.

We provide default values. You can replace them with your own rules, section by section, in the "Access Rules" tab of the console. The full table of the fields served at each tier is in the guide Digital Product Passport.

#The EU declaration of conformity

The passport carries a dedicated section, separate from the compliance block. The two answer different questions: the compliance block says which standards apply to this product, the declaration carries the document through which you take responsibility.

You fill in the declaration number, its date and place of issue, the legal person under whose responsibility it is issued, its postal address, the object of the declaration, the Union legislation covered, the harmonised standards applied and, where the procedure requires it, the notified body with its identification number, the procedure followed and the reference of its certificate.

The address is not a formality. Decision 768/2008/EC makes it the second item on the list, and a market surveillance authority has to be able to write to someone: a declaration that does not say where to reach the responsible party does not do its job.

Two choices are worth explaining, because they affect you.

A field left empty is not published. The whole section stays absent until something is filled in. An empty block would assert that a document exists without saying anything about it, and once published it would be sealed and timestamped permanently.

No field collects the name of a natural person, and that is not an oversight. The passport hash covers its entire content, and that hash is written on chain: a name entered here would be written there permanently, whatever access level is chosen. We therefore carry the legal person who is bound, never the signatory. The signed document itself stays linked by its address.

⚠️ A consequence worth knowing: what we publish is not the complete declaration in the sense of the annex to Decision 768/2008/EC, since the signature is not part of it. The document you link carries that.

This section exists today for batteries and electronics. CE marking does not apply to every category, so adding it everywhere would invent obligations.

#Substances of concern

The ESPR handles substances of concern in its article 7, paragraph 5. It calls for identifying them, saying where they sit in the product, at what concentration, and which safety instructions apply.

The console carries a "Substances" tab dedicated to these declarations. A declaration is attached to a product model, and optionally to one specific component. It accepts:

These declarations feed three outputs: the signed attestation of the passport, the JSON-LD export of the console, and the readiness score described further down. In those outputs they sit under the substances_of_concern section, served at the recycler, upstream and authority tiers, and closed at the open tiers.

#The European passport registry

The ESPR provides, in its articles 12 and 13, for a central European registry. That registry is an index. It does not host the data of your passports. It records the unique product identifier, called UPI, and the address at which the passport can be reached. It checks by itself that this address answers.

SealTrust builds that record for you. For an item, the UPI is the short address https://sealtrust.io/p/{serial}. For a batch, it is the GS1 link of the batch, https://sealtrust.io/01/{gtin}/10/{lot}. The record states its level in the level field, item or batch, because the registry records a passport at the model, batch or item level. It also carries the GTIN of the model when it has one, the version of the passport, its hash, and the economic operator identifiers filled in on your brand. The model level has no record yet.

Four constraints of the registry are known. The UPI must be an https address. It must answer, and resolving it must not take more than three redirects. Its length depends on the submission channel: the registry's web form caps at fifty characters, while file upload accepts eight to two thousand characters, in XML as in JSON. We produce files, so the file bounds are the ones that apply to your records. We check the length before any submission and we set aside from the file any record that falls outside those bounds, because a single invalid record gets a whole file rejected.

You obtain that file today by asking SealTrust for it, for one item, for a batch, or for a list of items designated by their serial number. For a batch, the file carries either every item of the batch, or the single record of the batch passport, as you choose. No console screen produces it yet. The file comes with the list of the identifiers that were set aside, with the reason for each exclusion. An item withdrawn from sale is not in it.

The file only contains batteries. The product group it declares is read from the product itself, never from the request: the "Battery" category, the battery passport template chosen for the product model, or a published passport shaped like a battery passport. The product name does not count. A product that no registry group covers, a perfume or a bag for instance, goes into no file: it is listed among the identifiers set aside, with that reason. No registry group covers it today, the only one being batteries, whose passport is required from 18 February 2027. If a batch or a list mixes several groups, each group gets its own files, since a file declares a single group.

In the console, the "Readiness" tab displays the state of the connector to the registry. As long as sending is not switched on, the registration request returns the complete record we have built, without any network call. You see the content before it leaves.

#The back-up copy at a service provider

Article 10(4) provides for a back-up copy of the passport kept by a digital product passport service provider. It matters the day the manufacturer, or SealTrust, stops trading: the passport printed on a product already sold must stay available. Annex III point (l) wants the passport to carry that provider's reference.

What is copied. Every sealed version of your passport, in full, and not only what the public reads. The copy holds the version's data, its hash, its place in the chain of versions, and what is needed to find it again: serial number, GTIN and brand name. A draft is never copied.

Where. In storage held by the provider, separate from ours, under access keys separate from ours. A copy kept in the same place as the original would disappear with it.

When. Within fifteen minutes of a version being sealed. Publishing never depends on the provider: if it is unavailable, the copy is simply taken on the next pass.

How you know it is sound. A copy only counts once it has been read back from the provider and found identical byte for byte. A version whose data no longer matches its seal is not copied: copying it would launder a change. Every day, a sample of copies is restored from the provider and checked from its own content alone, without our database.

What the passport shows. The provider's name and identifier, and the date of the copy, as soon as the copy of the version on display exists. Not before: we do not show a reference that nothing backs. If a copy fails its check, the passport stops naming the provider (the copy was lost, altered or unreadable at the provider), and the copy is taken again on its own at the next pass. A mere provider outage during the check does not count as a failure: the reference stays on display and the copy is checked again later. The same reference appears in the JSON-LD format, under espr:passportServiceProvider.

