EU DPP Registry: All You Need to Know

On 20 July 2026, the European Commission launched the EU Digital Product Passport (DPP) Registry under Article 13 of the ESPR (Regulation (EU) 2024/1781). The Registry is not a database of product data. It is a directory: for a given product, it points to where the passport data is hosted. It is infrastructure going live, not a new wave of mandatory passports, but it changes the logic of market access for the categories it covers.

Last updated: 8 October 2026.

Where the Registry Stands (October 2026)

The Registry is live, but still being built out.

Works today

• EU Login access

• Enrolment and verification of your organisation, in production and in the test environment

• Trial registration of passports in the test environment, with the passport URL and granularity level

Not available yet

• API access

• Complete passport registration: the semantic catalogue for batteries, the first product group, is not final

What the Registry Is (and What It Is Not)

The Registry is an index, not storage. For each passport it records a small set of data: the unique product identifier (a URL pointing to where the passport is hosted), the registering operator and, where required, data such as the commodity code. The passport content stays with the operator or the DPP platform they choose.

Authorities use the index in two ways:

• Customs can check electronically, before releasing imported goods, that a valid registered DPP exists.

• Market surveillance authorities can find the registered passports of a product group and follow the link to the hosted data.

For you, that means two separate tasks: hosting a passport that is always reachable, and registering its identifier.

The Legal Framework in Brief

• Implementing Regulation (EU) 2026/1778 of 16 July 2026 sets the Registry's rules: access management, user verification, registration data and architecture. Its operating rules apply from 6 August 2026.

• Six harmonised CEN/CENELEC standards have applied since 15 July 2026 (Implementing Decision (EU) 2026/1736), including EN 18219 (unique identifiers), EN 18220 (data carriers) and EN 18223 (system interoperability).

• Registry components: a web interface, an API (announced, not yet available), a verification platform and an identifier scheme. Behind them sit the list of verified operators, a semantic repository of data models per sector and a log system.

The Market-Access Logic

Once a product category is covered by an applicable delegated act, a product can only be placed on the market if its passport exists and is registered. Registration stops being an administrative afterthought and becomes a precondition for market access. Customs and market surveillance authorities will query the Registry directly, so a covered product without a valid entry is exposed to enforcement risk from the day its category's mandate applies, not before.

What the Registry Actually Checks

• Discoverability: given a product identifier, does a passport exist and where is it hosted.

• Technical verifiability: per the Commission's 7 July 2026 webinar, the check is limited to two points: mandatory fields defined by the sectoral legislation are present, and the data is correctly formatted. The Registry does not validate the accuracy of the passport's content.

Responsibility for the content, and the liability that comes with it, stays with whoever hosts the data.

How to Get Verified: Step by Step

Before any passport can be registered, your organisation must be enrolled and verified. According to the Commission's user guide for economic operators, the process runs as follows.

Where to start: the entry point is the Commission's DPP Registry page, which links to the live Registry, the test environment and the user guide. You can also go directly to the production Registry or to the test environment, which needs its own EU Login account.

1. Create an EU Login account. It is a personal account: use a personal work address, not a shared inbox. Production and test environments each need their own account.

2. Add a second authentication factor. A password alone does not work for the Registry. The simplest option is a passkey, registered in "My Account" on EU Login's own sign-in page (the Registry's sign-in page does not offer password-only access). Alternatives are the EU Login mobile app, a security key or a national eID.

3. Enrol your organisation. Choose the organisation type: a legal person (company, verified with a qualified electronic seal) or a natural person (sole trader, verified with a qualified electronic signature). Enter the registered name, address, country and one official identifier, plus a compliance contact. If a colleague has already enrolled your company, ask for an invitation instead of enrolling it again.

4. Request the declaration. Enter your legal representative's details. The Registry generates a PDF declaration, already sealed by the Commission. Do not modify it: any change other than your own seal breaks the Commission's seal.

5. Seal or sign the PDF with a qualified certificate. It must be a qualified seal or signature from a provider on the EU/EEA trusted lists, used from a qualified device or remote signing service (not a software certificate file), and embedded in PAdES Baseline format. The legal name, country and identifier in the certificate must match your form exactly.

6. Upload and verify. The Registry runs automated checks and returns PROCESSING, SUCCESS or FAILURE. On success you become the organisation's administrator.

Order the qualified seal first. The provider has to check your identity, which makes it the longest lead time of the whole process. The Commission's free validation tool lets you check your sealed file before uploading.

Validity: verified status lasts until your certificate expires and for at most three years. After that you must repeat the verification before registering new passports or changing existing ones.

Value chain actors (suppliers, recyclers and others who interact with the Registry without placing products on the market) follow the same verification and receive "verified value chain actor" status. Verified operators may delegate access rights to third parties, but remain responsible for what is registered in their name.

After Verification: Registering Passports

• Identifiers: you provide a Unique Product Identifier (an https:// URL resolving to the hosted passport) and the Registry issues a Unique Registration Identifier.

• Submission: an online form for single passports, or a JSON or XML file upload for up to 100 passports per file. If one entry fails, the whole file is rejected. API registration is provided for by the regulation but not available yet.

• Granularity: model, batch or item level, depending on the product legislation. For batteries, only item level is available.

• Proof of registration: a Commission-sealed, time-stamped proof can be generated and shared with customers or third parties, and stays available for 90 days.

• Cost: the Commission does not charge for the Registry. Your costs are the qualified seal and the hosting of the passport data.

Most businesses will not interact with the Registry directly: a DPP platform can handle registration once a passport is published. Whichever route you take, the operator remains responsible. Battery data requirements are covered in our battery passport guide.

Common Pitfalls

• Ordering the qualified seal last.

• Form data that does not match the certificate (including legal form and formatting).

• Using a software certificate file or a signing tool that does not produce PAdES.

• Editing the declaration before sealing it.

• Using one EU Login for both test and production.

• Enrolling the same company twice.

• Forgetting the three-year limit on verified status.

What This Does Not Change (Yet)

Two other ESPR-related dates are often confused with the Registry: the unsold-goods destruction ban for large enterprises (also from 19 July 2026) and the Right to Repair Directive (applicable from 31 July 2026). Neither is the Registry itself.

What to Do Now

1. Confirm your product category and its delegated act status before assuming urgency or time. Our Data Readiness Assessment shows what applies to your category.

2. Order your qualified seal or signature now, then enrol and verify. This is a prerequisite for every category, and the test environment is a safe place to practise.

3. If you are in batteries, treat this as the real start of your February 2027 countdown.

4. If your category has no finalised delegated act, structure your data against the current best estimate rather than waiting.

5. Choose a DPP platform that handles Registry registration for you. Compare providers in the DPP Pro directory.

The Bottom Line

The Registry is the plumbing every future DPP mandate will run through. The parts that take time are outside the Registry itself: a qualified seal with exactly the right attributes, and a legal representative able to apply it. Operators who prepare now will be able to register on day one of their category's deadline.

Sources: European Commission DPP Registry page and user guide for economic operators; Implementing Regulation (EU) 2026/1778; Implementing Decision (EU) 2026/1736; Commission webinar of 7 July 2026; itemactive's hands-on walkthrough of the test environment (October 2026).