Choosing the right DPP provider

The standard requires digital product passports to be accessible over open, standardised protocols - so that authorities, partners and your own systems can read the data without being tied to one provider’s software. A proprietary format would be an island: without the provider you could no longer reach your own data. The standard has been cited in the EU Official Journal since 15 July 2026 (Commission Implementing Decision (EU) 2026/1736), carrying the presumption of conformity with the ESPR.

Transpareo delivers all passport data and interfaces over standard HTTPS in structured, machine-readable form - no special software, no proprietary protocols. Every published version is additionally signed, so a recipient can not only read the data but verify that it is unchanged. What you see in the interface is the same record any authorised system retrieves over the open interfaces.

Source: EN 18216, data-exchange-protocol requirement: ‘The data exchange protocols specified in this clause shall be used for standardized DPP access.’

Every passport needs a unique identifier that points to the same product permanently and assumes no particular provider. If a provider ties the identifier to its own infrastructure, you lose the identity of your passports when you move - every printed code and every registration would then point into the void. The standard has been cited in the EU Official Journal since 15 July 2026.

Transpareo issues the identifier as a GS1 Digital Link carrying your GTIN - an open industry standard that belongs to the product, not the platform - and validates every identifier against the permitted standard schemes. The signing identity lives as a DID:web on your own domain, not ours. The identifier keeps resolving even if a system fails: a permanent fallback address keeps answering, and the passport keeps its identity across any change of provider.

Source: EN 18219, clause 4.6.2(3): ‘The unique identifier shall not result in vendor lock-in.’

The passport must be reachable through a machine-readable carrier on the product that anyone can open without special software - and that stays readable over the whole product life, including use and repair. A carrier that demands a particular app or account shuts out part of the public. The standard has been cited in the EU Official Journal since 15 July 2026.

Transpareo produces a QR code per ISO/IEC 18004 that carries a GS1 Digital Link address and resolves straight to the passport in any browser - no login, no download, any smartphone. Model, batch and item are already encoded in the address, so a scan lands on the right level directly. Because the address stays stable through a permanent fallback resolution, a code once printed stays valid over the whole product life.

Source: EN 18220, data-carrier requirements (Clause 5): symbology, encoding, print quality and durability; the carrier should remain usable after several use-reuse-repair cycles.

The standard requires a passport and its version history to be stored and kept unchanged and retrievable for the period prescribed by regulation. If only the current state is held, the traceability of earlier entries is lost - yet that is exactly what an economic operator must be able to prove to authorities. The retention period follows the relevant sector law; the ESPR asks for at least the expected lifetime of the product. The standard has been cited in the EU Official Journal since 15 July 2026.

Transpareo writes every publication as a frozen, signed version into an immutable archive where no one can later change or delete it - neither you nor us. Earlier states stay retrievable alongside the current one, and every version carries a timestamp and signature. For any point in time you can prove what the passport stated back then.

Source: EN 18221: ‘The digital product passport shall be available to specifically authorized users … during the digital product passport lifetime.’

Beyond display in the browser, the standard requires a programming interface through which passports can be created, read, updated and searched by product identifier. Without such an interface, every bulk operation stays manual and other systems cannot use the passport inventory automatically. The standard has been cited in the EU Official Journal since 15 July 2026.

Transpareo serves the prescribed standard methods over a versioned, standardised interface: passports can be created, read, updated and searched page by page over product identifiers, programmatically. The signed passport is delivered unchanged - the interface hands out exactly the bytes whose signature a verifier can recompute.

Source: EN 18222: a standardized API for DPP lifecycle management and searchability, as mandated by the ESPR.

So that passports fit together across systems and supply chains, the standard prescribes a shared data model with a common meaning for every field. A provider-specific model forces every partner into its own translation - and every translation is a source of errors. The standard has been cited in the EU Official Journal since 15 July 2026.

Transpareo builds on a horizontal vocabulary layer with parallel, recognised domain vocabularies (GS1, EPCIS and others) and describes each data point with a reference to its dictionary and its data type. A receiving system therefore learns not just what a field is called but what it means - the passport stays readable without reformatting.

Source: EN 18223: a common semantic data model for DPP system interoperability.

The standard distinguishes public data, which anyone reads without logging in, from controlled data, which opens only after authentication and according to the reader’s role, for authorities or for the roles a regulation sets. Rights apply per data element, and every access to controlled data is logged in a way that cannot be forged or deleted. EN 18239 has been published as the European standard EN 18239:2026, with the German edition appearing as DIN EN 18239:2026-11; the EU Official Journal has not cited it yet.

Transpareo carries visibility as a property on each data field, in four tiers: public, on demand, legitimate interest and authorities. Public and on-demand data are served without authentication. Legitimate-interest data goes only to a signed-in reader in an access group the issuer has cleared, and authority data only through a separate authority interface with read-only access. The standard’s two access schemes, public without login and controlled by role, are therefore built into the architecture. The access log is partial: every authority read is logged individually and reads over an API key as hourly counts, while a signed-in person reading legitimate-interest data is not logged, and the log is not protected against forgery.

Source: EN 18239:2026, clauses 5.2 and 6.2: public DPP data can be read without authentication; controlled data is reached only through authenticated, role-based access, and every access to it is logged.

The standard requires the authenticity and integrity of a passport to be provable, with verification free and unlimited. Trust must not hang on the provider’s survival but must stick to the data record itself - otherwise every passport is only as credible as whichever company currently hosts it. EN 18246 has been published as the European standard EN 18246:2026, with the German edition appearing as DIN EN 18246:2026-11; the EU Official Journal has not cited it yet.

