Annex III: the data a DPP can contain

Summary

Annex III to Regulation (EU) 2024/1781 sets out the elements from which the delegated acts specify what data are to or can be included in a Digital Product Passport. The requirements are therefore not uniform across products. A delegated act for one product group may require a given element, make it optional or leave it out, and it may also name additional information relevant to ecodesign that manufacturers can include voluntarily.

The list has twelve elements, marked (a) to (l). They range from product information and identifiers, through commodity codes and compliance documents, to details about the manufacturer, importer, facilities and the party hosting the back-up copy. Understanding them in advance lets a business check whether the data it holds today could be used for a passport later.

Identifiers get particular attention. The Global Trade Item Number is named in element (c) as defined in ISO/IEC 15459-6 or an equivalent, and the standards for the data carrier, the unique product identifier, and the unique operator and facility identifiers are the ISO/IEC 15459 series, parts 1 to 6, or equivalent European or international standards until references to harmonised standards are published. Relevant commodity codes, such as a TARIC code, appear in element (d).

For imports, element (j) calls for importer information, including the contact details that Article 29(3) requires, and the importer's Economic Operators Registration and Identification (EORI) number. Element (k) adds the name, contact details and unique operator identifier of the economic operator established in the Union who carries out the tasks of Article 4 of Regulation (EU) 2019/1020 or Article 15 of Regulation (EU) 2023/988.

It would be a mistake to read more into Annex III than it says. The text does not name QR codes, GS1 Digital Link, a data model or a vocabulary. It gives you an inventory of what a passport can hold and the identifier standards to use, and leaves everything else to the delegated act for the product group.

Identifiers and codes you will meet

Several of the Annex III elements are identifiers that already exist in trade and customs practice.

Global Trade Item Number (GTIN)

The trade item identifier named in element (c) as provided for in ISO/IEC 15459-6 or an equivalent, for products or their parts. If your products already carry a GTIN, that is the natural starting point for a product-level identifier, but the delegated act decides the level and the form.

Commodity code, such as TARIC

Element (d) refers to relevant commodity codes such as a TARIC code defined in Regulation (EEC) No 2658/87. For products placed under the customs procedure release for free circulation, the Article 13 registry also stores the commodity code.

EORI number

The Economic Operators Registration and Identification number of the importer, listed in element (j) together with the importer information required by Article 29(3).

Unique operator identifier

Elements (g), (h) and (k) refer to unique operator identifiers of the manufacturer, of other operators and of the responsible operator established in the Union. If one is not yet available, the operator that creates or updates the passport requests it on behalf of the actor concerned, after confirming that none exists.

Unique facility identifier

Element (i) lists unique facility identifiers for locations or buildings. The same rule applies: where none exists, the operator creating or updating the passport requests it on behalf of the party responsible for the location.

DPP service provider reference

Element (l) is the reference of the DPP service provider hosting the back-up copy of the passport, which links the passport to the continuity mechanism of Article 10(4).

The twelve data elements of Annex III

How to use Annex III in practice

Use the list as a data audit rather than a to-do list. For each element, ask whether you hold the data, where it is stored, whether it is maintained, and who owns it. Elements (b), (c), (d) and (g) to (j) rely on identifiers and codes that many businesses already hold in ERP or customs systems, whereas (a), (e) and (f) depend on documentation processes.

Importers should look closely at element (j). The contact details that Article 29(3) requires, namely name, registered trade name or trade mark and postal and electronic address, are to appear on the public part of the passport where applicable, alongside the importer's EORI number. Having a clean, validated EORI record and a stable contact record is therefore preparation that costs little and applies in any scenario.

Do not map data to a specific code symbology or syntax on the basis of Annex III. The Annex names the ISO/IEC 15459 series for identifiers and carriers and does not name a symbology, a web identifier scheme or a data model. Wait for the delegated act of your product group before committing to a format.

What the text leaves open

Annex III does not settle the following, and we offer no view on them.

• Which of the twelve elements are mandatory for a given product group, because the delegated acts decide this.
• The data model, vocabulary and format for each element.
• Who has read access to which element, which the delegated act determines for each group of actors.

Exemptions

Annex III contains no exemptions. Whether a product group is subject to a passport at all depends on a delegated act, and the Commission may exempt a product group where technical specifications are not available or where other Union law already provides equivalent digital information (Article 9(4)).

Acts that decide the content

We have not verified the adoption status of any of them.

• Product-specific delegated acts under Article 4 that choose among the Annex III elements. Application not earlier than 18 months after entry into force, except in duly justified cases.

Where to start

This list is a practical suggestion, not wording taken from the Regulation.

1. List the twelve elements and mark which ones you can already supply from existing systems.
2. Check that your GTINs, commodity codes and EORI records are complete and current.
3. Find out whether your facilities and operators already have identifiers that would qualify as unique identifiers.
4. Identify which compliance documents (declarations, certificates, technical files) exist in a machine-readable form.
5. Postpone any technology decision until the delegated act for your product group names the carrier and level.

Frequently asked questions

Does ESPR require QR or GS1 Digital Link?

The regulation text does not name a specific carrier format; it requires a persistent unique identifier linked through a data carrier that complies with the Annex III standards (ISO/IEC 15459 series) or equivalent. Specific formats are expected from the product-specific delegated acts.

Sources

• Regulation (EU) 2024/1781 of the European Parliament and of the Council of 13 June 2024 establishing a framework for the setting of ecodesign requirements for sustainable products, OJ L, 28.6.2024: Articles 12, 29 and Annex III

Facts last checked against the Official Journal text on 6 November 2026.