EU Draft DPP Registry Regulation: What Manufacturers Need to Know Now

On April 29, 2026, the European Commission published the long-awaited draft Implementing Regulation for the central Digital Product Passport (DPP) Registry. The document specifies how the central registry established by the ESPR Regulation (EU) 2024/1781 is intended to function technically and organizationally. For manufacturers, importers, and distributors placing products on the EU internal market, the draft represents the first concrete set of requirements — even though it has not yet entered into force.

What the Central DPP Registry Is — and What It Isn't

A common misconception is to equate the Registry with the Digital Product Passport itself. The two must be clearly distinguished.

The central Registry is not a storage system for product information. It stores exclusively three elements:

the Unique Identifier (UID) of the product,
the resolver endpoint — the URL to which the system redirects,
the associated commodity code (e.g., under the Combined Nomenclature).

The actual product data — material composition, repairability, carbon footprint — remains with the economic operator or a service provider they have engaged. The Registry therefore functions as an address book, not an archive. When someone scans a QR code on a product, they first reach the Registry, which uses the UID to redirect them to the stored resolver. Only there are the actual DPP data delivered.

Verified Economic Operators as a Prerequisite

The draft stipulates that only verified economic operators may create entries in the Registry. The precise requirements for this verification process — for example, whether eIDAS-compliant authentication will be mandatory — are not yet fully defined in the draft and are likely to be clarified during the consultation process. For companies, this means: if you plan to manage Registry entries yourself, you need to engage with the onboarding process early.

Retention Obligations and Lifecycle Requirements

The ESPR Regulation requires that Registry entries remain available and up to date for at least 10 years after the last time a product is placed on the market. This requirement is not trivial: it means that a manufacturer who withdraws a model from the market in 2028 must continue operating the corresponding Registry entry and resolver endpoint until at least 2038.

For companies planning their DPP infrastructure today, this has immediate implications:

Resolver stability: The stored endpoint must remain reachable for many years. Short-lived cloud instances or internal development URLs are not a suitable foundation.
Organizational continuity: In the event of company sales, mergers, or insolvencies, it must be clearly defined who assumes the Registry obligations.
Data maintenance: If the resolver changes — for example, due to a provider switch — the Registry entry must be updated; otherwise, scans will lead nowhere.

Interplay with GS1 Digital Link

The draft does not mandate a specific identifier syntax, but in practice GS1 Digital Link is emerging as the de facto standard for UID structure. A GS1 Digital Link encodes the GTIN, serial number, or batch number directly in a URL-compatible syntax — which simplifies integration with the Registry concept.

A typical GS1 Digital Link for an individual product looks like this:

https://id.example.com/01/04012345678901/21/ABC123

Here, 01 represents the GTIN application identifier and 21 represents the serial number. The resolver at id.example.com can use this structure to serve different link types — such as gs1:sustainabilityInfo for DPP-relevant sustainability data or gs1:epcis for traceability events. By using GS1 Digital Link, you can route to different datasets via structured link types without ever changing the QR code itself.

In practice, this means a single QR code on a product can serve the Registry entry while also directing consumers to a product page, repair technicians to technical documentation, and authorities to conformity documentation — depending on the context of the request.

What This Means for Existing QR Code Infrastructure

Companies currently using static QR codes that point directly to a fixed URL will need to update that infrastructure. A static QR code pointing to a hardcoded product URL cannot be retrofitted with Registry functionality — the code itself is immutable. Dynamic QR codes that redirect through a resolver are far more flexible, because the target endpoint can be updated at any time without changing the printed code.

Timeline: Batteries First, Textiles to Follow

The draft Registry Regulation is not a standalone document — it is part of a staged regulatory roadmap. The first product-specific regulations are scheduled to take effect in 2026 and 2027 under the ESPR timeline, with batteries and textiles leading the way.

Specifically: from August 2026, all batteries sold in the EU must carry visible QR codes and provide information on capacity, chemistry, and hazardous substances, as required by the Battery Regulation (EU) 2023/1542. For battery passport obligations that go beyond basic labeling, phased deadlines apply depending on battery type.

At the same time, the GS1 Sunrise 2027 deadline is approaching — the point at which retail point-of-sale systems must be capable of reading 2D barcodes. This means brands that continue to delay GS1 Digital Link QR code adoption are facing a time crunch from two directions simultaneously: regulatory pressure from ESPR and the Battery Regulation, and commercial pressure from Sunrise 2027.

Open Questions in the Draft

The draft leaves several points unresolved that will need to be addressed in the further legislative process:

Interoperability between national registries and the central Registry: Some member states are discussing supplementary national registries. How these will interact with the central EU Registry is not specified.
Liability in the event of resolver failure: Who is liable if a Registry entry points to an unreachable endpoint — the economic operator, the resolver operator, or no one?
Costs and access conditions: The draft is silent on fee structures. Whether the Registry will be freely accessible or subject to usage fees remains open.

Recommendations for Companies

The draft does not yet have legal force, but the direction is clear. Companies that act now will avoid last-minute adaptation pressure:

Define your identifier strategy: Decide whether you will use GTINs with GS1 Digital Link or proprietary UIDs. Migrating later is costly.
Build resolver infrastructure: Plan for a long-lived, maintainable resolver solution — not ad hoc redirects.
Clarify internal responsibilities: The 10-year retention obligation is an organizational requirement, not just a technical one.
Monitor the consultation process: The Commission will open the draft for public comment in the coming months. Industry associations and individual companies can submit feedback.

The next key date for the industry is the GS1 General Assembly 2026 in Warsaw, where standards updates and DPP implementation questions are expected to be on the agenda.

The Registry Regulation is not a peripheral bureaucratic exercise — it lays the technical foundation for the entire DPP ecosystem in the EU. Companies that make their architecture decisions now will face significantly less effort in 2027 and 2028 than those who wait.