Two enforcement tracks run at once, and only one of them is a regulator

A wrong digital product passport (DPP) is not a warning letter. It is two separate exposures running in parallel, and companies that plan for the first one usually have not noticed the second.

Track one: national authorities

Member States are responsible for implementing and enforcing the regulation in their territory. Market surveillance authorities carry out product compliance checks and can apply national measures to mitigate risks from particular products. Member States set the penalties for infringements and oversee the assessment and monitoring of conformity assessment bodies.

Customs authorities enforce at the external border, ensuring products have a corresponding passport before release for free circulation.

The practical shape of this is that enforcement is national, so the answer to "what is the penalty" depends on which member state, and a company selling across the EU is exposed to the strictest regime it sells into rather than an average.

Track two: consumers

This is the one that surprises people. Consumers have the right to claim compensation for damages caused by non-compliant products. That is private enforcement, and it does not need a regulator to initiate it.

The claim runs against the product's manufacturer. If the manufacturer is not established in the Union, it runs against the importer or the authorised representative. If none of those are established in the Union, the fulfilment service provider may be liable.

So liability follows the chain until it finds someone inside the EU. For a non-EU manufacturer with an EU importer, that means the importer is carrying a risk created by data they did not compile.

What this changes about how you treat passport data

Once there are two enforcement tracks, passport accuracy stops being a documentation task and becomes a liability question, which changes who should sign it off.

A statement in a passport is a public claim about your product. Recycled content, substances of concern, origin, repairability. If those claims are unverified estimates that later turn out wrong, you have not failed to file something. You have published something incorrect, at scale, with your name on it, in a record designed to be read by regulators and consumers.

That is a materially different risk from a late filing, and it argues for the same conclusion the rest of these pages reach from other directions: the evidence has to exist before the claim does.

Three practical consequences

Sign-off needs a named owner with authority to say no. If the only person who can refuse to publish a field is the person under pressure to ship the product, the control does not exist.

Supplier claims need to be evidenced, not accepted. A declaration that a material contains a given share of recycled content transfers a commercial expectation, not a legal defence.

Contracts should follow the data. If your passport carries a supplier's claim, your supply agreement should say what happens when that claim is wrong.

Sources

• European Commission, *Digital Product Passport: Frequently Asked Questions*, January 2026 update,
• question 30 on enforcement responsibilities and consumer compensation rights.
• Regulation (EU) 2024/1781 (ESPR).