Who carries the Digital Product Passport obligation?

The short answer

The Ecodesign for Sustainable Products Regulation attaches passport duties to the economic operator placing the product on the EU market. For most apparel brands that is the manufacturer, and the word manufacturer here has almost nothing to do with owning a factory.

For textiles specifically there is no duty yet. The framework exists. The textile delegated act that would say what a textile passport must carry has not been adopted, so there is nothing today for a textile brand to be non-compliant with. What is worth doing now is establishing which role you occupy, because the role decides everything that follows and it does not change when the act arrives. What does reach a textile business today is a shorter and more ordinary list, and it is set out in what actually applies now.

Two warnings before the detail. This is our reading of primary law rather than legal advice. And no article number appears on this page at all: the provisions that define these roles are being read through a consolidated rendering rather than against the Official Journal's own text, so each one is named by what it does, and the numbers come back when they can be right.

Placing on the market is not making available

These two phrases look like synonyms. They are the load-bearing distinction in EU product law.

The consequence is that duties attaching to placing on the market land on one actor rather than on everyone in the chain. A retailer selling a garment somebody else imported is making it available. It did not place it.

Selling online into the EU

An online offer counts as placing goods on the EU market when the offer is aimed at the EU. That is a test about intention shown through evidence rather than a test about whether a customer in Brussels can reach your checkout.

The signals that carry weight are the ones you chose: the dispatch areas you set, the languages you publish in, the currency you price in, the payment methods you accept and the domain you sell from. The signal that carries very little on its own is that the site loads in a browser somewhere in the Union. Every site does.

The same logic runs inside our own engine, in the other direction. A shop's shipping settings are never treated as evidence that it sells into a market, because ships is not sells and inferring a market from a postage table would attach duties to a business on the strength of a configuration screen.

The roles, and which one you are probably in

The framework recognises a small set of economic operator roles, and one company can occupy more than one of them at once for different products.

One more actor is worth knowing about and it comes from product safety rather than from ecodesign. The General Product Safety Regulation, Regulation (EU) 2023/988, applies without any declaration of conformity and creates a responsible person established in the Union. We reached that provision, and the same instrument's provisions on listing information, through somebody else's reproduction rather than at the Official Journal, so neither is quoted here and neither carries a number. We record that the role exists. We do not model it, this page does not tell anybody who their responsible person is or how one is appointed, and nothing in the passport should be read as our assessment of who that person is for a given product.

What a piece of software cannot be

A role is a legal position held by a legal entity. An application can hold a field, render it, syndicate it and send it to a register. It cannot be the entity, and no configuration screen changes which company occupies a role.

That boundary is worth stating plainly because three separate pieces of first-party material behind this page say the same thing from three directions, and all three come from the vendors rather than from us. A commerce platform states in its own help material that it does not offer the responsible person service. A marketplace refuses the role for its sellers and points them at paid providers instead. A merchant who asked a compliance vendor whether its feature amounted to the role was told the application only displays the fields.

We describe those three by class rather than by name. The evidence package behind this page supports the observation and does not support naming the companies, and a named platform beside a sentence about duties reads as a claim about that platform's obligations, which is not what any of this is. What the three of them establish together is narrow and useful: the software market's own documentation already agrees that software is not an actor.

The practical test on a proposal is short. Ask which legal entity is named, in which Member State it is established and where that appointment is written down. If the answer is the name of a product rather than the name of a company, the role has not been filled by anybody, and a field in a database holding the word responsible is a field holding a word.

The importer carries the most and knows the least

When goods come from outside the Union, the operator established inside it that places them on the market is the importer, and the duties attaching to placing land there. That is the role with the widest gap between what it carries and what it can actually answer.

The importer did not specify the fabric, commission the tests or choose the mill. Its record of the goods is a commercial invoice, a packing list and whatever the seller wrote on them. The brand's record is better in every respect, and the brand may sit outside the Union, where that particular role does not reach it. The data and the duty end up in different companies, which is the asymmetry worth naming before anybody designs a process on top of it.