#The battery passport in detail

The battery passport template shipped with SealTrust follows the categories of Annex XIII of Regulation (EU) 2023/1542. It applies to electric vehicle batteries, to industrial batteries above 2 kWh and to light means of transport batteries.

Three reading points matter for compliance.

Point 1 of Annex XIII is entirely public. All its items, from (a) to (s), are accessible to everyone. On top of the identity and the general specification, the public tier therefore serves the hazardous substances, the critical raw materials, the carbon footprint with its performance class, the link to the due diligence report, the post-consumer recycled content for cobalt, lithium, nickel and lead, and the share of renewable content.

Points 2 and 4 are restricted. The regulation opens them to persons with a legitimate interest. Seven fields are therefore served only at the trade tiers: the part numbers, the battery status, the expected lifetime in cycles and in years, the spare parts contact, the dismantling instructions and the fire safety sheet. A signed-in customer account does not see them, because a consumer is not a person with a legitimate interest in the sense of the regulation.

The state of health is restricted and specific to the unit. We serve those dynamic data at the repairer, recycler and authority tiers. They stay closed to the public and to the upstream tier. A state of health value only holds for one given physical battery, which matches the item level chosen by the regulation.

⚠️ This split applies to battery passports only. The other categories keep the general split: their carbon footprint stays at the customer tier, and so does their expected lifetime.

#What the console gives you to steer with

The console gathers DPP compliance in a single area, under "DPP Compliance", with seven tabs: Readiness, DPP Templates, Substances, Vocabulary, Access Rules, EPCIS and DPP Passports.

The "Readiness" tab computes a readiness score from 0 to 100 per product model. The score is spread over seven dimensions, with the following weights:

Throughout this score, a field counts as filled only when it carries an answer. Blank text, an empty list or a block whose rows are all empty do not. A 0 or a "no" you declare does: it is an answer.

The "Evidence" dimension measures the actual coverage of your units. It counts five factors of equal weight: the share of items carrying a published passport, a signed attestation, a data hash, an IPFS copy and an active certificate of authenticity. It answers the first question an auditor asks: on how many pieces.

For the models attached to the battery or consumer electronics passport template, a sixth factor is added: the presence of at least one substance declaration, or the statement in the passport that no substance is present above the threshold. Either one is enough.

The console records the score over time, which traces a curve. A point is added only when the score changes. The last year is kept in detail, then one point per month remains. A drop of more than five points against the previous measurement raises an alert.

Two exports go with the score. The evidence pack in PDF format exists for a product model and for your whole brand. The regulatory calendar takes up the six regulatory entries described above, picked according to the passport template attached to the product model.

#What SealTrust does not cover

This list is as important as the previous one.

• Filing with the European registry in your place. We produce the record and the file. Your company does the enrollment and the upload, with its own qualified electronic seal.
• A console screen for the filing file. No screen produces it yet. You ask SealTrust for it.
• The final mapping of the registry fields. The semantic catalog of the Commission is not published. Our record follows our own shape in the meantime.
• The registration of a reference passport with the registry. The registration path starts from the serial number of one unit, or from a batch.
• Returning substance declarations through the JSON read of the passport. They go through the signed attestation and through the JSON-LD export.
• A compliant list of fields for textiles, electronics or construction. Our passport templates for these categories are anticipatory. They take up data that these sectors already produce elsewhere. They cannot be compliant with a delegated act that does not exist.
• The link between a passport and the one of the original product. Article 11(d) asks that a new passport, created for a product that already had one, be linked to the original passport. Our return, warranty and buy-back journeys do create events, but none of them sets that link. So a refurbished product's passport does not point at the previous one.
• The choice of the back-up provider. The copy mechanism exists, but copying only starts once a provider has been appointed by contract. Until then, no copy is taken and your passport names no provider. Ask us who keeps the copy of your passports.
• Somewhere to put your registry registration identifier. The day you file and receive yours, the passport has no field to carry it. The commodity code of article 13(1) is also missing from the record we build, even though the data is already in your product model.
• A standardised facility identifier. Annex III point (i) asks for an identifier compliant with ISO/IEC 15459 for the production site. Our production_facility field is free text.
• The permanence of the identifier after a re-encode. Article 10(1)(a) asks for a persistent identifier. Here, erasing a carrier then encoding a new one on the same physical object gives it a NEW identifier.
• Legal advice. We describe legal texts and a product.

#Where to start

Four steps, in this order, whatever your category.

1. Determine whether a firm date concerns you. If you manufacture electric vehicle batteries, industrial batteries above 2 kWh or light means of transport batteries, your date is February 18, 2027 and your level is the item. In every other case, no passport date applies to you today.
2. Set the level of your passport. Model or item. That choice decides the marking to order, and it corrects badly once the production run is labeled.
3. Structure identity and data. A unique identifier per product, a durable data carrier, a composition and suppliers filled in per reference. That work stays valid whatever the delegated act that will come.
4. Measure. Publish a passport on one reference, look at the readiness score, deal with the gaps it names, and export the evidence pack.

#What to remember

• The ESPR has been in force since July 18, 2024, and it switches on category by category. No single passport date exists.
• The battery regulation carries a firm date in its own text: February 18, 2027, for electric vehicle batteries, industrial batteries above 2 kWh and light means of transport batteries.
• The delegated act of each family decides the passport level, model, batch or item. Only batteries have a known level today.
• SealTrust covers the unique identifier, the data carrier, the JSON-LD render, layered access, substance declarations and the building of the record for the European registry.
• SealTrust does not file with the registry in your place, and cannot deliver a compliant list of fields for a category whose delegated act is not published.