DPP Registry Implementing Regulation (EU) 2026/1778: A Plain-Language Guide

What This Regulation Actually Is

Commission Implementing Regulation (EU) 2026/1778 is the legal act that lays down how the EU’s Digital Product Passport Registry actually operates. It was adopted by the European Commission on 16 July 2026, published in the Official Journal on 17 July 2026, and, under its own Article 24, enters into force on the twentieth day after publication: 6 August 2026. Its full citation is: “Commission Implementing Regulation (EU) 2026/1778 of 16 July 2026 laying down the implementation arrangements for the digital product passport registry set up under Regulation (EU) 2024/1781 of the European Parliament and of the Council,” OJ L 2026/1778.

Read the official text: Commission Implementing Regulation (EU) 2026/1778 on EUR-Lex (permanent ELI identifier: data.europa.eu/eli/reg_impl/2026/1778/oj, available in all 24 official EU languages). The Commission’s own registry portal and user guidance sit at the DPP Registry page.

Last verified 17 July 2026. This regulation was adopted on 16 July 2026 and the registry itself only opens to users on 20 July 2026, so this is a genuinely fast-moving area. Corrigenda, amending acts, Commission guidance, and the registry’s own user documentation are all still landing, and details on this page may be overtaken by events. Every claim below is cited to a specific article or recital of the published text so you can check it against the source yourself. Please do. This is an informed technical brief, not legal advice: verify against the Official Journal text linked above and take qualified counsel before making compliance decisions for your own products.

Its legal basis is Article 13(5) of the ESPR (Regulation (EU) 2024/1781), which already required the Commission to set up the registry infrastructure by 19 July 2026 and separately empowered the Commission to adopt an implementing act specifying exactly how the registry works. This regulation is that act. The Commission’s own DPP Registry page confirms the Registry, its testing environment, and User Guidelines go live to users on 20 July 2026, a date distinct from both the 19 July legal deadline and the 6 August legal entry into force of this regulation. All three dates are real; they answer different questions.

Who It Covers: Not Just ESPR Products

The registry is not limited to products covered by future ESPR delegated acts. Article 1(1) and Recital 2 name the categories in scope today:

• Products covered by future ESPR delegated acts: Article 4, Regulation (EU) 2024/1781
• Batteries, meaning industrial batteries above 2 kWh, EV batteries, and LMT (light means of transport) batteries: Article 77, EU Battery Regulation (EU) 2023/1542
• Construction products: Article 76, Regulation (EU) 2024/3110
• Toys: Article 19, Regulation (EU) 2025/2509
• Detergents and end-user surfactants: Article 21, Regulation (EU) 2026/405
• Any other product a future Union law requires to be registered in this registry

Article 2 of the regulation is explicit that “digital product passport” for its purposes includes the battery passport established under Article 77 of the Battery Regulation, so everything below about identity verification and registration applies to battery passports too, not just future ESPR categories.

The Registry’s Nine Components

Article 3 sets out what the registry actually consists of: a secure website interface for economic operators, value chain actors, competent national authorities, and customs authorities; an API for registering passports and retrieving data; a verification platform that confirms a passport’s existence and completeness; a scheme for generating unique registration identifiers; a storage component for unique identifiers and customs commodity codes; a public list of verified digital product passport service providers; a semantic repository defining how DPP data is structured and versioned; a log system; and identification and authorisation schemes for users.

Becoming a “Verified” Operator: The Identity Check

Before anyone can register a passport, they must first become a “verified economic operator” (or, for repairers, refurbishers, remanufacturers, and recyclers, a “verified value chain actor”) under Articles 4 and 5. This is a one-time identity check run by the Commission itself, governed by the EU’s trust-services framework (Regulation (EU) No 910/2014, “eIDAS”), not a login issued by any DPP software platform, including ours.

The accepted proof of identity differs by applicant type: a sole trader established in the EU can use a qualified electronic signature, a high-assurance eID, or an electronic attestation of attributes; a sole trader not established in the EU needs a qualified electronic signature or an attestation of attributes, as the high-assurance eID option is not available to them. A legal entity established in the EU proves identity and establishment via a qualified electronic seal from a qualified trust service provider, or a qualified attestation of attributes; the same applies to a non-EU-established company, without the establishment-proof requirement.

Verified status lasts until the underlying electronic identification means expires, but never longer than three years from verification. After that, the operator must re-verify to keep registering or modifying passports (Article 4(4), Article 5(4)). Where the registry is integrated with another EU system using an equivalent verification standard (the regulation names EPREL, the EU’s energy-labelling registry, as an example in Recital 11), an operator already verified there does not need to repeat the process. A third party can register on an operator’s behalf, but must itself complete the same verification, and the operator remains fully responsible for what’s submitted (Article 19(4)). Registered passports can be transferred to another verified operator if a company is sold, merges, splits, or ceases activity (Article 6a).

How Registration Actually Works

Once verified, an operator registers a passport through the registry’s website or its API, at whatever granularity the applicable law requires: model, batch, or item (Article 8(6)). Where a passport is created at item level, the corresponding batch and model identifiers must also be linked, if those levels exist for the product (Article 8(4) and (5)).