A brand outside the Union that wants to keep hold of the position has one written route, which is to appoint an authorised representative inside it, in writing and with a defined scope. That is a purchase rather than an arrangement. One very small merchant in the records behind this page priced outsourced representation at a provider's published annual fee and rejected it as uneconomic against its own turnover, and stayed with the position that whoever imports becomes the operator. The figure sits in the research record rather than on this page, because one provider's published price at one moment is not a market rate and publishing it as though it were would be the same error this estate spends its time correcting.

Either way somebody established inside the Union ends up holding the position. The only question the brand controls is whether that somebody is a company it chose.

Proving who that is, from outside

A passport names the operator carrying it. Corroborating that name against a public register works very differently depending on the Member State, and the unevenness is invisible until somebody tries.

The EU VAT number validation service discloses different amounts per Member State. A French number comes back with the company name attached. A German or a Spanish number comes back valid with the name and address rendered as dashes. A British number cannot be checked through it at all since the United Kingdom left, which we record as not checkable rather than as a failed check, because those are different findings.

Customs identifiers are harder still. Disclosure is consent based in both the EU and the UK, so no route binds a customs identifier to a company without the company agreeing to it. An engine that assumed otherwise would resolve identity in France and go quiet in Germany without ever reporting that it had.

None of that changes who carries the duty. It changes what anybody can prove about it from the outside.

What the registry regulation puts on one operator

One instrument in force is unusually direct about where responsibility sits, and it is the implementing regulation behind the EU passport registry. It creates no duty for a textile business to register anything. What it does is decide which party answers for a registration once anybody makes one, and it does that in four separate provisions.

They are four rather than one, and merging any two of them is how this conversation goes wrong.

• A duty at the point of registration. One provision puts responsibility for the accuracy and the completeness of the registered data on the operator, at the moment the data is registered.
• A duty at all times. A separate provision asks that the registered data be accurate, complete and up to date at all times. It sets no interval, names no trigger and nominates no reviewer.
• A third party may do it, and the operator still answers for it. A further provision allows a third party to register on a verified operator's behalf, requires that third party to be verified in its own right, and leaves the verified operator fully responsible for what was registered.
• The operator is the controller of what it submits. A fourth provision makes the operator the controller of the data it submits, which is a status rather than a task and cannot be reassigned by a services agreement.

All four are on this page rather than elsewhere because they allocate responsibility between actors, which is this page's subject. They are not a procedure for running a passport, and none of them tells anybody inside a business who signs a value off. That is a different question with a different answer, and who owns a published field is where it is worked through, including what happens when a published value turns out to be wrong. What the act of registering involves, and what a business has to be before the registry will accept anything from it at all, is set out in what registering asks of a business.

Read together the four make one commercial point. A supplier can carry the work and cannot carry the position, so an arrangement described as taking compliance off your hands is an arrangement about labour, and no sentence in the instrument moves the responsibility along with it.

Is there an exemption if you are small?

We have not found one, and our reading of the framework is that its approach to small and micro enterprises is support rather than exemption.

Three provisions carry that: a guidance and support provision aimed at smaller enterprises, a provision making the circumstances of small enterprises an input into when requirements begin to apply, and a carve-out for the smallest. On that reading a brand of three people selling into the EU sits in the same place as a brand of three thousand, with more help available and the same obligations.

The burden that in practice falls hardest on a small brand is not a passport duty at all. It is producer registration for extended producer responsibility, which is live in some markets today, is unrelated to whether a passport exists, and costs roughly the same per market whatever the volume behind it.

What is not settled

Four things, kept visible rather than tidied away. Where we say something is unsettled we mean a specific thing about our own work, and how we decide that separates the three kinds of absence that sentence can carry.

Northern Ireland and the wider EEA

We have not settled how our own applicability logic should treat either. The consequence is deliberate. Where the position is undecided the duty stays live rather than switching off, so nobody is told a duty does not reach them on the strength of a question we have not answered. The separate question of what a business selling in Britain faces has its own answer, in what the UK position actually is.

