Picture an audit in 2029. A customer has your supply chain audited, and the auditor asks which text your product passport was built against. The useful answer is one that has not changed since: the same standard, the same version, the same check as back then.
Until recently that answer did not exist. Whoever built a passport built against drafts, and every new revision could move the target. Since July 2026 the text is fixed.
This article explains what that means for you, which of the eight standards are fixed and what each one requires. And it shows, standard by standard, how Transpareo meets them today.
Updated on 19 October 2026: EN 18246 and EN 18239 have been published as final European standards and are still not cited in the Official Journal. The section on the two reflects that and names what we meet only partly.
What “harmonised” means
On 15 July 2026 the EU cited the first six standards for the Digital Product Passport in the Official Journal, under Commission Implementing Decision (EU) 2026/1736. Since then they are harmonised. The word sounds technical and means two simple things.
First: the text has stopped moving. A gap check you run today still holds next year.
Second: whoever meets the standards counts as compliant with the passport requirements of the ESPR, the regulation behind the product passport, and does not have to prove it. You may meet those requirements another way, but then you carry the burden of proof.
The text is fixed, and whoever meets it counts as compliant.
So for you, one question matters: does the platform you trust with your passports already meet these standards? Ours does. Here is the proof, standard by standard.
Identifiers and data carriers: EN 18219 and EN 18220
EN 18219 (unique identifiers). Every passport carries a permanent identifier that belongs to no server, and a product identifier as a GS1 Digital Link that any scanner finds; the responsible manufacturer sits inside it as an LEI or GLN. An identifier that still holds when a domain or a provider disappears.
EN 18220 (data carriers). The QR code on the product opens in any browser, no app, no extra software. What the standard asks of the carrier is already everyday practice.
Storage and exchange: EN 18221 and EN 18216
EN 18221 (storage and archiving). Every published version is frozen and signed, and from registration with the EU register it sits in Transpareo Vault, an archive in which nothing can be changed any more and which is built for long-term retention. Each version is chained to the one before it by a fingerprint, so a missing or altered record shows up at once.
EN 18216 (data exchange). We serve the data format the standard defines, over ordinary web protocols. No bespoke format, no envelope of our own.
Data model and interfaces: EN 18223 and EN 18222
EN 18223 (data model). This is where we are strongest. Our data model is built open and carries each regulation’s own dictionary side by side, exactly what the standard’s introduction calls for. Every element describes itself, referencing its property, its dictionary, and its data type. We mapped it clause by clause against EN 18223 before launch; the standard is an output format for us, not a rebuild. We walk through the detail in EN 18223: why three lines become twenty.
EN 18222 (interfaces). Read a passport by its identifier or by its product identifier, create passports one at a time or in the thousands, retrieve any version: the interfaces the standard defines for operating a passport are part of the platform. Your systems read and write passports the way the standard describes.
Published, not yet cited: EN 18246 and EN 18239
Two standards are not cited yet, the ones on trust and security. Both were published in 2026 as final European standards, EN 18246:2026 and EN 18239:2026, so their text has stopped moving too. We meet most of what they ask today, and below we name what we meet only partly.
EN 18246 (authenticity and integrity). Every published version is signed and verifies itself in the reader’s browser, offline, against a public key. Whether the data is intact and who signed it, the reader sees with no call back to us, and the check costs nothing. With Transpareo Proofchain each version is also chained to the one before it by a fingerprint, so the published history cannot be rewritten unnoticed. How the signatures work is in Signatures and certificates in the DPP.
Two parts are partial. The standard asks everyone who supplies data to sign with a certificate issued after an identity check; our issuer keys are published on the issuer’s own domain, without such a certificate. And it asks for a record nobody can disown of every change, from the first draft on; we sign every published version, while edits to a draft sit in our ordinary audit log.
EN 18239 (access rights and confidentiality). Four access tiers, public, on demand, legitimate interest and authorities, map onto the audiences the Batteries Regulation names, and every field carries its own tier. Public and on-demand data open without a login, legitimate-interest data only for a signed-in reader in an access group you have cleared. Every customer is kept apart from the others; authorities reach the data through their own verified, read-only channel.
