# The EU DPP Registry: what it stores and where passport data lives

Source: https://activatedigital.ai/knowledge/regulation/where-passport-data-lives
Last verified: 7 October 2026
Summary: The EU DPP Registry is live, but it does not store the complete passport and not every registration workflow is complete. Current Registry, test, enrolment and registration status.

## In 60 seconds

The [European Commission announced the launch of the Digital Product Passport Registry on 20 July 2026](https://single-market-economy.ec.europa.eu/news/digital-product-passport-registry-now-live-2026-07-20_en), together with a testing environment. The rules it runs on are in [Commission Implementing Regulation (EU) 2026/1778](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ%3AL_202601778), adopted on 16 July 2026 and in force from 6 August 2026.

- The Registry launched on **20 July 2026**, with a testing environment.
- It runs on Commission Implementing Regulation (EU) 2026/1778, adopted 16 July 2026 and in force from **6 August 2026**.
- The production Registry and organisation enrolment are available. Enrolment needs EU Login plus separate organisation verification.
- Batteries is the first product group for which registration will be available, and successful Battery registration is not currently available because the Battery semantic catalogue has not been defined.
- The Registry holds a record about a passport. The passport data stays where the operator hosts it.
What went live is an index. The Commission's own description is that the registry "acts as the indexing service for all Digital Product Passports of products placed on the EU market", holding [unique identifiers, registration data and high level metadata rather than the full detailed product information](https://single-market-economy.ec.europa.eu/single-market/digital-product-passport/dpp-registry_en). The launch announcement puts the same point the other way round: product data is stored in a decentralised manner, and what an operator registers is the identifier and the metadata that go with it.

So the answer to the question most people are asking is no. The Commission does not now hold your product data, your supplier documents or your test reports. It holds a record that a passport exists, who registered it, what it is about and where a backup copy can be found, which sits with [a service provider the framework defines and then restricts](https://activatedigital.ai/knowledge/passport/service-providers).

That is the smaller half of what changed. The larger half is that a set of arguments about how this system works are no longer open. The instrument names the parties, sets the verification, defines the vocabulary layer and states in its own recitals what a passing automated check does not establish.

### The two dates, and why published explanations disagree

Several published explanations of the registry print 19 July 2026 as the day it opened. The Commission's own announcement says 20 July 2026.

Both dates are real and they belong to different things. The framework behind the registry, the [Ecodesign for Sustainable Products Regulation](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02024R1781-20240628), set the Commission a date by which it had to have the registry set up, and that date is 19 July 2026. It is a duty on the Commission. It is not a date on which anything happened to a business, and it is not the launch. The launch is the Commission's announcement the following day.

That distinction is the shape of almost every date error in this subject. A date in an instrument is usually a duty on somebody, and the somebody is frequently not you. Which dates in this system attach to a business, and which do not, is kept row by row on the [status record](https://activatedigital.ai/knowledge/status/textile-passport) rather than asserted here.

## EU DPP Registry Operational State Snapshot

**Checked: 7 October 2026. Commission User Guide: v1.03, last published 16 September 2026.**

The Registry is operational, but it's only one layer of the DPP system. The complete DPP stays decentralised with the economic operator or a DPP service provider. "Registry live" doesn't mean "every product can now complete registration". Keep four questions apart: the infrastructure is available; an organisation can enrol and be verified; the current registration workflow can be rehearsed, including in the separate test environment; but a Battery DPP cannot currently complete successful registration under Commission User Guide v1.03.

| Operational question | Current state | What that means |
|---|---|---|
| Production Registry | AVAILABLE | Commission production service is accessible and organisations can enrol. |
| Organisation enrolment | AVAILABLE | EU Login plus separate organisation verification is required. |
| Test environment | AVAILABLE | Separate from production. User Guide v1.03 says a different EU Login is needed and test changes do not migrate. |
| Product group currently exposed for registration | BATTERIES | The guide describes Batteries as the first product group for which registration will be available. |
| Current Battery granularity in UI guide | ITEM | Item is currently available and pre-selected for Batteries. This is not a universal cross-category rule. |
| Successful Battery DPP registration | NOT CURRENTLY AVAILABLE | User Guide v1.03 says the Battery semantic catalogue/content has not yet been defined. |
| Semantic repository in law | ESTABLISHED | Regulation (EU) 2026/1778 requires an authoritative machine-readable repository of models, definitions and vocabularies. Product-group content is progressive. |
| Online form | DOCUMENTED | Current guide documents single-DPP registration by form. |
| File upload | DOCUMENTED | Current guide documents XML/JSON submission for one or multiple DPPs, up to 100 requests per file, with a 1 GB file limit. |
| Registry API | ESTABLISHED IN LAW | Regulation (EU) 2026/1778 provides an API. Do not infer production endpoints, authentication or payloads beyond official technical documentation. |
| Web Portal | SEPARATE DPP LAYER | ESPR establishes a Web Portal for search and comparison. It is not the place where operators register DPPs. |