Transpareo signs every published version with two independent keys (issuer and Transpareo) and chains the versions by their hash in the Transpareo Proofchain, so even the history cannot be rewritten unnoticed. An open-source renderer checks both signatures right in the browser without contacting any server of ours - the required signed, self-verifying proof is already in place. Where the keys come from is partial: the standard asks everyone who supplies data for a certificate issued after an identity check, while our issuer keys are published on the issuer’s own domain without such a certificate.

Source: EN 18246:2026, clause 4.7: the authenticity and integrity of DPP data must be verifiable, free of charge and with interoperable mechanisms.

Every passport subject to registration must be entered in the central EU register, which assigns a permanent registration ID and on request issues an official proof of registration. The register has been running since 20 July 2026. Today the economic operator makes the entry itself, in the register’s web form or by uploading a file of up to 100 passports. The regulation also provides for a programming interface, whose technical specification the Commission has not yet published. And according to the register’s user guide no passport can yet be registered successfully, because the data definitions for the first product group, batteries, are still missing. So no provider can demonstrate a connection today; where one claims otherwise, you should ask.

Transpareo has prepared the connection as far as it can be prepared without the technical specification: registration ID, proof of registration, version hash and the address of every version are already in place in the data model. We expect registration to be connectable through the interface once the Commission has documented it; you will not have to rework your passports for it. Until then this box stays unticked.

Source: DPP Register Implementing Regulation (EU) 2026/1778, Art. 3(a) and (b) and Art. 8(6) (registration through the web interface or the programming interface); DPP Registry User Guide for Economic Operators, version 1.03 (September 2026), section 6.2.1 (registration not currently possible).

The EU register keeps a passport's registration data for ten years from registration where Union law sets no duration of its own, and otherwise for as long as the passport has to be available. The passport itself has to stay available even if the manufacturer becomes insolvent or ceases trading. The duty therefore outlives both your contract with a provider and the provider itself.

Transpareo holds an immutable archive for this, in which no one can later change or delete a version once written - neither the manufacturer nor us. The archive takes effect automatically with EU registration. Transpareo itself is built to last as well: 51 per cent of the share capital of Transpareo AG is held by the non-profit Transpareo Foundation in Zug, Switzerland, which is subject to the Federal Supervisory Authority for Foundations. A foundation cannot sell off its assets, so the majority stake in the company can never change hands, and long-term access to your passports is structurally secured.

Source: DPP Register Implementing Regulation, Art. 10(3) (ten-year retention); ESPR Art. 11(e) (availability after an insolvency).

A battery’s instructions and safety information and contact details must be in a language end-users can easily understand, as determined by the member state where the battery is placed on the market - not only in the language of the manufacturer’s home country. Serving only the home market leaves the duty unmet for every other target market.

Transpareo maintains each passport in multiple languages and delivers the mandatory content in all 24 EU official languages. You capture the content once; the language versions follow from it, without paying per language or maintaining separate passports. The passport is compliant and readable in every target market.

Source: Battery Regulation (EU) 2023/1542, Art. 38(1)(a) and 38(7): instructions, safety information and contact details in a language determined by the member state where the battery is placed on the market.

A provider that makes moving hard holds you captive over your own data - and what happens to your data at the end of the contract decides whether you can move freely. The standard therefore requires data to be transferable through an open, interoperable network without vendor lock-in.

Transpareo places the regulatory passport artefacts from the outset in an open, publicly mirror-friendly area: a simple sync produces a complete, signed copy that verifies itself against the published keys, with nothing needed from us. The full event archive we hand to you or your new provider over a signed, time-limited download address, and the upstream product catalogue additionally as JSON-LD and CSV. At contract end the registered mandatory passports stay reachable through the immutable ten-year archive: the public mirror and the archive stay in sync and hand over the same data set, QR codes already printed keep resolving via the permanent fallback address, and the register reference points to the new address. So the contract ends without data loss and without breaking the statutory retention.

Source: EN 18216: data must be ‘transferable through an open, interoperable network without vendor lock-in.’

A passport that lives only in the provider’s interface becomes a data island alongside your other systems - every change then has to be maintained twice.

Transpareo reports events over signed webhooks and lets data be read in and out over a bulk API, so you can connect the passport to your own system landscape. We deliberately do not ship a ready-made connector for one specific ERP system - the open, signed interfaces suit any system rather than favouring one.

Anyone who wants to use the captured data outside the passport needs import and export for more than the legal mandatory fields.

Transpareo takes in larger volumes of data via Excel, CSV and the bulk API and gives them back out at the same scope. The system therefore serves not only EU compliance but your own data management too.

Entry in the EU register including obtaining the official proof is recurring effort that a provider could take on for you. The Register Regulation lets a third party register on the operator's behalf only where Union law provides for it, and legal responsibility stays with the economic operator even then. Today the economic operator makes the entry itself.

We expect service providers to become able to register on the operator’s behalf. Transpareo will then handle registration for you - you remain the legally responsible economic operator but carry none of the operational effort. Until then Transpareo prepares the details the entry asks for.

Source: DPP Register Implementing Regulation (EU) 2026/1778, Art. 8(2) and Art. 19(4): a third party registers on the operator’s behalf only where Union law provides for it; responsibility stays with the economic operator.

Some providers separate usage from support and bill help separately; the collaboration becomes hard to budget as a result.

At Transpareo support is part of the tariff - no separate support contract, no extra hours billed by effort. Whatever support you need is already included in the stated price.

A pricing structure that only becomes visible in the sales conversation, or bills extra per language, product and API call, makes the true cost unpredictable.

Transpareo publishes four tariffs for every company size openly on the website, with a free trial and cancellation at any time. There are no hidden extra costs per language, product or interface call - the stated price is the price.