CEN CENELEC Standards for Digital Product Passport: Complete Guide 2026

The EU Digital Product Passport now has a technical rulebook. On 27 May 2026, CEN and CENELEC published the first six harmonized European standards developed by Joint Technical Committee JTC 24, the body responsible for translating ESPR's legal obligations into operational infrastructure. Two additional standards covering security and data authentication are expected in September 2026, completing a set of eight. This is no longer a "watch and wait" situation: the technical baseline is fixed, and you can start building against it today.

What is CEN/CENELEC JTC 24, and why does it matter?

CEN/CENELEC JTC 24 is the Joint Technical Committee mandated by the European Commission under Standardisation Request M/604 to develop the harmonized standards underpinning the Digital Product Passport (DPP) under ESPR (EU Regulation 2024/1781). It does not define what data goes into a DPP (that is left to sector-specific delegated acts). It defines how that data must be structured, exchanged, identified, stored, and secured across all systems and supply chains in the EU.

Think of ESPR as the "what" and JTC 24 as the "how". Without JTC 24 standards, every company would build its own proprietary DPP format, creating a fragmented, non-interoperable patchwork that defeats the entire purpose of the regulation. A battery manufacturer in Germany, a textile producer in Italy, and an electronics supplier in France would each create incompatible systems that regulators, recyclers, and customs authorities cannot read.

JTC 24 organised its work into four working groups: WG1 (strategic advisory), WG2 (unique identifiers and data carriers), WG3 (security), and WG4 (interoperability framework). The eight standards map onto WG2, WG3, and WG4. Since April 2024, over 200 technical meetings have been held, mobilizing national standardization bodies from 34 European countries. The drafts went through public enquiry in mid-2025 and formal vote in early 2026.

Important nuance: available does not mean harmonised

These six standards can be purchased and implemented today. However, they only confer a legal "presumption of conformity" with ESPR once they are cited as harmonised standards in the Official Journal of the European Union. That citation step has not yet occurred. The right posture now is: build to these standards, and track harmonisation status before relying on them for legal presumption.

The 3-layer DPP architecture these standards define

The clearest way to understand the EN 182xx series is as three distinct layers working together:

• Sectoral acts define the content — the Battery Regulation says what a battery passport must contain, an ESPR delegated act does the same for textiles or furniture.

• The eight JTC 24 standards define the system — identity, carriers, exchange, structure, storage, access, and authentication, once, for every product category.

• The EU DPP Registry is the coordination point — it holds the unique identifier and metadata of every passport, while the passport content itself stays decentralised with the operator or a DPP service provider.

This decentralised-but-coordinated design means the European Commission does not run a giant central database of every product's data. It runs a registry of pointers, and the JTC 24 standards ensure that whatever sits behind each pointer is identifiable, reachable, interoperable, and verifiable. The EU DPP Registry is scheduled to become operational on 19 July 2026.

The 6 standards published on 27 May 2026 — in detail

Layer 1 | Identity and physical link (WG2)

EN 18219:2026 | Unique identifiers. Before anything else, a DPP needs a name that is globally unique, never reused, and stable across the product's entire life. EN 18219 codifies five permitted product-identifier schemes: web-enabled structured paths such as a GS1 Digital Link URI, self-issued Identification Links (IEC 61406), Decentralized Identifiers (W3C DIDs), RFID/2D product identifiers, and Digital Object Identifiers (DOIs). It also defines four operator-identifier schemes (ISO/IEC 6523, ISO/IEC 15418, Decentralized Identifiers, and Digital Object Identifiers), with codes such as the GLEIF Legal Entity Identifier usable as an identifier value within the ISO/IEC 6523 scheme. The design choice is deliberate: a multinational can keep its GS1 estate, a cooperative can self-issue a DID, and both still resolve into the same system. Beyond product and operator identifiers, EN 18219 also covers facility identifiers, reusing the same four operator schemes, all of which must remain persistent throughout the product lifecycle.

EN 18220:2026 | Data carriers. The identifier has to physically reach a phone at the shelf, the repair bench, or the recycling line. EN 18220 governs how it is encoded onto the product: 2D symbols (QR Code, Data Matrix) and RFID (HF, NFC, and UHF/RAIN) — with rules on placement, marking, and quality. The baseline guarantee for consumers: at least one data carrier must be free to use and readable with an ordinary smartphone, with no app download required. In practice, this is usually a QR code resolving to the passport in a normal web browser.

Layer 2 | Exchange, structure, and storage (WG4)

EN 18216:2026 | Data exchange protocols. Every passport must move: from the manufacturer's system to a service provider, to a recycler, to a regulator, to a customs authority. EN 18216 fixes the transport layer: RESTful APIs over HTTPS with TLS, structured message formats, and authenticated, confidential, tamper-resistant exchange. It is the lowest common denominator that allows two systems that have never met to talk to each other. This standard is technology-neutral — it does not mandate any specific cloud provider or vendor stack.

EN 18222:2026 | APIs for lifecycle management and searchability. Where EN 18216 says "use REST," EN 18222 specifies exactly which calls. It defines the API methods to create, read, update, and search passports — element-level operations, batch retrieval, versioning queries, and registry submission — so a refurbisher can read a passport, append a repair record, and write it back without a bespoke integration for every partner. The Fine Granular API defined in Clause 6 allows reading and updating individual data elements within a DPP without retrieving or modifying the entire document.

EN 18223:2026 | System interoperability. A battery passport and a textile passport carry different facts but share a structure. EN 18223 defines that shared data model: the container, its metadata, and how each data element links to a machine-readable definition in a semantic repository. This standard makes data meaningful, not merely transportable. It is what allows customs systems, repairers, and increasingly AI agents to interpret any passport without manual mapping. EN 18223 defines two normative serialisation formats for DPP content: an extended representation in JSON and a compressed representation in XML.