**Maintenance rule:** this module is living operational content. Recheck it whenever the Commission changes the User Guide, semantic catalogue, exposed product groups, registration success state, submission constraints or Web Portal/API documentation.

The operational journeys are separate: [enrol your organisation in the DPP Registry](https://activatedigital.ai/knowledge/regulation/enrolling-in-the-registry), [Registry test environment](https://activatedigital.ai/knowledge/regulation/registry-test-environment), [register and manage a DPP](https://activatedigital.ai/knowledge/regulation/how-to-register-a-dpp-eu-registry).

## Registry: business consequence of the architecture

For **what your business still has to build, host and maintain now the Registry exists**, rather than the Registry's legal architecture, see [The EU DPP Registry is live. What does your business still need to do?](https://activatedigital.ai/knowledge/guides/eu-dpp-registry-what-businesses-still-need)

## What is registered, provision by provision

Registration happens through a secure user interface or through an API, and the instrument treats the two as equivalent routes rather than as a basic option and an advanced one. Article 8(6) offers both. Article 8(10) says the registration identifier comes back through whichever of the two you used.

What the registry stores about a registration, under Article 8(8) and 8(9), is a short list:

- a unique persistent registration identifier, generated by the registry and issued back to the registrant
- the unique identifiers, where relevant
- the commodity code for the product, where relevant
- a reference to the digital product passport service provider, where relevant
- registrant information, including the date and time of registration and the integrity of the passport, held as evidence of the registration event
Registration happens at model, batch or item level according to whichever act governs the product. Where a product falls under two sets of rules asking for different levels, Article 8(3) resolves it in one direction: the passport is registered at the most granular level required. Article 8(4) and 8(5) then require an item level record to link its batch and model identifiers where those designs exist, and a batch record to link its model. The registry assumes a ladder rather than a choice, which is a different thing from settling how many passports a range needs. For batteries, see [which batteries need a passport from February 2027](https://activatedigital.ai/knowledge/digital-product-passport/batteries).

Two retention periods sit underneath all of this. Article 9(4) makes [a proof of registration](https://activatedigital.ai/knowledge/evidence/proof-of-registration) available for 90 calendar days from the date it is generated, and it can be generated again. Article 10(3) deletes registration data automatically 10 years after registration where Union law sets no specific availability period, and aligns the retention with that period where it does. Neither is a deadline for anybody. Both are properties of the instrument, and both are worth knowing before a supplier describes either as permanent.

## What stays with you, and where the copies are

The instrument and the framework together put your product information in three places, and only one of them belongs to the Commission.

The three places passport information sits, and who runs each, as read from the implementing regulation and the framework in August 2026.

| Where it sits | What is there | Who runs it |
|---|---|---|
| The registry | Identifiers, commodity code, registrant identity, a service provider reference, a hash of the version, a registration identifier | The Commission, as owner and manager under Article 21(2) |
| Your own systems, or a provider you appoint | The passport itself. Composition, documents, claims, evidence, everything a reader would actually want | You |
| A digital product passport service provider | A backup copy, which the framework requires the operator placing the product on the market to make available | A provider you choose, from a list the registry maintains under Article 3(f) |

Two consequences follow that are easy to miss.

The first is that the pointer is load bearing. The registry stores a reference to the service provider, and Article 8(7)(e) has the Commission confirm that the backup link is valid at the point of registration. That is where the instrument places the check, and we did not find a provision requiring it to be repeated later. What keeps the thing at the other end reachable years afterwards is a procurement question rather than a registry function, and changing that provider is a supplier decision rather than a transfer of who answers for the record.

The second is that responsibility doesn't move with the hosting. Article 19(1) and 19(2) put accuracy and completeness on the verified [economic operator](https://activatedigital.ai/knowledge/regulation/who-carries-the-obligation) at registration and require the information to be kept accurate, complete and up to date at all times. Article 19(5) makes that operator the controller of the data it submits. Article 19(4) lets a third party perform registration actions on your behalf and says in the same sentence that you remain fully responsible.

