The passport is a process, not a file

Most companies are preparing for the digital product passport (DPP) as if it were a document to hand in once. One QR code, one data export, one sign-off, done.

The regulation asks for something different, and the difference determines whether compliance is a project with an end date or a capability you have to run.

What the law actually asks of you

The economic operator placing a product on the EU market is responsible for compiling the data, registering the passport, ensuring a physical carrier is attached, and maintaining data accuracy throughout the product's lifecycle.

That last duty is the one that changes the shape of the work. Accuracy is not a state you reach at launch. It is a condition you hold for as long as the product exists on the market, and beyond, since the passport is meant to serve repairers and recyclers at end of life.

Why a snapshot goes wrong so quickly

Consider what changes in a normal year of a normal product.

A supplier is replaced for cost or capacity reasons. A material is reformulated. A production site changes. A component is substituted. A safety notice is issued. A certification is renewed, or lapses.

Each of those makes at least one passport field wrong. None of them are unusual, and none of them generate a compliance alert on their own. So a record assembled at launch drifts quietly out of accuracy while everyone believes the task is closed, which is the worst possible failure mode: an incorrect public claim that nobody knows is incorrect.

What treating it as a process actually requires

Four things, and only one is technical.

A source of truth that is not the passport. The passport should be generated from your product and supplier data, not maintained alongside it. If the passport is a separate artefact that someone updates, it will diverge from reality the first busy quarter.

A trigger for every change. When a supplier or material changes, something has to know the passport is affected. In most companies this is the missing link: the sourcing decision happens in one system and nobody tells the compliance record.

An owner with authority. Named, accountable, able to require data from other functions. Covered in who owns the DPP.

A record of who changed what and when. Because accuracy will eventually be questioned, and the defence is the history rather than the current state.

The upside nobody mentions

A process that keeps product data current is not only a compliance asset.

It is also what answers a tender questionnaire in an afternoon, what makes an annual disclosure routine rather than an emergency, and what lets you respond to a recall by knowing exactly which batches are affected. Companies that build the process get those for free. Companies that build the file get none of them and still have to build the process later.

That is the idea behind how we built Junction: keep the record at the source and update it as the product changes, so filing the passport becomes a step rather than a project.

Sources

• European Commission, *Digital Product Passport: Frequently Asked Questions*, January 2026 update,
• question 3, on the economic operator's responsibilities including lifecycle data accuracy.
• Regulation (EU) 2024/1781 (ESPR).