# How to Enrol Your Organisation in the EU DPP Registry

Source: https://activatedigital.ai/knowledge/regulation/enrolling-in-the-registry
Last verified: 7 October 2026
Summary: How EU DPP Registry enrolment works: EU Login, organisation verification, QSeal or QES, Commission declaration, rejection handling and what verification does not prove.

## In 60 seconds

Before a business can register a Digital Product Passport in the EU Registry, the organisation behind it has to be verified. An EU Login gets a person into the system. It does **not** verify the business.

- As checked on **7 October 2026**, the production Registry is available and organisations can enrol.
- A legal person needs a Qualified Electronic Seal (QSeal) and a sole trader a Qualified Electronic Signature (QES), both through a Qualified Trust Service Provider.
- User Guide v1.03 requires PAdES Baseline B, T, LT or LTA. A certificate installed only as a software file can produce an advanced rather than qualified seal.
- After successful verification the applicant becomes Administrator of the organisation. Verification does not create a DPP, register a product or prove compliance.
- The test environment is separate from production, uses a different EU Login and does not migrate test objects into production.
For the Commission's current PDF-based enrolment route, the practical sequence is:

**EU Login → organisation application → legal representative → Commission-sealed declaration → qualified signature or seal → upload → verification → administrator access.**

For a legal person, the current guide requires a **Qualified Electronic Seal (QSeal)**. For a natural person acting as a sole trader, it requires a **Qualified Electronic Signature (QES)**. If the checks fail, the application is rejected with an error report and can be corrected and resubmitted.

**Who can register?** Only a verified economic operator. A third party can register on your behalf, but it has to be a verified economic operator in its own right, and you stay fully responsible for what's registered and remain controller of the data you submit. [Where passport data lives](https://activatedigital.ai/knowledge/regulation/where-passport-data-lives) sets out that responsibility in full.

Nothing obliges a textile business to register anything in the Registry today. No product category that reaches a textile business carries a live registration duty, and Commission Implementing Regulation (EU) 2026/1778, which established the Registry, sets no compliance deadline of its own. It was adopted on 16 July 2026, published in the Official Journal the following day and entered into force on 6 August 2026. The portal has been operational since [20 July 2026](https://activatedigital.ai/knowledge/digital-product-passport/timeline).

## The current position

| Question | Current answer, checked 7 October 2026 |
|---|---|
| Is the production Registry available? | Yes. The Commission says organisations can now enrol. |
| Do I need EU Login? | Yes, for user authentication. |
| Does EU Login verify my organisation? | No. Organisation verification is a separate Registry process. |
| What happens after successful verification? | The applicant becomes Administrator of the new organisation in the Registry. |
| Legal person verification route | Current guide: QSeal from a Qualified Trust Service Provider. |
| Natural person / sole trader route | Current guide: QES from a Qualified Trust Service Provider. |
| Can a failed application be repaired? | Yes. The guide describes rejection reports and resubmission/restart routes. |
| Does verification mean my products comply? | No. It verifies the actor for Registry access. Product-law compliance is a separate question. |

If your question is **whether your business is the economic operator that carries the DPP obligation**, start with [Who carries the Digital Product Passport obligation?](https://activatedigital.ai/knowledge/regulation/who-carries-the-obligation). This page starts one step later: you have identified the organisation and now need to get it through the Registry's operational verification process.

## What enrolment is actually proving

The Registry needs to know who is acting and whether that person has the right to represent the organisation being enrolled.

The Commission's User Guide describes enrolment as the process of providing the information needed to:

- verify the applicant's right to represent the economic operator
- create the organisation profile
- create the administrator account associated with that organisation.
So an ordinary login is not enough. EU Login authenticates the user. Registry enrolment verifies the organisation relationship that sits behind the future registration activity.

The implementing regulation then gives that verified status legal significance inside the Registry. Only verified actors can perform the Registry operations available to their role.

## Do not confuse EU registry identity with UNTP identity credentials

The current EU DPP Registry identity check and the emerging UNTP identity model solve related problems through different trust frameworks.

For Registry enrolment, Commission Implementing Regulation (EU) 2026/1778 provides the controlling Union methods for verifying an economic operator. The current route can rely on mechanisms including qualified electronic signatures or seals, high-assurance electronic identification and qualifying electronic attestations under Union law.

UNTP uses decentralised identifiers and an emerging Digital Identity Anchor pattern to connect a digital identifier with authoritative identity evidence. That can be useful for interoperable supply-chain credentials, but it is **not the current legal substitute for the Registry verification methods**.

