Regulation (EU) 2025/2509 makes the Digital Product Passport a central conformity record for toys. It generally applies from 1 August 2030. The long lead time is justified: a toy passport must connect the product model, safety evidence, languages, online sales, customs and ten-year availability.
One passport for each toy model
Before placing a toy on the market, the manufacturer creates its DPP. The passport generally corresponds to a specific model and states that the requirements of the Regulation, especially the essential safety requirements, have been demonstrated.
The mandatory data set is defined in Part I of Annex VI. It includes the unique product identifier, manufacturer and authorised-representative information where applicable, a toy description, commodity code, conformity information and relevant warnings and safety instructions. Additional information from Part II may be included.
The data must be accurate, complete and up to date. The DPP must remain available for ten years after the toy is placed on the market, including after insolvency, liquidation or cessation of activity in the EU.
The data carrier must be visible before purchase
The carrier is physically present on the toy or an affixed label. Where the product's size or nature makes that impossible, it may be placed on packaging or accompanying documentation. Consumers and market-surveillance authorities must be able to see it before purchase, explicitly including distance sales.
For online retailers, a DPP link cannot appear only on the packaging after delivery. Marketplace and shop data need a digital copy of the carrier or an equivalent connection to the relevant toy model.
Where other EU law also requires information through a data carrier, a single carrier should be used. This is particularly relevant to electronic or connected toys that may also be governed by radio-equipment, cybersecurity or AI rules.
A model-level passport that can become more granular
The toy DPP begins at model level. If other Union legislation requires a passport at batch level for the same product, the toy passport may also move to that level. Companies therefore need a data model that supports both.
A robust identifier structure distinguishes:
- the durable model,
- variants such as colour or equipment,
- production batch and manufacturing site,
- individual items where recalls or other law require them.
These layers should not be improvised through changing URLs. A persistent product identifier should resolve to the correct current representation.
Safety information is not all public
The DPP serves several audiences: consumers, market-surveillance and customs authorities, notified bodies, the Commission and economic operators. They do not all need the same data. The Commission will further define access rights while protecting trade secrets.
Public information includes identity, manufacturer, warnings and safe use. Authorities need deeper conformity information. Detailed technical documentation, component lists and substance information may require protection.
The solution should not create several disconnected passports. A shared identity with role-based views, reliable authentication and audited updates is stronger.
Connection to conformity and Safety Gate
By creating the passport, the manufacturer assumes responsibility for conformity. Under defined conditions, the DPP may contain information that also fulfils EU declaration-of-conformity obligations under other legislation. The passport therefore becomes an active regulatory record, not merely a consumer webpage.
When accessed, it must also display a link to the relevant Safety Gate area for submitting information about toys that may present a risk. Recall and risk-management processes should consequently use the same product identity as the DPP.
Customs checks begin with consistent identifiers
The Regulation enables customs authorities to verify automatically whether a registered DPP exists for imported toys. The unique registration identifier and commodity code must be consistent with the EU Registry.
Importers and marketplaces need more than a visual inspection of the code. Before approval, they should verify:
- the exact model matches the DPP,
- the responsible economic operator in the EU is identified,
- the passport is registered and available,
- the commodity code is correct,
- required languages and warnings are present,
- the carrier remains visible in the online offer.
Six preparation workstreams
- Clean up product models and variants and assign unique identifiers.
- Map Annex VI data to product, quality and supplier systems.
- Connect the safety assessment, technical file and passport through one identity.
- Design public and protected access roles.
- Test the carrier across the toy, packaging and online offer.
- Secure ten-year availability, backup and provider portability contractually and technically.
The 2030 application date is not a reason to postpone the work. Toy ranges have long supply chains, many variants and many language versions. Structuring identity and safety data early allows the eventual DPP to be generated from reliable sources instead of assembling conformity files manually shortly before the deadline.