Partial here is the record of who read what. The standard asks for a tamper-proof log of every access to controlled data, and for everyone reading it to carry an operator identifier unique worldwide. We log each authority read individually and reads over an API key as hourly counts; a signed-in person reading legitimate-interest data is not logged, our audit log is not tamper-proof, and a reader is known by account or API key, with a worldwide identifier (a GLN) only where one was entered for the key.
Each of these parts sits in the trust layer, apart from the passport data, so closing it leaves every passport already published as it is.
Where we stand
That is the answer that counts: the target is fixed, and our platform meets it. We built closely alongside that moving target while it was still shifting, and now that the text is settled, there is practically nothing for us to change. We satisfy the six harmonised standards today. Of the two that follow, we meet most today, and the parts still partial are named above.
Start now, and you are no longer building against a moving draft but onto a fixed target, and onto a platform that carries the standards for you.
Which deadline applies to your product depends on your sector’s rules; our industries reference keeps it per industry, and the ESPR timeline for 2027 breaks it down for batteries. The standards are ready. So are we.
Questions on this article
Are the six standards mandatory?
No. A harmonised standard is a route to compliance, not a duty of its own. Meeting it means you are presumed to comply with the ESPR's requirements for the passport, and you may demonstrate compliance another way. What became binding on 15 July 2026 is the text itself. Implementing Decision (EU) 2026/1736 cites the six standards, so the target you build against no longer moves.
What does counting as compliant get us in practice?
It reverses the burden of proof. Without the standards you have to show a market-surveillance authority under your own steam that your identifier, data carrier, storage and interfaces satisfy the ESPR’s requirements for the passport. With them, pointing at the standard is enough unless someone shows otherwise. That is worth most exactly when it suits least, during an inspection, years after the person who designed the passport has left the company.
Do we have to buy and read the standards?
You have to know what they require; whether you buy them is a different question. The six cover identifiers (EN 18219), data carriers (EN 18220), storage and archiving (EN 18221), data exchange (EN 18216), the data model (EN 18223) and interfaces (EN 18222), throughout things the platform holding your passports implements, not fields you fill in per product. If you build the passport store yourself, read them. If you do not, ask your provider for its clause-by-clause mapping instead.
What about the two standards not yet cited?
EN 18246 on authenticity and integrity and EN 18239 on access rights and confidentiality were published as final European standards in 2026 and are not cited yet. So meeting them does not yet count as compliance by itself. Nothing stops you from meeting them already, with signed passports that verify themselves against a public key, an unalterable history of published versions, and access tiers matching the audiences the Batteries Regulation names. Transpareo implements most of both today; the article names the parts still partial, among them a tamper-proof log of every read and issuer keys backed by a certificate.
Do passports published before the citation have to be reissued?
No. The citation changed the status of the text, not the ESPR’s requirements for the passport. A passport that met them before still meets them. What changes is planning. A gap check you run today stays valid instead of expiring with the next draft revision. Where a gap does show up, the fix is a new signed version, and the earlier one stays retrievable.
Does meeting the standards mean we are ready for the EU register?
The two overlap, but they are different obligations. The standards govern how the passport is identified, stored, exchanged and read; the register asks you to record that the passport exists, under an identity verified through eIDAS, and to keep the entry for ten years. Today your company makes the entry itself. The register offers no access for service providers yet. The standards work is what makes the entry short, because the identifier, the address and the fingerprint already exist by then.
How do we check a provider's claim?
Ask for the mapping, clause by clause, and for the evidence behind it, the identifier a passport carries, a signed version anyone can verify without asking the provider, the archive holding the earlier versions, and the interface that reads a passport by its identifier. A provider that “supports the standards” but cannot name a clause is saying a marketing sentence. Ours is written out standard by standard in this article, and any Transpareo passport can be verified independently with the open-source Transpareo Time Machine.