So a company should not assume that owning a DID, publishing a UNTP identity credential or operating a UNTP resolver satisfies the EU enrolment gate. Follow the Commission's Registry rules for the Registry, then map that verified organisational identity into other credential systems where there is a separate business reason to do so.

For the system-level comparison, see [EU Digital Product Passport vs UNTP DPP](https://activatedigital.ai/knowledge/regulation/eu-dpp-vs-untp). For the digital trust boundary, see [what a verifiable credential actually proves](https://activatedigital.ai/knowledge/evidence/verifiable-credentials).

## What to have ready before you start

The fastest route is to settle four things before opening the enrolment form.

### 1. The legal identity you are enrolling

The current interface separates organisations into **Legal Person** and **Natural Person**.

Use the legal identity that will carry the Registry responsibility. Do not use a trading name where the underlying certificate and legal records identify a different entity.

For legal persons, the guide asks for organisation identity information including legal name, country and an organisation identifier. It gives identifier types including a national trade register identifier, LEI, VAT/eID or a locally defined identifier depending on the case.

**The organisation data you type into the Registry needs to match the identity represented by the qualified seal or signature used later.**

### 2. An EU Login for the person doing the enrolment

The Registry uses EU Login for authentication. If the applicant does not have an EU Login account, one has to be created and confirmed first.

This is a user credential, not a company verification credential.

### 3. A legal representative who can complete the verification

The workflow asks for legal-representative information before the declaration is generated. The final declaration is not merely an uploaded company document. It is generated by the Registry from the information supplied and sealed by the European Commission.

### 4. Access to the right qualified trust service

This is the point most likely to turn a five-minute form into a procurement task.

Under the current v1.03 guide:

| Organisation type | Current verification instrument |
|---|---|
| Legal Person | Qualified Electronic Seal, QSeal |
| Natural Person acting as sole trader | Qualified Electronic Signature, QES |

The guide says the QSeal or QES must be provided through a **Qualified Trust Service Provider (QTSP)**. It also warns that possessing a qualified certificate is not necessarily enough to create a qualified signature or seal. A qualified creation device or qualified remote signing service may be needed.

The EU Trusted List Browser is the official place to inspect qualified trust service providers. Do not buy a generic “digital signature” product on the assumption that it will satisfy the Registry's current verification checks.

## The enrolment journey, step by step

### Step 1: Sign in through EU Login

Open the Commission's DPP Registry production environment. The Registry redirects the user to EU Login for authentication.

After successful authentication, a new user lands on the Registry welcome page.

### Step 2: Start a new organisation application

Choose the enrolment route and select the organisation's legal nature.

The current guide presents **Legal Person** and **Natural Person** as the two organisation types. Changing the type after entering data can clear the information already supplied, so choose the legal nature before filling the form.

Enter the requested organisation information exactly as it appears in the authoritative records and as it will appear in the qualified certificate used for the later signature or seal.

### Step 3: Add the legal representative

The verification journey asks for the information of the person legally representing the organisation.

This is not an invitation to create a convenient technical user. The representation data is part of the verification chain.

### Step 4: Ask the Registry to generate the declaration

The organisation information is locked into a PDF declaration generated through the Registry. The Commission applies its own seal to that declaration.

Treat this PDF as a controlled verification artefact.

Once downloaded, do not edit its substantive contents. The current guide says that, after download, the permitted change is the addition of the organisation's qualified signature or seal. Other changes can invalidate the declaration and force the verification process to restart.

### Step 5: Apply the organisation's QSeal or QES offline

The signing or sealing step happens outside the Registry.

For the PDF-based route in User Guide v1.03, the qualified signature or seal has to be embedded using an accepted **PAdES Baseline** profile: B, T, LT or LTA.

A valid certificate can still produce a document that the Registry rejects if the signing configuration does not produce the required qualified result or accepted PDF signature format.

The Commission guide points to its Digital Signature Service tools for signing and validation. Before uploading, validate the finished document and check that the result is qualified for the organisation type you are using.

### Step 6: Upload the signed or sealed declaration

Return to the Registry and upload the completed PDF declaration.

The current guide describes automated checks covering the integrity, validity and authenticity of the document, the signature or seal, associated certificates and the identity information they contain.

### Step 7: Submit and follow the application status

Submit the application and use the status view to follow the verification outcome.

A passing application results in the organisation being verified. The User Guide says that, after successful verification, the applicant becomes the **Administrator** of the new organisation in the DPP Registry.

A failing application is not a vague dead end. The current guide describes error reports and routes to upload a corrected declaration or restart the verification process where necessary.

