Who Is Responsible for the Passport?

Product regulation in the EU attaches duties to roles rather than to companies. Understanding which role you occupy for a given product decides everything else, and companies frequently occupy different roles for different lines without noticing.

The operative concept is placing on the market — making a product available in the EU for the first time. Whoever does that carries the passport obligation, regardless of who manufactured the item or where.

The roles, and what each one owes

The importer row is the one that surprises people most often. A company importing finished goods is not a reseller in the regulatory sense; it stands in the manufacturer’s shoes for the purposes of EU product law and must be able to evidence the passport data it publishes.

Private label inverts the intuition

When a product is placed on the market under a retailer’s own brand, the retailer generally becomes the responsible operator. The factory that made it is a supplier, and its regulatory exposure runs through the contract rather than through the regulation.

This has a practical consequence that retailers often discover late. A grocery or general merchandise chain with a substantial own-brand range is a manufacturer for regulatory purposes across dozens of product groups simultaneously, without a manufacturing function to hold the data.

What a platform can and cannot take on

A passport service provider can host the record, serve it through a resolver, maintain uptime and provide an audit trail. It cannot become the economic operator, and any commercial arrangement suggesting otherwise misdescribes how the regulation works.

• A vendor can be accountable for availability — that the passport resolves, stays online and serves the right view to the right audience.
• A vendor cannot be accountable for accuracy of a figure you supplied, because it has no way to know what your supplier actually measured.
• A vendor can be accountable for retention and for exporting your data in standard formats if you leave.
• A vendor cannot absorb enforcement risk. An authority contacts the operator named on the product, not its software supplier.

Contract manufacturing and where data lives

Responsibility and data possession diverge most sharply under contract manufacturing. The brand owns the obligation; the contract manufacturer owns the bill of materials, the process parameters and the supplier relationships that produced them.

Neither party can discharge the duty alone, which makes the manufacturing agreement the real compliance instrument. Agreements written before ESPR typically say nothing about attribute-level data provision, retention periods or the right to audit a claim, and renegotiating them takes a contract cycle you may not have.

The practical move is to add the attribute schedule to new and renewing agreements now, naming the fields, the format, the update trigger and who signs each assertion. That is a small clause with a large effect on whether the data arrives at all.

When one company holds several roles

Most mid-sized manufacturers occupy more than one role without having mapped it. They manufacture some lines in the EU, import others as finished goods, and distribute a third set made by somebody else under that maker’s brand. Each of those carries a different duty for the same legal entity.

The failure this produces is uniform treatment. A company that applies its manufacturer process to imported goods over-invests; one that treats imports as distribution under-invests and carries an obligation it has not resourced. The remedy is a line-by-line role map, which is an afternoon of work and rarely done.

Marketplaces and cross-border sales

Online marketplaces occupy a role that has tightened considerably. Where a third-party seller outside the EU offers goods to EU consumers, the regulatory framework increasingly requires an operator established in the Union to be identifiable and responsible.

For a brand selling directly into the EU from outside it, the question is therefore not whether an EU-established responsible party is needed but which one it will be — an importer, an authorised representative, or a fulfilment provider standing in by default. Choosing deliberately is better than discovering the answer during an inspection.