EN 18221:2026 | Data storage, archiving, and data persistence. A passport must remain reachable for the life of the product (potentially a decade or more) and must preserve its full history. EN 18221 makes the economic operator responsible for ongoing availability, requires a backup arrangement via a DPP service provider, and mandates archived versions so a regulator can see what was claimed in 2027 versus today. All changes to a DPP must be tracked and archived, maintaining a complete audit trail of modifications. The standard is deliberately storage-technology-neutral, keeping costs proportionate for smaller operators.

The 2 standards expected in September 2026 — Layer 3: Security (WG3)

EN 18239:2026 (FprEN) | Access rights management, information system security, and business confidentiality. Not all DPP data is public. EN 18239 separates open data — recyclability instructions, repair guides — that anyone can read from controlled data such as sourcing arrangements and trade secrets, which requires authenticated, role-based access aligned with eIDAS levels of assurance. The standard frames access control inside recognised information-security management practice (aligned with ISO 27001-series principles). This is what allows a manufacturer to be genuinely transparent on sustainability while protecting legitimately confidential commercial information. It is critical for chemicals, automotive, and defense-adjacent supply chains where selective disclosure is a hard requirement.

EN 18246:2026 | Data authentication, reliability, and integrity. A counterfeit battery is a safety hazard; a falsified origin claim is fraud. EN 18246 ensures a DPP can be proven genuine and tamper-evident through an electronically signed data construct. Implementable via W3C Verifiable Credentials, an Electronic Attestation of Attributes (EAA) under eIDAS, a Visible Digital Seal (ISO 22376), or a Digital Signature data structure (ISO/IEC 20248). With full audit logging of every change, tampering can both be detected and attributed. This is where the "trusted" in a trusted DPP is actually established.

What this means for your DPP implementation

The system layer is now stable. You can prepare against a fixed target rather than a moving one. Here is what that means in practice:

• Identifier strategy (EN 18219): Decide which of the five permitted identifier schemes fits your product and supply chain. If you already use GS1 GTINs, a GS1 Digital Link URI is the natural path. If you need more control, a self-issued DID is permitted. This decision shapes your entire data architecture.

• Data carrier selection (EN 18220): QR codes remain the most practical carrier for most consumer products. But if your packaging material or product surface makes QR placement difficult, NFC/RFID is equally valid under EN 18220. The free-to-read requirement eliminates proprietary scanning apps.

• API compliance (EN 18222): Any DPP software you evaluate should support the EN 18222 API methods. Vendors who cannot demonstrate this alignment are building proprietary silos that will require costly rework once sector delegated acts enter into force.

• Data persistence planning (EN 18221): If your current infrastructure is not designed for long-term lifecycle persistence and version archiving, address this now — before your first delegated act requires a live DPP.

• Access control architecture (EN 18239 — September 2026): Do not finalise your DPP data model before EN 18239 is published. The role-based access layers it defines — determining what regulators, supply chain partners, consumers, and third parties can see — will constrain your data structure choices.

• Trust and signing (EN 18246 — September 2026): Verifiable Credentials and eIDAS-aligned signatures are the expected implementation paths. If your technology provider cannot support electronically signed data constructs, this is a selection criterion to apply now.

For smaller operators, the standards were deliberately written to keep choices proportionate. The most cost-effective compliant path is typically a plain QR code, a hosted DPP service, and an off-the-shelf signature implementation — not a bespoke enterprise platform.

The Battery Passport: the first hard deadline

The Digital Battery Passport under EU Battery Regulation 2023/1542 becomes mandatory from 18 February 2027 for EV batteries, industrial batteries, and light transport batteries above 2 kWh. A second mandatory DPP deadline applies to detergents under the Detergents Regulation, from 23 September 2029. For ESPR product categories such as textiles, furniture, and electronics, timing is still indicative pending delegated acts.

The JTC 24 standards do not define the content of the Battery Passport, that is governed by the Battery Regulation itself. But they define the technical infrastructure through which battery passport data is exchanged, stored, and accessed. Battery manufacturers who align their infrastructure build with the EN 182xx family now are significantly better positioned than those waiting.

Where things stand as of June 2026

• 6 standards published (27 May 2026): EN 18216 (data exchange), EN 18219 (unique identifiers), EN 18220 (data carriers), EN 18221 (storage and archiving), EN 18222 (APIs), EN 18223 (system interoperability)

• 2 standards expected (September 2026): EN 18239 (access rights and security) + EN 18246 (data authentication and integrity)

• Harmonisation in OJEU: Pending, standards are available but not yet cited as harmonised

• EU DPP Registry operational: Scheduled from 19 July 2026

• Battery Passport mandatory: From 18 February 2027

• Detergents Passport mandatory: From 23 September 2029

• ESPR first delegated acts (non-battery): Expected 2027-2028

How to read the standards yourself, for free

The six standards are sold individually by national standardisation bodies, but there is a free way to read them in German.

1. Create a free account on harmonisierte-normen-in-europa.de

2. Once logged in, click "Liste harmonisierter Normen" and go directly to page 19

3. You will find EN 18216, 18219, 18220, 18221, 18222, and 18223 available to read there

The texts are only available in German through this service. For small teams or companies that just need to understand the technical content without buying all six documents individually, this is a good option. It can save around 500 euros in documentation budget.

Ready to start your DPP project? Browse 100+ vetted DPP solution providers on DPP.PRO — including vendors already building to the EN 1821x standard family.

Not sure which regulations apply to your products? Use our free Compliance Navigator to get your personalised compliance timeline.

Want to assess your data readiness before investing in a DPP platform? Take the DPP Data Readiness Assessment in 10 minutes.