## The failures worth preventing before you submit

The Commission guide contains a long error catalogue. Most of it collapses into five preventable classes.

### The declaration was changed

If the Commission-sealed PDF has been altered beyond adding the required qualified signature or seal, the integrity check can fail.

**Control:** keep the downloaded declaration as a controlled file and do not run it through document-cleaning, conversion or editing workflows.

### The identity in the certificate does not match the application

The Registry checks whether organisation details match information represented by the QES/QSeal certificate.

**Control:** compare legal name or natural-person name, identifier and country before the declaration is generated and again before signing.

### The seal or signature is not actually qualified

A non-qualified electronic signature or seal is not the same thing as a QES or QSeal.

The current guide specifically warns that a certificate installed only as a software file can result in an advanced rather than qualified signature/seal if no qualified signature creation device or qualified remote signing service is used.

**Control:** ask the QTSP what qualified creation method will be used, not merely whether it supplies a qualified certificate.

### The PDF signature format is wrong

User Guide v1.03 requires PAdES Baseline B, T, LT or LTA for this PDF-based process.

**Control:** validate the signed PDF using a trusted validation tool before upload. If using Acrobat or another general signing tool, do not assume its default format is the Registry-compatible one.

### The certificate is not trusted, is revoked or cannot be validated

**Control:** check certificate status and the QTSP chain before the first production submission.

## What successful enrolment gives you

It gives the organisation a verified Registry identity and gives the successful applicant administrative access for that organisation.

It does **not** create a DPP.

It does **not** register a product.

It does **not** establish that the organisation is substantively compliant with every product law that may apply.

It simply clears the actor-level gate that sits in front of Registry operations.

The implementing regulation says the same in its recitals: the Registry's automated checks confirm that a submission is structurally valid and complete, and they are not proof that the product complies with any requirement. No product should be described as registered or compliant on the strength of a Registry record. What the Registry holds, and what it does not, is on [where passport data lives](https://activatedigital.ai/knowledge/regulation/where-passport-data-lives).

Registration data is deleted ten years after registration, and a proof of registration can be retrieved for ninety days. [What proof of registration proves](https://activatedigital.ai/knowledge/evidence/proof-of-registration) covers that window.

The next operational question is [how to register a DPP in the EU Registry](https://activatedigital.ai/knowledge/regulation/how-to-register-a-dpp-eu-registry).

## The credential expires, and its price is not published

Verification does not last indefinitely. It runs until the underlying electronic identity means expires and never longer than 3 years for one economic operator, after which the operator has to be verified again before it can keep registering. That is a ceiling, not a passport lifetime or a compliance deadline. In practice it makes the seal a recurring purchase from a commercial vendor: a credential bought now will need renewing at least once before any textile duty could reach you, because no adopted act creates one.

Access to the Registry and its interfaces is free of charge, and the implementing regulation states no registration fee. The credential is the cost. We looked for a published figure for what a qualified electronic seal costs, at the Commission, at Member State supervisory bodies and in trade material. We did not find one. That is a finding about the published record as we found it, not a claim that no figure exists anywhere.

Ask a prospective trust service provider for the seal price, the renewal price and the identity evidence they need from your entity, in writing, before any of it goes into a plan. Ask a software vendor whether their price includes a seal or assumes you already hold one.

## If a vendor registers for you

A vendor can make the submission. It cannot take the responsibility, and nothing in the implementing regulation moves it. Five questions separate a vendor who has done this from one who has read about it:

- Are you a verified economic operator yourselves, and in which Member State?
- Is the registration made under your seal or under ours, and whose identity appears against the record?
- What happens to the registrations if we stop working with you?
- Who hosts the passport data the Registry's link points at, and what happens to that link if the hosting stops?
- What do you do, and what do you need from us, when our verification comes up for renewal?

## Production and test enrolment are separate

The Commission also provides a [DPP Registry test environment](https://activatedigital.ai/knowledge/regulation/registry-test-environment). Under User Guide v1.03 it is separate from production, uses a different EU Login and does not migrate test objects into production.

The verification process in the test environment is described as the same as production. So the sandbox is useful for rehearsing the real organisational process, but it is not a shortcut around qualified signatures/seals or valid organisation data.

For a business that expects to automate or delegate DPP registration later, rehearsing enrolment early can expose a surprisingly non-technical dependency: who owns the qualified trust credential and who is authorised to use it.

