Your company is listed in the commercial register. It holds your name, your number, your registered office and who may sign. What it does not hold: your contracts, your invoices, your product data. The register proves that you exist and where to find you. Everything else stays with you.
That is exactly how the EU register for Digital Product Passports is meant to work. It records that a passport exists, where it lives and that it has not changed since the entry. The product data itself stays with the manufacturer or with its platform.
On 29 April 2026 the European Commission published the draft of the regulation that governs this register. This article explains what the draft asks of you, who may register and what happens to the data. The regulation has since been adopted and the register is in operation; what changed on the way to adoption is in our analysis of the adopted regulation. The essentials have stayed the same.
What the register stores, and what it does not
The register does not store the passport data. It is a directory: for every entry it holds a registration number, the commodity code, the identity of the company, a fingerprint of the current passport version and a reference to the back-up copy at the service provider.
The draft calls this a “decentralised model”: the product data stays with the manufacturer or with its platform.
The register is the official address list, not a data store.
It consists of a web interface and an interface for registrations, a service that checks the identity of companies, a list of the authorised service providers, a multilingual directory of the shared data terms and a log with staggered retention periods.
Identity first, then the entry
No passport is registered before the company is recorded as checked (Article 4). The check takes place directly with the register through the EU’s official digital means, the eIDAS Regulation 910/2014:
- Companies in the EU: a qualified electronic seal or an electronic attestation of attributes
- Sole traders in the EU: a qualified electronic signature, an eID at level “high” or an attestation of attributes
- Companies outside the EU: a qualified signature or seal or an attestation of attributes
The check is valid for three years at most. Anyone who does not renew is set to “unchecked” and may not register new passports or change existing ones (Article 4(4)).
This check sits between you and the Commission. No service provider, Transpareo included, can hold it for you. And the entry itself stays with you too: the register accepts it only from the company placing the product on the market.
Model, batch or item
Article 8 requires passports to be registered at the level the regulation of the respective sector prescribes: model, batch or item. Where an item is registered and batch or model numbers exist, they have to be carried along. For batches the same applies to the model number.
For manufacturers this means: your own master data needs a clean order of model, batch and item. Without that link the automatic check of the entry fails.
Versions, fingerprint and retention
Every version of a passport stays linked to the original registration number. With every change the register requires a fingerprint of the current version, computed by machine and checkable by anyone, not typed in by hand.
The proof of registration (Article 9) is an electronic document that the Commission seals and timestamps. It contains at least the registration number, the commodity code, the identity of the company, the date and the fingerprint of the latest version. It is valid for 90 days and can be requested again at will.
Retention is ten years from registration, unless EU law or sector law sets another period (Article 10(3) of the draft). Even insolvency or liquidation of the manufacturer does not release anyone from the duty to keep the passport available (ESPR, Article 11(e)).
What is logged
The register logs at three levels (Article 14):
- Access and logins: 6 months
- Data changes: as long as the entry exists
- Administrative actions and data exchange: 5 years
National authorities are granted access in the event of incidents, audits or spot checks.
Which personal data the Commission stores
Article 18 lists which data sits only with the register: the first and last name of every user, login details, postal address, email. For natural persons additionally the ID number, eID and tax number. This data is none of the service provider’s business. The Commission is responsible for this account data, the company remains responsible for its passport data.
How Transpareo fits
Most of the requirements touch decisions Transpareo has already made this way. In detail:
Your data stays with you. Transpareo keeps a separate database for every customer. The passport data lives in the company’s database, not in a shared pool. Exactly the split the draft assumes.
Clear roles. Articles 19(5) and 20(3) provide that the company remains responsible for its passport data, even where a third party processes it. Transpareo works as a processor under a data processing agreement. The roles are settled.
One permanent address per passport. Every passport is reachable at a fixed address that does not change even with new versions. That is exactly what Article 8(6)(d) requires as the reference to the back-up copy at the service provider.
Model, batch, item. The Transpareo data model distinguishes the three levels and links them. That is the precondition for Article 8.
Multilingual. The Commission’s directory is multilingual. Transpareo carries every entry in 40 languages, all 24 official EU languages included, with translation part of the plan.
Fingerprint. Transpareo computes a fingerprint for every passport version that anyone can recompute. The only open point is the exact format the register will expect it in; as soon as the Commission publishes it, we deliver it in addition.
Listing as a service provider. Transpareo will apply for the official list of service providers (Article 2 No. 32 of the ESPR) as soon as the procedure is published.