Article 19(4) does something slightly surprising. It sends that third party down the Article 5 verification route, the process written for value chain actors, not Article 4, the process for economic operators. A vendor registering on your behalf is verified as a participant in your value chain, not as a stand-in for you. Whether you can get an account at all, and what a legal entity has to buy to do so, is the [verified economic operator question](https://activatedigital.ai/knowledge/regulation/enrolling-in-the-registry), and it comes before everything on this page.

## The semantic repository, and what Article 12 actually requires of it

Article 12 sets up something that gets a sentence in most coverage and deserves more. The Commission establishes and maintains a semantic repository as the authoritative machine readable source for the data models, semantic definitions and vocabularies that apply to passports across every product group. Article 12(7) makes access to it, and to its APIs, free of charge. Article 12(5) requires a search service. Article 12(6) requires publicly documented APIs in common data formats.

Article 12(2) sets out what it has to contain, and one limb is more interesting than the rest. Alongside the data models, the metadata and the multilingual labels, the repository must carry:

the semantic meaning of data attributes required within a digital product passport and technical specifications for creating, where relevant, typed and resolvable links between different digital product passports, and links between digital product passport attributes and underlying evidence communicated through the product value chain

That's a specification for linking a value to the thing that supports it, and one passport to another, at the level of shared vocabulary rather than one vendor's schema. Anybody who has tried to reconcile a certificate against a field will recognise it. It's the difference between a passport that asserts a number and one where the number can be followed back to something. Whether the delegated acts eventually use that limb is not settled, and the estate's method for a question in that state is set out in [how we know](https://activatedigital.ai/knowledge/evidence).

For a business the practical reading of Article 12 is narrow and useful. The vocabulary your fields will have to speak is published, free, searchable and reachable by machine. It isn't a place your data goes. It's where the meanings live. Whether your existing product data can speak it, and what happens where a product group's catalogue hasn't been defined yet, is worked through at [what the EU's published definitions ask of your product data](https://activatedigital.ai/knowledge/guides/mapping-to-the-eu-definitions).

## The people the instrument names

The definition that repays the most attention is in Article 2, and it is not about products at all:

'value chain actor' means a natural or legal person, other than the economic operator, that performs activities in the value chain of a product requiring a digital product passport and its registration in the registry, such as a repairer, refurbisher, remanufacturer or recycler

Article 5 gives those actors their own verification route, on the same terms as economic operators: an electronic identification means or a [qualified electronic signature](https://activatedigital.ai/knowledge/passport/signing-the-record) for a sole trader, a qualified electronic seal or a qualified attestation of attributes for a legal entity, with verified status running until the underlying means expires and in no case beyond three years. Article 5(3) then limits access to verified actors and says they may perform actions in the registry "where specified in the relevant Union law". Article 20 gives them responsibilities of their own for what they submit.

Article 6a completes the picture by allowing a registered passport to be transferred to another verified economic operator or to a verified value chain actor taking over the obligations attached to it, from the date indicated for the transfer. Recital 10 explains what that is for: an actor that did not pass verification, and organisational changes such as a merger, a split, a sale of part of a business or a cessation of activities.

The system now has [a mechanism for a passport to change hands](https://activatedigital.ai/knowledge/regulation/passport-transfer) along with the duty attached to it, and it has an identity layer for the people who repair and recycle. Whether any of that produces an outcome is a separate question with a separate answer, and the continuation block below points at it.

## The system in eight objects

If two of these objects are described as interchangeable, the page is wrong.

| Object | What it is | What it is not |
|---|---|---|
| Complete DPP | Structured product data hosted by the economic operator or provider | Not the Registry registration record |
| DPP registration record | Minimal or defined data held in the Registry and linked to the DPP's UPI | Not the full DPP |
| DPP Registry | EU indexing, verification, registration and management infrastructure | Not the complete product-data repository |
| Web Portal | Separate framework layer for users to search and compare DPP information | Not the operator registration interface |
| DPP service provider | A provider that may host or act around DPP infrastructure where permitted | Does not remove the economic operator's responsibility |
| Data carrier | Physical or digital carrier giving access to the DPP, such as a QR code where the product law requires it | Not the DPP itself |
| Proof of registration | Commission-secured evidence that the registration obligation for identified DPPs was fulfilled | Not a certificate of product compliance |
| Semantic repository | Authoritative machine-readable models, definitions and vocabularies used for interoperability and validation | Not a copy of every product's DPP data |

For the definitions themselves see [the EU's published definitions](https://activatedigital.ai/knowledge/guides/mapping-to-the-eu-definitions), for what the Registry holds about you see [what the Registry records about you](https://activatedigital.ai/knowledge/evidence/what-the-registry-records), for the proof artefact see [proof of registration](https://activatedigital.ai/knowledge/evidence/proof-of-registration), and for who may hold the data see [DPP service providers](https://activatedigital.ai/knowledge/passport/service-providers).