## What to do now

For most readers the right action today is none. No adopted act creates a registration duty for textiles, and buying a credential well ahead of any duty means renewing it to protect a capability nobody requires. Four things are worth doing anyway, and none of them costs anything:

- Establish [which economic operator role](https://activatedigital.ai/knowledge/regulation/who-carries-the-obligation) your business occupies. That question comes before the Registry and does not change when a product act arrives.
- Decide which legal entity in your group would hold the seal, since verification attaches to an entity rather than to a brand or a website.
- Put the renewal arithmetic in front of whoever would sign the purchase order, so a three-year ceiling is understood as recurring before anything is bought.
- Keep the vendor questions above in the file you use when somebody offers to handle Registry submission for you.
Do not let a Registry deadline into a plan, because the implementing regulation does not create one.

### DO NOW

If you expect to be the economic operator responsible for a product group whose DPP obligation is approaching:

- confirm the exact legal entity that will register
- confirm who can act as legal representative
- check whether an appropriate QSeal or QES is already available
- verify the organisation data that will have to match the certificate
- decide who will hold the Registry Administrator role.

### TEST NOW

Use the test environment to rehearse the enrolment process if the organisation is prepared to use valid organisation data and the required qualified signature/seal.

### PREPARE

Treat the Registry Administrator role and qualified trust credential as controlled business infrastructure. Decide who owns them, how access is recovered and how responsibility moves if staff change. Product identifiers come later, when passports are registered, and you can [check your GTINs before registration](https://activatedigital.ai/gtin-checker).

### WATCH

Watch for a newer Commission User Guide or changes to the verification methods permitted by the implementing regulation and operational system.

### DO NOT HARD-CODE

Do not hard-code User Guide v1.03's screen labels, PDF workflow or signing-tool settings into long-lived internal software. They describe the current implementation, not an immutable legal interface.

## Direct questions

### Can I use EU Login to register a DPP immediately?

No. EU Login authenticates the user. The organisation must also complete the Registry's verification process before it can perform the available DPP registration operations.

### Does my company need a QSeal?

For the current PDF-based verification route described in Commission User Guide v1.03, a legal person uses a Qualified Electronic Seal. A natural person acting as sole trader uses a Qualified Electronic Signature.

### Is a digital certificate enough?

Not necessarily. The current guide explicitly distinguishes a qualified certificate from the creation of a qualified signature or seal. The result needs to meet the required qualified level and accepted PDF signature format.

### What happens if verification fails?

The application is rejected with an error outcome. The current guide provides routes to correct the declaration/signature issue and resubmit or restart verification depending on the problem.

### Does verification prove my company or products comply with EU law?

No. It verifies the actor for Registry purposes. Product-law compliance and the correctness of DPP content remain separate questions.

## What would change this page

Recheck this page whenever the Commission publishes a newer DPP Registry User Guide, changes the enrolment/verification workflow or introduces additional permitted identity-verification methods in the production service.

## Keep exploring

The questions this page usually raises next.

- [CompareNext questionDPP Registry & Operational Infrastructure: where passport data lives and how the system fits together→](https://activatedigital.ai/knowledge/regulation/where-passport-data-lives)
- [CompareNext questionHow to use the EU DPP Registry test environment→](https://activatedigital.ai/knowledge/regulation/registry-test-environment)
- [CompareNext questionHow to register a DPP in the EU Registry→](https://activatedigital.ai/knowledge/regulation/how-to-register-a-dpp-eu-registry)
- [Evidence behind thisNext questionWhat proof of registration proves→](https://activatedigital.ai/knowledge/evidence/proof-of-registration)
- [CompareNext questionWho carries the Digital Product Passport obligation?→](https://activatedigital.ai/knowledge/regulation/who-carries-the-obligation)

## Primary and official sources

- [European Commission, **The DPP Registry**](https://single-market-economy.ec.europa.eu/single-market/digital-product-passport/dpp-registry_en) European Commission
- [European Commission, **DPP Registry User Guide for Economic Operators**, v1.03, last published 16 September 2026](https://single-market-economy.ec.europa.eu/document/download/079a45e2-469f-4eec-b1e5-32e8e05d1357_en?filename=dpp_registry_user_guide_for_economic_operators.pdf) Official guidance
- [Commission Implementing Regulation (EU) **2026/1778**, especially Articles 3 to 6 and 19](https://eur-lex.europa.eu/eli/reg_impl/2026/1778/oj) Delegated or implementing act
- [Regulation (EU) No **910/2014** on electronic identification and trust services, as amended](https://eur-lex.europa.eu/eli/reg/2014/910/oj) EU law
- EU/EEA Trusted List Browser
[https://eidas.ec.europa.eu/efda/trust-services/browse/eidas/tls](https://eidas.ec.europa.eu/efda/trust-services/browse/eidas/tls)