Digital Passport, who sees what: a date has finally been set for differentiated access.

From Theory to Timeline

For months, it has been reiterated that the Digital Product Passport (DPP) will not be an open showcase where everyone can see everything. Consumers will be able to view the environmental footprint and repair instructions; recyclers will have access to information on material composition; and regulatory authorities will be able to review compliance documentation. The principle of differentiated access has been embedded in the ESPR (Ecodesign for Sustainable Products Regulation) (EU) 2024/1781 from the very beginning.

However, one crucial question for businesses remained unanswered: when will this take effect? In the autumn of 2026, the picture finally became clear. There is no single date for everyone; instead, there are three distinct milestones: a technical standard, an implementing act, and the first legal obligation.

Milestone 1 – The Technical Standard: EN 18239 (September 2026)

In May 2026, the joint CEN-CENELEC committee JTC 24 published the first six European standards for the DPP, covering unique identifiers, data carriers, APIs, data storage, and more. In July 2026, the European Commission referenced these in the Official Journal.

The final piece of the puzzle—security—was addressed in September 2026 with the publication of the standard EN 18239:2026, which focuses on:

• the management of access rights, including those based on roles and attributes;
• the security of information systems;
• the protection of commercial confidentiality;
• the transfer of responsibilities and permissions between economic operators.

While this standard establishes the foundational rules, the specific details regarding who is permitted to view which data will be determined by the regulatory acts governing each individual sector.

Milestone 2 – Who Has a "Legitimate Interest"? The Batteries Act (late 2026)

Batteries serve as the initial litmus test. Regulation (EU) 2023/1542 establishes three levels of access:

1. Public: performance, sustainability, and general model data;
2. Parties with a legitimate interest: repairers, remanufacturers, and recyclers, with access to data for repair, remanufacturing, and end-of-life processing;
3. Authorities and the Commission: test reports and compliance documentation.

The specific criteria for inclusion in the second category remained to be defined. The Commission was expected to adopt the implementing act by August 18, 2026, but this deadline was missed. A consultation on the draft began in October 2026 and will conclude on November 16, 2026. Adoption is anticipated by the fourth quarter of 2026.

Milestone 3 – The first obligation: February 18, 2027

The delay in the implementing act has not shifted the deadline. As of February 18, 2027, batteries for electric vehicles, light means of transport (LMT), and industrial batteries with a capacity exceeding 2 kWh must feature a passport with access rights already segmented by level. Consequently, battery manufacturers and importers will have only a few weeks between the publication of the final rules and the date they become mandatory.

What about all other products?

There is no single date for products covered by the ESPR (Ecodesign for Sustainable Products Regulation). Each product group will be subject to its own delegated act, which will specify the required data, the formats, and the access rights. The Commission’s indicative timeline includes:

Period	Milestone
Q4 2026	Delegated act for iron and steel
Q3–Q4 2027	Delegated acts for textiles, aluminium, and tyres
2029	Mandatory Digital Product Passport (DPP) for ICT, tyres, aluminium, textiles, and detergents

These are indicative timelines and are subject to change.

What to do now

• Classify your data into three tiers now: public, supply-chain-restricted, and authority-restricted. The general framework will remain consistent; only sector-specific details will vary.
• Evaluate DPP providers: Ensure your chosen platform can dynamically manage roles and permissions and complies with the EN 18239 standard.
• Monitor the delegated act on batteries—even if you do not manufacture batteries. It will serve as the blueprint for all subsequent sectors.
• Safeguard trade secrets by conducting an internal assessment to distinguish between mandatory disclosures and information that should remain confidential.

Conclusion

Differentiated access is no longer just an abstract concept. A technical standard exists, a delegated act defining authorized access for batteries is on the way, and a firm deadline has been set: February 18, 2027. For all other sectors, this same logic will be introduced via delegated acts between 2027 and 2030. Organizations that begin structuring their data by access levels today will gain a competitive advantage.