How to Enrol Your Organisation in the EU DPP Registry
How EU DPP Registry enrolment works: EU Login, organisation verification, QSeal or QES, Commission declaration, rejection handling and what verification does not prove.
Navigate this page
- Overview
- The current position
- What enrolment is actually proving
- What to have ready before you start
- The enrolment journey, step by step
- The failures worth preventing before you submit
- What successful enrolment gives you
- Production and test enrolment are separate
- What to do now
- Direct questions
- What would change this page
- Primary and official sources
Before a business can register a Digital Product Passport in the EU Registry, the organisation behind it has to be verified. An EU Login gets a person into the system. It does not verify the business. For the Commission's current PDF-based enrolment route, the practical sequence is: EU Login → organisation application → legal representative → Commission-sealed declaration → qualified signature or seal → upload → verification → administrator access. For a legal person, the current guide requires a Qualified Electronic Seal (QSeal). For a natural person acting as a sole trader, it requires a Qualified Electronic Signature (QES). If the checks fail, the application is rejected with an error report and can be corrected and resubmitted. That is the operational gate in front of DPP registration.
The current position
| Question | Current answer, checked 3 September 2026 |
|---|---|
| Is the production Registry available? | Yes. The Commission says organisations can now enrol. |
| Do I need EU Login? | Yes, for user authentication. |
| Does EU Login verify my organisation? | No. Organisation verification is a separate Registry process. |
| What happens after successful verification? | The applicant becomes Administrator of the new organisation in the Registry. |
| Legal person verification route | Current guide: QSeal from a Qualified Trust Service Provider. |
| Natural person / sole trader route | Current guide: QES from a Qualified Trust Service Provider. |
| Can a failed application be repaired? | Yes. The guide describes rejection reports and resubmission/restart routes. |
| Does verification mean my products comply? | No. It verifies the actor for Registry access. Product-law compliance is a separate question. |
If your question is whether your business is the economic operator that carries the DPP obligation, start with Who carries the Digital Product Passport obligation? and What a business has to be before it can register anything. This page starts one step later: you have identified the organisation and now need to get it through the Registry's operational verification process.
What enrolment is actually proving
The Registry needs to know who is acting and whether that person has the right to represent the organisation being enrolled.
The Commission's User Guide describes enrolment as the process of providing the information needed to:
- verify the applicant's right to represent the economic operator
- create the organisation profile
- create the administrator account associated with that organisation.
That is why an ordinary login is not enough. EU Login authenticates the user. Registry enrolment verifies the organisation relationship that sits behind the future registration activity.
The implementing regulation then gives that verified status legal significance inside the Registry. Only verified actors can perform the Registry operations available to their role.
What to have ready before you start
The fastest route is to settle four things before opening the enrolment form.
1. The legal identity you are enrolling
The current interface separates organisations into Legal Person and Natural Person.
Use the legal identity that will actually carry the Registry responsibility. Do not use a trading name where the underlying certificate and legal records identify a different entity.
For legal persons, the guide asks for organisation identity information including legal name, country and an organisation identifier. It gives identifier types including a national trade register identifier, LEI, VAT/eID or a locally defined identifier depending on the case.
The practical rule is more important than the list: the organisation data you type into the Registry needs to match the identity represented by the qualified seal or signature used later.
2. An EU Login for the person doing the enrolment
The Registry uses EU Login for authentication. If the applicant does not have an EU Login account, one has to be created and confirmed first.
This is a user credential, not a company verification credential.
3. A legal representative who can complete the verification
The workflow asks for legal-representative information before the declaration is generated. The final declaration is not merely an uploaded company document. It is generated by the Registry from the information supplied and sealed by the European Commission.
4. Access to the right qualified trust service
This is the point most likely to turn a five-minute form into a procurement task.
Under the current v1.02 guide:
| Organisation type | Current verification instrument |
|---|---|
| Legal Person | Qualified Electronic Seal, QSeal |
| Natural Person acting as sole trader | Qualified Electronic Signature, QES |
The guide says the QSeal or QES must be provided through a Qualified Trust Service Provider (QTSP). It also warns that possessing a qualified certificate is not necessarily enough to create a qualified signature or seal. A qualified creation device or qualified remote signing service may be needed.
The EU Trusted List Browser is the official place to inspect qualified trust service providers. Do not buy a generic “digital signature” product on the assumption that it will satisfy the Registry's current verification checks.
The enrolment journey, step by step
Step 1: Sign in through EU Login
Open the Commission's DPP Registry production environment. The Registry redirects the user to EU Login for authentication.
After successful authentication, a new user lands on the Registry welcome page.
Step 2: Start a new organisation application
Choose the enrolment route and select the organisation's legal nature.
The current guide presents Legal Person and Natural Person as the two organisation types. Changing the type after entering data can clear the information already supplied, so choose the legal nature before filling the form.
Enter the requested organisation information exactly as it appears in the authoritative records and, importantly, as it will appear in the qualified certificate used for the later signature or seal.
Step 3: Add the legal representative
The verification journey asks for the information of the person legally representing the organisation.
This is not an invitation to create a convenient technical user. The representation data is part of the verification chain.
Step 4: Ask the Registry to generate the declaration
The organisation information is locked into a PDF declaration generated through the Registry. The Commission applies its own seal to that declaration.
Treat this PDF as a controlled verification artefact.
Once downloaded, do not edit its substantive contents. The current guide says that, after download, the permitted change is the addition of the organisation's qualified signature or seal. Other changes can invalidate the declaration and force the verification process to restart.