The entry stays with you. The register accepts an entry only from the company placing the product on the market, so we do not make it for you. What we do is keep ready what the entry asks for, product identifier, company identifier, permanent address and fingerprint of the version, so that filling it in is a matter of minutes once the interface is settled.
Timeline
The draft enters into force 20 days after publication in the Official Journal (Article 23). The ESPR requires in Article 13(5) that the register be in place by 19 July 2026.
The register will only be felt, most likely, from 18 February 2027: on that day Article 77 of the EU Batteries Regulation 2023/1542 takes effect, and the passport becomes mandatory for industrial, vehicle and e-bike batteries above 2 kWh. We have written down the details and the open questions in the ESPR timeline 2027. Until then around nine months remain. Anyone budgeting time for supplier contracts, the move of the master data and internal approvals knows: that is tight, not ample.
What remains open
The draft describes the framework. What is missing is the technical description of the interface: the exact format, the checking rules. It is to follow as a separate Commission guideline (Article 15(1)), probably still in the course of 2026.
Your data stays with you, checked companies, unique registration numbers, versions with a fingerprint: none of that will go away again.
The Commission’s official consultation is available on Have Your Say.
Questions on this article
Is this draft still the current text?
No. The Commission adopted the regulation on 16 July 2026 as Implementing Regulation (EU) 2026/1778, and the register has been operating since 20 July 2026, with a test environment and technical documentation for companies. The essentials described here, your data stays with you, checked companies, registration numbers, a fingerprint per version, ten years of retention, are in the adopted text as well. What is still not final is the technical interface. What changed on the way to adoption is in our analysis of the adopted regulation.
Does the register store our product data?
No. It is a directory holding the registration number, the commodity code, the identity of the company, a fingerprint of the current version and a reference to the back-up copy at the service provider. The product data stays with you or with your platform. In practice a register entry does not replace your own duty to keep the passport reachable.
What is the identity check, and who needs it?
The company itself. Before a passport can be registered, the company has to be recorded as checked, using the EU’s official digital means under the eIDAS Regulation (EU) 910/2014, a qualified electronic seal or an electronic attestation of attributes for companies, a qualified signature or an eID at level “high” for sole traders. The check lasts three years at most; letting it lapse sets you to unchecked and removes the right to register new passports or change existing ones. It sits between you and the Commission, and no service provider can hold it for you. So start it early.
Can Transpareo handle the registration for us?
No, and at present no provider can. The register accepts the entry only from the company placing the product on the market (ESPR Art. 13(4) and (5), for batteries Art. 77(10) of the Batteries Regulation); the EU DPP Help Desk has confirmed that reading, and the Commission has said it is examining whether the process can be opened to service providers. What we do is make the entry short. Every passport already carries the product identifier, the permanent address it lives at, and the fingerprint proving it is unchanged. Once the interface is settled you enter that once and receive the sealed proof of registration.
At which level do we register: model, batch or item?
At the level your sector’s regulation prescribes. Where an item is registered and batch or model numbers exist, they have to be carried along; for batches the same applies to the model number (Article 8 of the draft). That is not a register problem but a question of your master data. Your own order of model, batch and item has to be clean before the entry, otherwise the automatic check fails.
How long does a registered passport have to stay available?
Ten years from registration is the standard, unless EU law or sector law sets another period (Art. 10(3)). Insolvency or liquidation of the manufacturer does not release anyone from this duty (ESPR Art. 11(e)). That is why the question of what happens to your passports after a cancellation belongs in every provider conversation. At Transpareo every published version is held for ten years in a separate write-protected archive and stays reachable at a permanent address.
Do we have to compute the fingerprint ourselves?
The register requires a fingerprint of the current version with every change, computed by machine and checkable by anyone, not typed in by hand. Whoever holds the passport computes it, so in practice the platform does. Transpareo computes a fingerprint for every version that anyone can recompute; the only open point is the exact format the register will expect it in. If you build the passport store yourself, this is the part to get right first. A fingerprint nobody can recompute is worse than none at all.
The proof of registration lasts 90 days. What covers the ten years?
Within that period the register reissues the proof on request, so the 90 days are the validity of the document, not of the entry. Across ten years, though, that presupposes the original company still exists and can ask for a fresh one. That is why we proposed a public checking address and proofs you may keep to the Commission (our four submissions). Until such an address exists, keep the sealed proof you receive rather than relying on reissuing it.
