Picture an audit in 2029. A customer has your supply chain audited, and the auditor asks which text your product passport was built against. The useful answer is one that has not changed since: the same standard, the same version, the same check as back then.
Until recently that answer did not exist. Whoever built a passport built against drafts, and every new revision could move the target. Since July 2026 the text is fixed.
This article explains what that means for you, which of the eight standards are fixed and what each one requires. And it shows, standard by standard, how Transpareo meets them today.
What “harmonised” means
On 15 July 2026 the EU cited the first six standards for the Digital Product Passport in the Official Journal, under Commission Implementing Decision (EU) 2026/1736. Since then they are harmonised. The word sounds technical and means two simple things.
First: the text has stopped moving. A gap check you run today still holds next year.
Second: whoever meets the standards counts as compliant with Articles 10 and 11 of the ESPR, the regulation behind the product passport, and does not have to prove it. You may meet those articles another way, but then you carry the burden of proof.
The text is fixed, and whoever meets it counts as compliant.
So for you, one question matters: does the platform you trust with your passports already meet these standards? Ours does. Here is the proof, standard by standard.
Identifiers and data carriers: EN 18219 and EN 18220
EN 18219 (unique identifiers). Every passport carries a permanent identifier that belongs to no server, and a product identifier as a GS1 Digital Link that any scanner finds; the responsible manufacturer sits inside it as an LEI or GLN. An identifier that still holds when a domain or a provider disappears.
EN 18220 (data carriers). The QR code on the product opens in any browser, no app, no extra software. What the standard asks of the carrier is already everyday practice.
Storage and exchange: EN 18221 and EN 18216
EN 18221 (storage and archiving). Every published version is frozen, signed, and written to an archive in which nothing can be changed any more and which is built for long-term retention. Each version is chained to the one before it by a fingerprint, so a missing or altered record shows up at once.
EN 18216 (data exchange). We serve the data format the standard defines, over ordinary web protocols. No bespoke format, no envelope of our own.
Data model and interfaces: EN 18223 and EN 18222
EN 18223 (data model). This is where we are strongest. Our data model is built open and carries each regulation’s own dictionary side by side, exactly what the standard’s introduction calls for. Every element describes itself, referencing its property, its dictionary, and its data type. We mapped it clause by clause against EN 18223 before launch; the standard is an output format for us, not a rebuild. We walk through the detail in EN 18223: why three lines become twenty.
EN 18222 (interfaces). Read a passport by its identifier or by its product identifier, create passports one at a time or in the thousands, retrieve any version: the interfaces the standard defines for operating a passport are part of the platform. Your systems read and write passports the way the standard describes.
The two still to come: EN 18246 and EN 18239
Two standards are not cited yet, the ones on trust and security. We meet those already too.
EN 18246 (authenticity and integrity). Every passport is signed and verifies itself in the reader’s browser, offline, against a public key. Whether the data is intact and who it comes from, the reader sees with no call back to us, and the issuer cannot deny its signature. An unalterable archive holds the history. That is precisely what the standard requires. How the signatures work is in Signatures and certificates in the DPP.
EN 18239 (access rights and confidentiality). Four access tiers, public, on demand, legitimate interest, authorities, already map onto the very audiences the Battery Regulation names in Article 77(2). Every customer is kept apart from the others; authorities reach the data through their own verified channel.
And because our trust layer is cleanly encapsulated from the start, we reconcile the last details of these two standards in days once they are cited, with no rebuild.
Where we stand
That is the answer that counts: the target is fixed, and our platform meets it. We built closely alongside that moving target while it was still shifting, and now that the text is settled, there is practically nothing for us to change. We satisfy the six harmonised standards today, and the two that follow are built in.
Start now, and you are no longer building against a moving draft but onto a fixed target, and onto a platform that carries the standards for you.
Which deadline applies to your product depends on your sector’s rules; our industries reference keeps it per industry, and the ESPR timeline for 2027 breaks it down for batteries. The standards are ready. So are we.
Questions on this article
Are the six standards mandatory?
No. A harmonised standard is a route to compliance, not a duty of its own. Meeting it means you are presumed to comply with Articles 10 and 11 of the ESPR, and you may demonstrate compliance another way. What became binding on 15 July 2026 is the text itself. Implementing Decision (EU) 2026/1736 cites the six standards, so the target you build against no longer moves.
What does counting as compliant get us in practice?
It reverses the burden of proof. Without the standards you have to show a market-surveillance authority under your own steam that your identifier, data carrier, storage and interfaces satisfy Articles 10 and 11. With them, pointing at the standard is enough unless someone shows otherwise. That is worth most exactly when it suits least, during an inspection, years after the person who designed the passport has left the company.
Do we have to buy and read the standards?
You have to know what they require; whether you buy them is a different question. The six cover identifiers (EN 18219), data carriers (EN 18220), storage and archiving (EN 18221), data exchange (EN 18216), the data model (EN 18223) and interfaces (EN 18222), throughout things the platform holding your passports implements, not fields you fill in per product. If you build the passport store yourself, read them. If you do not, ask your provider for its clause-by-clause mapping instead.
When do the two outstanding standards arrive?
EN 18246 on authenticity and integrity and EN 18239 on access rights and confidentiality are not cited yet. So meeting them does not yet count as compliance by itself. Nothing stops you from meeting them already, with signed passports that verify themselves against a public key, an unalterable history, and access tiers matching the audiences the Batteries Regulation names in Article 77(2). Transpareo implements both today, so their citation will not be a rebuild here.
Do passports published before the citation have to be reissued?
No. The citation changed the status of the text, not the requirements of Articles 10 and 11. A passport that met them before still meets them. What changes is planning. A gap check you run today stays valid instead of expiring with the next draft revision. Where a gap does show up, the fix is a new signed version, and the earlier one stays retrievable.
Does meeting the standards mean we are ready for the EU register?
The two overlap, but they are different obligations. The standards govern how the passport is identified, stored, exchanged and read; the register asks you to record that the passport exists, under an identity verified through eIDAS, and to keep the entry for ten years. Today your company makes the entry itself. The register offers no access for service providers yet. The standards work is what makes the entry short, because the identifier, the address and the fingerprint already exist by then.
How do we check a provider's claim?
Ask for the mapping, clause by clause, and for the evidence behind it, the identifier a passport carries, a signed version anyone can verify without asking the provider, the archive holding the earlier versions, and the interface that reads a passport by its identifier. A provider that “supports the standards” but cannot name a clause is saying a marketing sentence. Ours is written out standard by standard in this article, and any Transpareo passport can be verified independently with the open-source Transpareo Time Machine.