On submission, the Commission runs an automatic check covering the data’s semantic conformity, coherence of mandatory fields, whether the granularity matches what’s required, validity of the commodity code, and the link to the operator’s hosted passport data (Article 8(7)). This check is explicitly not a compliance check. Recital 16 states it verifies structure and completeness only, and is not proof that the underlying product actually complies with the regulation requiring the passport. Substantive verification remains a market surveillance function. If the check succeeds, the registry issues a unique, persistent registration identifier (Article 8(8)).

At any time, the registering operator can generate a downloadable proof of registration: a secure electronic document sealed with a qualified electronic seal and Commission timestamp, containing the product identifier, commodity code where relevant, the registrant’s identity, the registration date and time, and a cryptographic hash of the passport version (Article 9). This proof stays available for 90 calendar days and can be regenerated.

Registration data is deleted automatically 10 years after registration, unless the specific product law sets a different period, in which case that period applies instead (Article 10(3)). This is the same default used elsewhere in EU product law, per the Commission’s 2022 “Blue Guide.”

Who’s Responsible for What

Verified economic operators and value chain actors are responsible for the accuracy and completeness of everything they submit, keeping their data current, and securing their own credentials, even where a third party registers on their behalf (Articles 19 and 20). The European Commission owns and manages the registry itself: its development, availability, monitoring, updates, maintenance, hosting, and security (Article 21). Member States own and secure any national systems they connect to the registry, act as the GDPR controller for their own processing of registry data, and must appoint a single national administrator, by 18 February 2027 at the latest, as the sole point of contact with the Commission for managing that country’s access rights (Articles 7 and 22).

That 18 February 2027 deadline is worth noting on its own: it is the same date the EU Battery Regulation’s battery passport becomes mandatory (Article 77(1)). The registry’s national-access infrastructure and the first hard product deadline land on the same day.

Data Protection

The Commission is the registry’s data controller (under Regulation (EU) 2018/1725) for the personal data it stores: each user’s name, login credentials and authentication tokens, postal address, email address, and, for natural persons, a national identifier such as a passport, national ID, or tax identification number (Article 18). Where Member States process data they’ve obtained from the registry for their own duties, they act as controller under the general GDPR (Regulation (EU) 2016/679) instead (Article 22(4)).

Availability, Logging, and Support

The registry is meant to be accessible at all times. Planned maintenance gets advance notice on a public website, and in a genuine emergency (malfunction, cyberattack, or urgent security threat) the Commission can suspend access without notice (Article 15). Access and authentication logs are kept 6 months; data-modification logs are kept for as long as the registration exists; administrative and data-exchange logs are kept 5 years (Article 14). A Commission helpdesk operates year-round, 08:00 to 20:00 Brussels time, reachable at EC-HELPDESK-DPP@ec.europa.eu or +32 2 296 0431. The Commission is also required to build an automated, 24/7 support tool by February 2029 (Article 13).

What This Means for Manufacturers

This regulation does not change when a passport becomes mandatory for your product. That still comes from the applicable delegated act or, for batteries, the Battery Regulation itself. What it changes is how you’ll actually register one once you need to: you now know the exact identity-verification standard, the exact automated checks your submission will go through, and the exact retention and proof-of-registration mechanics.

Two practical points follow. First, work out how your organisation will complete eIDAS verification: a qualified electronic signature for a sole trader, or a qualified electronic seal from a qualified trust service provider for a company. That is the gate to registering anything, arranging it takes lead time, and it is something you do directly with the Commission. No DPP platform can complete it on your behalf, and any vendor suggesting otherwise has misread Articles 4 and 5.

Second, note what the registry actually indexes. It stores identifiers and registration data pointing at a passport that already exists. It does not create that passport for you. The underlying work still has to happen first: mapping your technical documentation to the applicable data model, filling the gaps only upstream suppliers can fill, and hosting the result somewhere the registry can resolve to and link against (Article 8(7) checks that link on submission). That data-assembly work is the slow part, measured in months rather than minutes, and it is where the real deadline risk sits. It is also the part Traceable is built to handle: structuring passport data to the required model, collecting what’s missing across the supply chain, and publishing it against a standards-based GS1 Digital Link identifier, so that when your category’s deadline lands, registering with the Commission is a short procedural step rather than the start of the project.

Official Sources

Every claim on this page traces to one of these primary sources. All are free to access and authoritative. If this page and the Official Journal ever disagree, the Official Journal is right.

• Commission Implementing Regulation (EU) 2026/1778: the full text discussed on this page (OJ L, 2026/1778, 17.7.2026)
• European Commission: The DPP Registry: the registry portal, testing environment, User Guide, and Help Desk
• Regulation (EU) 2024/1781 (ESPR): Article 13 establishes the registry, and Article 13(5) is this act’s legal basis
• Regulation (EU) 2023/1542 (EU Battery Regulation): Article 77, the battery passport and its 18 February 2027 date
• Regulation (EU) No 910/2014 (eIDAS): the trust-services framework behind the registry’s identity verification
• Commission Help Desk: EC-HELPDESK-DPP@ec.europa.eu, +32 2 296 0431, 08:00 to 20:00 Brussels time

Related Reading

• EU DPP Registry Launches 20 July 2026: What the European Commission Just Confirmed
• EU Central DPP Registry: What Manufacturers Need to Know
• ESPR Regulation 2024/1781: Complete Guide
• EU Battery Passport for SMEs: What to Prepare Before 18 February 2027