The eight standards under the passport, six of them now published

The digital product passport (DPP) rules describe what a passport must do. A separate body of work decides how it does it, and that work is where the practical constraints on any vendor come from.

The Commission issued a standardisation request to CEN, CENELEC and ETSI in July 2024. The work is being done by CEN-CENELEC committee JTC 24, and it covers eight core areas. Six of the eight are now published and cited in the Official Journal; the two on security follow.

The eight areas

Unique identifiers for products, economic operators and facilities. Three different identifier types with three different lifecycles, which is more than most systems assume.

Data carriers and the link between the physical product and its digital representation. This is where the identification link on the item is defined.

Access rights management, information security and data protection. Which party sees which layer of the same record.

Interoperability requirements, technical, semantic and organisational. Whether two systems built by different vendors can read each other's passports.

Data processing, exchange protocols and data formats.

Data storage, archiving and persistence, to ensure long-term availability. This is the standards counterpart to the continuity obligation described in data continuity.

Mechanisms for data authentication, reliability and integrity. Whether the record can be shown not to have been tampered with.

APIs for passport lifecycle management.

Why a decision-maker should care about a standards committee

Because two of these decide whether you are locked in.

The interoperability work is explicitly designed to prevent vendor lock-in, to allow interoperability with existing legacy identification systems where possible, and to support extension with new data types later. It builds on the European Interoperability Framework and its core vocabularies and base registries.

The persistence work is what makes a passport survive the systems it was created in.

Together they mean a passport built to the standards is portable in principle. A passport built around a proprietary format is not, whatever the contract says, because portability is a property of the data rather than of the agreement.

The practical test to apply to any vendor

You do not need to read the standards. You need three answers.

Which identification link standard does the code follow? There is a right kind of answer here: a named standard, not a description of a URL format.

Can the passport be exported in a form another provider can ingest, without re-issuing the identifiers? If moving provider means new codes, every carrier already printed is invalidated.

Which identifier schemes can you carry? A provider that only supports one scheme is making a decision on your behalf about a registry you may already be in.

Where the standards stand now

Six of the eight are done. EN 18216, 18219, 18220, 18221, 18222 and 18223, covering identifiers, data carriers, data exchange, storage, APIs and interoperability, were published on 27 May 2026 and cited in the Official Journal on 15 July 2026 by Implementing Decision (EU) 2026/1736. Citation is what turns a European standard into a harmonised one, so conformity with them now carries a presumption of conformity with the regulation.

The two that remain are the security ones, EN 18239 and EN 18246. They were ratified on 17 August 2026, with definitive texts due on 16 September 2026, and are not yet cited in the Official Journal.

That changes the question to put to a vendor. Conformance with the six is checkable rather than aspirational: ask which EN numbers a provider implements and expect numbers back. On authentication and data integrity, a conformance claim is still a claim about a text that is not yet harmonised, so avoid architectures that depend on a specific answer there.

Sources

• European Commission, *Digital Product Passport: Frequently Asked Questions*, January 2026 update,
• questions 20 and 21.
• Commission Implementing Decision C(2024) 5423 final of 31 July 2024 on a standardisation request
• as regards digital product passports.
• Commission Implementing Decision (EU) 2026/1736 of 15 July 2026 citing EN 18216, 18219, 18220,
• 18221, 18222 and 18223 in the Official Journal.