Skip to content

What proof of registration proves, and what a buyer will assume it proves

The registry can produce a sealed electronic document saying a named operator registered a named product at a named moment. The regulation says that document serves as evidence, including against third parties. A different provision says communication from the registry is not proof of compliance. Both sentences are correct, and the gap between them is where the next few years of procurement arguments will happen.

Sources as at
28 August 2026
Share
LinkedIn X Email
On this page

The short answer

Proof of registration proves that a registration happened. It proves the identity of the operator that made it, the moment it was made and, through a cryptographic hash, exactly which version of the passport was registered.

It proves nothing about the product. Not that the fibre content is right, not that a claim is substantiated, not that anything complies with anything.

That distinction is not an interpretation this estate is offering. It is written into both instruments, in opposite directions, and reading them together is the whole of the subject.

What the document actually contains

Article 9 of Commission Implementing Regulation (EU) 2026/1778 lets an economic operator, or a third party acting on its behalf, generate proof of registration at any time for one or more passports. It is a secure electronic document, downloadable from the registry through the interface or the API, and Article 9(2) sets a floor of five things it must carry.

The five elements Article 9(2) of the registry implementing regulation requires a proof of registration to carry, and the job each one does.
What the proof carriesWhat that element does
The unique product identifierTies the document to a product rather than to a company
The commodity code, where relevantTies it to what was declared for customs purposes, which is where the border check eventually compares them
The name and identity of the verified economic operator responsible for the registrationNames who is accountable, which is not always the party handing you the document
The date and time of the registration of the latest passport version, validated by a Commission electronic time stampEstablishes when, on the Commission's clock rather than anybody else's
A hash of the version of the passport used to generate the proofTies it to one exact state of the data

Article 9(3) requires the whole document to be guaranteed by a qualified electronic seal as provided for in Article 38 of Regulation (EU) No 910/2014, the same trust framework that sits behind the credential a business needs before it can register anything at all. That is a real cryptographic guarantee of origin and integrity, and it is the reason this document is worth more than a screenshot of a portal.

The two sentences that look like they disagree

Article 9(2) says the proof "shall serve as evidence, including vis-à-vis third parties, that the registration obligation has been fulfilled".

Article 13(5) of the Ecodesign for Sustainable Products Regulation says that the registry's communication of a unique registration identifier "shall not be deemed to be proof of compliance with this Regulation or other Union law".

Nothing in the published coverage we read reconciles these. They reconcile easily, and the reconciliation is the useful part: they are about two different propositions.

  • The registration obligation was fulfilled. True or false as a matter of record. The registry knows the answer. Article 9 hands you that answer in a sealed document.
  • The product complies. True or false as a matter of substance. The registry does not know the answer and does not claim to.

Recital 16 of the implementing regulation makes the same separation from the other end, saying that verification of the substantive correctness of registered data "remains a task for the market surveillance authorities" and that the automated verifications "should not be deemed to constitute proof of compliance". What the registry checks at submission, and how narrow those five automated checks are, is set out at where your passport data actually lives.

So a proof of registration is a strong document about a weak proposition. That is not a criticism. A document that does one thing reliably is more useful than one that gestures at several.

The hash is the part worth understanding

Of the five elements, the hash is the one a counterparty should actually care about, and it is the one nobody is explaining.

A hash of a passport version means the proof is tied to one exact state of the data. Change any value in the passport and the hash of the new version will not match the one in the document you handed over. That makes proof of registration a tamper evidence instrument rather than merely a receipt.

Two practical consequences follow, and they run in opposite directions.

For the party receiving one, the useful question is not "do you have a proof of registration" but "does the passport I am looking at today still correspond to the version in this proof". A proof from March against a passport edited in July tells you something real: the record moved.

For the party issuing one, the same property is a discipline. Every correction changes the hash. A business that corrects a value has not invalidated its compliance, but it has invalidated the specific document a customer is holding, and nothing in the instrument requires anybody to tell that customer. Who stays responsible once a value is published, and what happens when one turns out to be wrong, is worked through at who has to own this.

Ninety days, and what that does to a procurement file

Article 9(4) makes the proof available for 90 calendar days from the date it is generated, through the interface or API the operator chose, and it can be generated again.

That number gets misreported. At least one widely read explanation states that proof of registration is retained for ten years. Ten years is the Article 10(3) rule for deleting registration data where Union law sets no specific availability period. It is not the life of the document. Conflating the two overstates the shelf life of the artefact by a factor of about forty, and a buyer relying on it will file something that has quietly stopped being retrievable.

The operational reading is short. Proof of registration is a document you generate on demand, not a certificate you obtain once and keep. A procurement process that requests one at onboarding and files it has a document that ages twice over: it stops being retrievable from the registry after 90 days, and it stops describing the current passport the moment anybody edits a value.

The better arrangement, for both sides, is to ask for a fresh proof at the moment it matters rather than to hold an old one. That is a change to a supplier onboarding process rather than to a system.

The other thing the registry can evidence

One provision that goes unmentioned everywhere is worth knowing because it protects you rather than your customer.

Article 15(3) lets the Commission suspend the registry's availability without prior notice where there is a malfunction, a cyber attack or a compelling urgent security need. Article 15(4) then says that where registration was prevented by temporary unavailability or malfunctioning, the Commission records the date and time and makes that information available on request, for no less than five years, to economic operators, value chain actors, competent national authorities and customs authorities.

That is a second, quieter evidence instrument. If a registration could not be made because the registry was down, there is an authoritative record of the outage and you are entitled to ask for it. Worth knowing before anybody has to explain a gap.

Three phrases that do not survive contact with the instrument

The commercial risk in this subject is not that a business fails to obtain proof of registration. It is that somebody describes it wrongly, in writing, to a customer.

Three phrases in commercial use, and the provision that refuses each of them.
The phraseWhy it fails
EU verifiedThe registry verified the operator's identity, not the product. Verified economic operator status is a check on a legal entity and establishes nothing about goods
Registry approvedNothing is approved. Article 8(7) confirms structure, granularity, coherence, commodity code range and backup link validity. Confirmation is not approval
EU compliantRecital 16 declines to make this claim and ESPR Article 13(5) declines to make it too. A business making it on the strength of a registration is making a claim the regulator specifically withheld

The estate's own rule follows from this and applies to the businesses we work with as much as to anybody else: no product is described as registered or compliant on the strength of a registry record. The wider question of what a filled field can and cannot establish about a product is the subject of what a passport field can and cannot prove.

What to do with this

  1. Generate one and look at it. For anybody who can already register, the document is free and takes minutes. Reading the five elements settles most arguments about what it is.
  2. Change the onboarding question. Ask suppliers for a proof generated within a stated window rather than for a proof on file. The 90 days makes the second request meaningless.
  3. Record the hash alongside the proof. It is the element that lets you detect a changed record later, and it is worthless if nobody stores it.
  4. Fix the language in your own templates now. Supplier questionnaires, sales collateral and certification claims written this year will be quoted back at you for a decade.
  5. Do not accept a proof as evidence of anything about the goods. If a supplier offers one in answer to a question about composition or substantiation, the answer to the question has not been given.

You might want to read next

Since you have read this, these may answer the questions that usually come next.

Sources

The ten year misreport described above was found in current published coverage of the registry. It is described rather than linked, because the point is the error and not the publisher.

Worth sharing?

Help someone else make sense of product passports.

LinkedIn X Email