Who actually checks your passport, and when

"Who enforces this" is a fair question and it has three answers, because three different parties check three different things at three different moments. Knowing which is which tells you what your digital product passport (DPP) actually has to withstand.

At the border: customs check existence

Customs authorities enforce controls at the EU external border to ensure products have a corresponding passport before they are released for free circulation. A central registry lets them perform an automated check that a valid, unique registration identifier exists, which also prevents duplicates.

Note the nature of the check. At the border, the question is whether a passport is registered, not whether its contents are accurate. That is a binary gate: registered or held.

Worth knowing on timing: the connection with customs has to be built within four years of the registry launch, so full automated verification is expected around 2029. Until then the mechanism tightens progressively rather than arriving all at once.

In the market: surveillance authorities check accuracy

Market surveillance authorities in each member state carry the primary responsibility for verifying the accuracy, completeness and reliability of passport data, as part of their standard enforcement duties. They can scan a product's data carrier to reach its documentation and run targeted searches for non-compliant products.

This is the check that tests your data rather than your paperwork, and it can happen at any point while the product is on the market, which is to say years after it left your control.

Member States also set the penalties for infringements and oversee conformity assessment bodies, so the consequences are national and vary by country.

Everywhere: consumers can claim

The third track has no authority in it at all. Consumers have the right to claim compensation for damages caused by non-compliant products, running against the manufacturer, or the importer or authorised representative where the manufacturer is not established in the Union, or the fulfilment service provider where none of the others are.

This is private enforcement, described more fully in DPP penalties, and it does not wait for a regulator to act.

What each track asks you to prepare

The three checks reward three different things, and a plan that only satisfies one of them is incomplete.

Customs reward registration discipline: every product in scope registered, correctly, before it ships. This is a process problem.

Market surveillance rewards evidence: every claim in the passport traceable to something you can produce years later. This is a data problem, and it is the expensive one.

Consumers reward accuracy in what you publish: no claim in the record that is not true. This is a governance problem, and it comes down to who signs off.

Sources

• European Commission, *Digital Product Passport: Frequently Asked Questions*, January 2026 update,
• questions 30 and 31, including the note that the customs connection is expected around 2029.
• Regulation (EU) 2024/1781 (ESPR).