Step 5: Apply the organisation's QSeal or QES offline
The signing or sealing step happens outside the Registry.
For the PDF-based route in User Guide v1.02, the qualified signature or seal has to be embedded using an accepted PAdES Baseline profile: B, T, LT or LTA.
That technical detail matters because a valid certificate can still produce a document that the Registry rejects if the signing configuration does not produce the required qualified result or accepted PDF signature format.
The Commission guide points to its Digital Signature Service tools for signing and validation. Before uploading, validate the finished document and check that the result is genuinely qualified for the organisation type you are using.
Step 6: Upload the signed or sealed declaration
Return to the Registry and upload the completed PDF declaration.
The current guide describes automated checks covering the integrity, validity and authenticity of the document, the signature or seal, associated certificates and the identity information they contain.
Step 7: Submit and follow the application status
Submit the application and use the status view to follow the verification outcome.
A passing application results in the organisation being verified. The User Guide says that, after successful verification, the applicant becomes the Administrator of the new organisation in the DPP Registry.
A failing application is not a vague dead end. The current guide describes error reports and routes to upload a corrected declaration or restart the verification process where necessary.
The failures worth preventing before you submit
The Commission guide contains a long error catalogue. Most of it collapses into five preventable classes.
The declaration was changed
If the Commission-sealed PDF has been altered beyond adding the required qualified signature or seal, the integrity check can fail.
Control: keep the downloaded declaration as a controlled file and do not run it through document-cleaning, conversion or editing workflows.
The identity in the certificate does not match the application
The Registry checks whether organisation details match information represented by the QES/QSeal certificate.
Control: compare legal name or natural-person name, identifier and country before the declaration is generated and again before signing.
The seal or signature is not actually qualified
A non-qualified electronic signature or seal is not the same thing as a QES or QSeal.
The current guide specifically warns that a certificate installed only as a software file can result in an advanced rather than qualified signature/seal if no qualified signature creation device or qualified remote signing service is used.
Control: ask the QTSP what qualified creation method will be used, not merely whether it supplies a qualified certificate.
The PDF signature format is wrong
User Guide v1.02 requires PAdES Baseline B, T, LT or LTA for this PDF-based process.
Control: validate the signed PDF using a trusted validation tool before upload. If using Acrobat or another general signing tool, do not assume its default format is the Registry-compatible one.
The certificate is not trusted, is revoked or cannot be validated
Control: check certificate status and the QTSP chain before the first production submission.
What successful enrolment gives you
It gives the organisation a verified Registry identity and gives the successful applicant administrative access for that organisation.
It does not create a DPP.
It does not register a product.
It does not establish that the organisation is substantively compliant with every product law that may apply.
It simply clears the actor-level gate that sits in front of Registry operations.
The next operational question is how to register a DPP in the EU Registry.
Production and test enrolment are separate
The Commission also provides a DPP Registry test environment. Under User Guide v1.02 it is separate from production, uses a different EU Login and does not migrate test objects into production.
The verification process in the test environment is described as the same as production. That means the sandbox is useful for rehearsing the real organisational process, but it is not a shortcut around qualified signatures/seals or valid organisation data.
For a business that expects to automate or delegate DPP registration later, rehearsing enrolment early can expose a surprisingly non-technical dependency: who owns the qualified trust credential and who is authorised to use it.
What to do now
DO NOW
If you expect to be the economic operator responsible for a product group whose DPP obligation is approaching:
- confirm the exact legal entity that will register
- confirm who can act as legal representative
- check whether an appropriate QSeal or QES is already available
- verify the organisation data that will have to match the certificate
- decide who will hold the Registry Administrator role.
TEST NOW
Use the test environment to rehearse the enrolment process if the organisation is prepared to use valid organisation data and the required qualified signature/seal.
PREPARE
Treat the Registry Administrator role and qualified trust credential as controlled business infrastructure. Decide who owns them, how access is recovered and how responsibility moves if staff change.
WATCH
Watch for a newer Commission User Guide or changes to the verification methods permitted by the implementing regulation and operational system.
DO NOT HARD-CODE
Do not hard-code User Guide v1.02's screen labels, PDF workflow or signing-tool settings into long-lived internal software. They describe the current implementation, not an immutable legal interface.
Direct questions
Can I use EU Login to register a DPP immediately?
No. EU Login authenticates the user. The organisation must also complete the Registry's verification process before it can perform the available DPP registration operations.
Does my company need a QSeal?
For the current PDF-based verification route described in Commission User Guide v1.02, a legal person uses a Qualified Electronic Seal. A natural person acting as sole trader uses a Qualified Electronic Signature.
Is a digital certificate enough?
Not necessarily. The current guide explicitly distinguishes a qualified certificate from the creation of a qualified signature or seal. The result needs to meet the required qualified level and accepted PDF signature format.
What happens if verification fails?
The application is rejected with an error outcome. The current guide provides routes to correct the declaration/signature issue and resubmit or restart verification depending on the problem.
Does verification prove my company or products comply with EU law?
No. It verifies the actor for Registry purposes. Product-law compliance and the correctness of DPP content remain separate questions.
What would change this page
Recheck this page whenever the Commission publishes a newer DPP Registry User Guide, changes the enrolment/verification workflow or introduces additional permitted identity-verification methods in the production service.
Does this reach your products?
Give ActivateDigital one product and it works out which obligations apply from the product's own character, and says which it cannot decide.
Help someone else make sense of product passports.
Primary and official sources
https://eidas.ec.europa.eu/efda/trust-services/browse/eidas/tls