Who counts as a supplier of an article for substance notifications

Whether a brand owner that never physically handles goods is the supplier of an article under REACH is not obvious from the text. We treat it as carrying the duty and we label that as our reading. It matters for the substance notification reference on the passport and nowhere else.

Whether ordinary apparel needs a declaration of conformity

Our reading is that it does not, and we have not had that reading tested by anybody else. Declarations belong to specific regimes such as personal protective equipment, medical devices, toys and electrical equipment. Ordinary clothing falls outside all of them. That is our reading of the instruments rather than a statement any of them makes, and it is the reason there is no public register of textile test reports to consult.

What the textile act will say about actors

Unknown, because it does not exist. Any page telling you today which actor carries a textile passport duty is describing the framework and calling it the product rules.

When any of this starts

This page carries no date, and the omission is deliberate. Adoption, entry into force, application and any transition period are four different things, and the status page is the only page here that states dates, row by row, with what is in force kept separate from what has been adopted and from what has only been signalled.

Sources

Everything here rests on primary law, and no article number appears anywhere above. Three separate reasons converge on that: two independent reads of the framework attributed its passport provisions to different articles, the framework's operator and support provisions are being read through a consolidated rendering rather than against the Official Journal's own text, and the safety instrument's provisions reached us through somebody else's reproduction. So each provision is named by what it does, and the numbers come back when they can be right. Where a provision has been reviewed we say so, and where it has not we say that instead. The distinction is not a formality on this page, because this is the one a reader is most likely to act on.

• Ecodesign for Sustainable Products Regulation (EU) 2024/1781, consolidated text
  CELEX 02024R1781-20240628In forceRelevant provisions reviewed

  The framework this page describes. Its operator provisions were reached through a consolidated rendering rather than against the Official Journal text, and the three provisions behind the section on small enterprises have not been read verbatim at all, which is why that section gives our reading rather than the wording. Two independent reads of this instrument attributed its passport provisions to different articles, so no article of it is cited here and each provision is named by what it does. That check is outstanding and it is the one thing that would change how any of them is cited.

  View official source

• Regulation (EU) 2019/1020 on market surveillance and compliance of products, Article 3
  In forceRelevant provisions reviewed

  The source of the placing on the market and making available definitions, and of the operator roles as this page uses them. The definitions were read in a consolidated rendering rather than against the Official Journal's own text, so the provision carrying them is named here by what it does along with the rest.

  View official source

• General Product Safety Regulation (EU) 2023/988
  In forceReached through a secondary reproduction, primary text not read

  Carries one thing here, which is that a responsible person established in the Union is a role the product safety instrument creates. That provision and the instrument's listing information provisions both reached us through a reproduction rather than at the Official Journal, so nothing here quotes them and no number is published for either. The role is recorded and it is modelled nowhere in the product.

  View official source

• REACH Regulation (EC) No 1907/2006, Articles 3(33) and 33
  In forceRelevant provisions reviewed

  Relevant here only for the supplier of an article question in the unsettled section above.

  View official source

• EU VAT number validation service
  Regulator dataReviewed in full

  The per Member State disclosure behaviour above is a live observation of a public interface rather than a documented specification, and it was observed in August 2026. It needs re-observing rather than re-reading before anybody relies on it.

  View official source

• Commission Implementing Regulation (EU) 2026/1778 establishing the Digital Product Passport registry
  CELEX 32026R1778In forceRelevant provisions reviewed

  Carries the four responsibility provisions above, read at article level by one research programme in August 2026: the provision putting responsibility for accuracy and completeness on the operator at the point of registration, the separate provision asking that the registered data be accurate, complete and up to date at all times, the provision allowing a third party to register on the operator's behalf while leaving the operator fully responsible, and the provision making the operator the controller of the data it submits. The instrument's internal numbering has not been checked against the Official Journal PDF, so no article number is published here and each provision is named by what it does. That check is outstanding.

  View official source