Which Products Need a Digital Product Passport?

This is the first question every compliance team asks, and the honest answer has two halves that people tend to conflate. Which products can be covered is settled — it is nearly everything. Which products are covered today is a much shorter list, and it changes as delegated acts are adopted.

Confusing the two produces both failure modes: teams who conclude "this does not apply to us" because no act names them yet, and teams who panic-buy a platform three years before their obligation exists.

What does the ESPR actually cover?

The Ecodesign for Sustainable Products Regulation (EU) 2024/1781 applies to physical goods placed on the EU market, including components and intermediate products. That last point is routinely missed: you can be in scope as a supplier of a part, not only as the brand selling the finished item.

The framework replaces the older Ecodesign Directive, which was limited largely to energy-related products. The ESPR removes that limitation. Its default position is inclusion, with a short list of explicit carve-outs.

How do I tell whether my product is in scope today?

Work through these in order. The sequence matters, because each step can end the enquiry.

Which product groups are expected first?

The Commission publishes a working plan signalling the groups it intends to regulate and roughly when. These are indicative — they are planning signals, not legal deadlines — but they are the best forward view available.

What about components and intermediate products?

This is the most commonly missed part of the scope question. The ESPR explicitly reaches intermediate products, so a delegated act can require passport data from a component that is never sold to a consumer.

The practical effect is a chain of obligations. A finished-goods brand cannot declare recycled content it does not know, so the requirement propagates upstream until it reaches whoever actually measures the material. That party may be several tiers away and may have no direct EU market presence at all.

• If you sell finished goods, your obligation is to produce the passport — but most of the data is not yours to produce.
• If you sell components, you may be in scope directly, and you will certainly be asked for data by customers who are.
• If you import, the obligation sits with you where the manufacturer is outside the EU, which makes supplier contracts the critical control.
• If you are outside the EU entirely, market access is the lever: the requirement reaches you commercially even where it does not reach you legally.

What should you do if your group is not named yet?

The temptation is to wait, and the arithmetic argues against it. A transition period of roughly 18 months sounds generous until you break down what has to happen inside it.

Only the last row genuinely depends on the delegated act. Everything above it can be done now, and the contract row alone can exceed the entire transition period if it starts late.

The useful framing is that a delegated act tells you which fields to report. It does not tell you whether you can get the data. That second question is the one that decides whether you make the deadline, and you can start answering it today.

What happens if you are in scope and do not comply?

The ESPR leaves penalties to member states, so the specific consequence depends on where the product was placed on the market. What is consistent across the EU is the mechanism: market surveillance authorities can require corrective action, restrict or prohibit sale, and order withdrawal or recall.

For most manufacturers the commercial consequence arrives before the legal one. Retailers and distributors will not knowingly stock a product that cannot lawfully be sold, and a missing passport is trivially detectable — unlike many compliance failures, it is visible from outside the company simply by scanning the product.

• Market access is the primary sanction. A non-compliant product can be refused entry or removed from sale, which is usually more costly than any fine.
• Detection is cheap for regulators. Machine-readable data means checking can be automated at scale rather than done document by document.
• Inaccurate data is its own exposure. A passport asserting recycled content you cannot evidence is a substantiated-claims problem as well as an ESPR one.
• Your customers will check before regulators do. Downstream buyers subject to their own obligations will require passport data contractually.

A note on over-scoping

The opposite error is real too. Some organisations respond to uncertainty by attempting a passport for every SKU at once, which produces a large, low-quality dataset nobody trusts and a programme that stalls under its own weight.

A better first move is one product line, end to end, with real supplier data and honest gaps recorded as gaps. That surfaces every structural problem — missing tier-2 relationships, incompatible units, suppliers who simply will not answer — at a fraction of the cost, and produces a template rather than a backlog.