What happens to your passports when the business changes hands

The short answer

Article 6a of Commission Implementing Regulation (EU) 2026/1778 says it in one sentence:

Three words in that sentence decide most of what follows. May means nothing happens on its own. Verified means the receiving party has to already hold registry status before it can receive anything. Takes over the obligations means what moves is not a file, it is a duty.

Recital 10 says what the mechanism is for: an operator or value chain actor that did not pass identity verification before the deadline, and organisational changes "such as merging, splitting or sale of all or parts of the actor, cessation of activities or other circumstances".

So the machinery exists, it covers the events a corporate lawyer would expect it to cover, and it is entirely manual.

Why a product outlives the arrangement that made it

It is worth being explicit about why this matters more than a one line provision suggests.

The framework already assumes the company stops. The Ecodesign for Sustainable Products Regulation requires passport data to remain available for at least the expected lifetime of the product, and requires it to remain available including after an insolvency, a liquidation or a cessation of activity in the Union. The registry regulation adds a default deletion of registration data ten years after registration where Union law sets no specific period.

Put those next to the ordinary lifespan of a corporate arrangement. Brands are sold. Divisions are carved out. Licences lapse. Companies fail. Meanwhile the garment, the appliance or the component is still in somebody's hands, still repairable, still resalable and still within the period the law expects a record to answer for it.

The passport is therefore an obligation with a longer half life than most of the entities that carry it. That is the idea underneath Article 6a, and it is the reason the provision belongs in a sale agreement rather than in an IT migration plan.

Share sale, asset sale, and the difference nobody states

The most useful thing this page can do is separate two transactions that are routinely discussed as one.

A share sale usually needs no transfer at all. Registry status attaches to a legal entity. If the buyer acquires the shares in the company that holds the verified economic operator status, the legal person is unchanged, the registrations are unchanged, and there is nothing to move. What does change is who controls that entity, and the practical questions are about the credential rather than the registrations: who holds the seal, who is named on the user profiles and whether the verification is close to expiry.

An asset sale is where Article 6a does its work. If a buyer acquires a brand, a range or a division without acquiring the legal entity, the registrations sit with a company that no longer places those goods on the market. Something has to move them, and Article 6a is the only mechanism the instrument provides.

That distinction is the single sentence most missing from published coverage of this subject. Nothing found in the current search landscape addresses it.

Which entity occupies which role in the first place is prior to all of this and is not always the company that assumes it is, which is the subject of who carries the obligation.

The transferee has to already be verified

Article 6a transfers to "another verified economic operator" or, where applicable, a verified value chain actor. Not to any company. To one that has already been through the identity verification in Article 4 or Article 5.

That is a sequencing problem with a clock on it. Verification runs on an electronic identity means, and Articles 4(4) and 5(4) cap it at three years from the date of verification, or the expiry of the underlying means if that comes sooner. So a transfer has a precondition that itself takes procurement time, because the credential involved is bought from a commercial trust service provider rather than applied for from the Commission. What that status actually requires, and what it costs a legal entity to obtain, is set out at what a business has to be before it can register anything.

The practical order is therefore the reverse of the one people assume. The buyer becomes a verified economic operator, and only then can the passports move. Doing it the other way round is not slow, it is impossible.

Changing your provider is not a transfer

Two things get confused here and it is worth keeping them apart, because one is a legal event and the other is a supplier change.

A transfer under Article 6a moves the obligations from one operator to another. The responsible party changes.

Changing the party that hosts your passport data changes nothing about who is responsible. The registry stores a reference to the passport service provider as part of the registration data, and confirms that the backup link is valid at the point of registration. But Article 19(1) and 19(2) put accuracy and completeness on the verified economic operator at registration and continuously thereafter, and Article 19(5) makes that operator the controller of the data it submits. Article 19(4) allows a third party to act on your behalf and says in the same sentence that you remain fully responsible.

So a hosting migration is a data project with a registry record to update. A transfer is a change of who answers for the record. A vendor describing the first as the second is describing something that did not happen. What actually breaks when hosting fails rather than changes hands, and what to settle before signing, is worked through at when the link dies.

The three hand-overs, side by side

What the instrument does not say

Article 6a is one sentence, and a one sentence provision leaves a lot open. Naming the gaps is more useful than filling them with confident guesses, and each of these is a question we could not answer from the enacting terms.

• Who initiates it, and what the transferee has to do to accept. The instrument says passports may be transferred. It sets out no procedure and names no consent step.
• What happens if the transferor is dissolved before transferring. Article 6a assumes a transferor exists to act. Recital 10 contemplates cessation of activities without saying who acts once the entity is gone.
• Whether an insolvency practitioner can act. Nothing found by us addresses it. The office holder is not the economic operator and would presumably act for it, but the instrument does not say so.
• What happens to proofs of registration already issued. A proof names the operator responsible at the time it was generated. Whether an old proof remains meaningful after a transfer is not addressed.
• What happens to the ten year retention clock. Article 10(3) runs the deletion period from registration. Whether a transfer restarts anything is not stated, and on the face of the text it does not.
• What happens to the log history. Article 14 keeps data modification logs for the duration of the registration. Whether a transferee inherits visibility of the transferor's edit history is not addressed. What the registry records and who can reach it is set out at what the registry records about you.

These are gaps in the published instrument as we read it, not oversights we have discovered. How this estate types a question that cannot yet be resolved is set out at how we know.

What to put in the agreement

The useful output of this page is a short list of things that belong in a transaction rather than in a system.

1. Establish whether it is a share sale or an asset sale first. Everything else follows from that answer and it is usually already settled by the time anybody asks about passports.
2. Make the buyer's verified status a condition, not a completion task. It takes procurement time and the transfer cannot happen without it.
3. Name a transfer date. Article 6a hangs the hand-over on the date indicated for it. Leaving it unstated leaves the obligations ambiguous at exactly the moment somebody would want them clear.
4. List what is moving. A transfer is per passport. A range with thousands of registrations needs a schedule, not a sentence.
5. Agree who answers a correction after completion. The duty in Article 19(2) to keep the information accurate, complete and up to date is continuing, and it lands on whoever holds the registration at the moment the error surfaces. Where that duty sits in practice is worked through at who has to own this.
6. Ask where the data is hosted and what happens to that arrangement. The registrations can move cleanly to a buyer who then discovers the passport content sits behind a contract that did not.

None of this is exotic. It is the same diligence a business already does for domain names, trade marks and product certifications, applied to an asset most legal teams do not yet know exists.

Sources

A note on the article number. Article 6a is unusual numbering for a freshly adopted implementing regulation, so it was checked. The Official Journal PDF, published 17 July 2026, carries twenty four articles numbered 1 to 6, then 6a, then 7 to 24, and Article 6a is headed Transfer of registered digital product passports.

• Commission Implementing Regulation (EU) 2026/1778 establishing the Digital Product Passport registry
  Relevant provisions reviewed

  Article 6a quoted in full from the enacting terms, plus recital 10, Articles 4(4), 5(4), 8(9)(c), 10(3), 14(3) and 19. The gaps listed above were established by reading the enacting terms rather than inferred from a summary.

  View official source

• Ecodesign for Sustainable Products Regulation (EU) 2024/1781, consolidated text
  Relevant provisions reviewed

  Two propositions: that a passport must remain available for at least the expected lifetime of the product, and that availability must survive insolvency, liquidation or cessation of activity in the Union.

  View official source