## The EU Registry is not UNTP, a data space or a Digital Twin Registry

Several current architectures use the words **registry**, **resolver**, **credential** and **discovery**. They are not interchangeable with the EU DPP Registry.

The EU Registry has a statutory job under Commission Implementing Regulation (EU) 2026/1778. It handles DPP registration information, automated validation of defined registration elements, persistent registration identifiers and the semantic repository used by the EU DPP system. The complete passport remains decentralised with the economic operator or a service provider rather than being turned into one central Commission product database.

Four adjacent systems solve different problems:

| System | Main job | What it does not replace |
|---|---|---|
| EU DPP Registry | Statutory DPP registration, defined validation and EU semantic-repository functions | The complete DPP or a sector exchange ecosystem |
| UNTP resolver and credential architecture | Discover and verify machine-readable traceability credentials and related resources | EU DPP registration, EU operator verification or hosting obligations |
| Catena-X Digital Twin Registry | Register and discover digital twins and their aspects inside the Catena-X ecosystem | The EU statutory DPP Registry |
| Data space | Govern participation and controlled cross-company exchange through shared rules, contracts or policies and technical exchange mechanisms | The EU registration obligation |

The UNTP boundary is particularly useful because both architectures use machine-readable identity and verification language. UNTP separates discovering a linked resource from verifying the retrieved credential. The EU Registry uses its own statutory mechanisms, including EU identity-verification routes for economic operators. Choosing UNTP does not determine where the complete EU passport must be hosted and it does not remove the EU registration step where that step applies.

The same is true of Catena-X. A Catena-X Digital Twin Registry helps participants locate twins and aspects inside a sector ecosystem. It is not an alternative legal registry. The surrounding data-space architecture adds participant governance, discovery, contracts or policies and controlled exchange. ESPR does not require Catena-X, AAS, Gaia-X or EDC merely because a product needs a DPP.

The clean architecture is layered:

**governed product data -> DPP publication -> EU registration where required -> optional resolver, credential, digital-twin or data-space services where they solve an additional problem**

For the industrial exchange layer, see [what a data space is and how Catena-X fits DPP architecture](https://activatedigital.ai/knowledge/product-data/data-spaces-catena-x). The rule on this page stands: the EU Registry is an index and registration layer, not the place where every complete passport payload has to live.

## What a passing check means, and the regulation says it itself

Article 8(7) has the Commission read the submitted content and automatically confirm five things: semantic conformity against the applicable act, coherence of mandatory data against the passport values where relevant, conformity with the required [granularity](https://activatedigital.ai/knowledge/guides/granularity) level, validity of the [commodity code](https://activatedigital.ai/knowledge/regulation/when-the-commodity-code-changes) within the permitted range where relevant and validity of the backup link hosted by a service provider where relevant.

Recital 16 then says, in the Commission's own words, what those checks are not:

The verification of the substantive correctness of the data registered remains a task for the market surveillance authorities under the applicable Union rules. Accordingly, the automated verifications should not be deemed to constitute proof of compliance with the requirements of the Union rules applicable to the product, including with market surveillance rules.

The framework says the same thing from a different direction. Under the Ecodesign framework the communication of a registration identifier is not to be deemed proof of compliance.

So a registered passport means a submission was well formed, populated and correctly levelled, and that the commodity code and the backup link were in range. It means nothing about the fibre content being right, nothing about a claim being substantiated and nothing about the product complying with anything. That distinction becomes commercially sharp the moment a buyer asks for evidence rather than a record.

## The plain answers

The questions businesses are asking about the registry, with the provision that answers each one.

| The question | The answer, and where it comes from |
|---|---|
| Does the EU now hold my product data? | No. The registry holds identifiers, registration data and metadata. The passport stays with you or a provider you appoint. Commission registry page, and Article 8(9) |
| Do I register my company or every product? | Both, in that order. The entity is verified once under Article 4. Each passport is registered under Article 8 |
| Can I register through an API? | Yes. Article 8(6) treats the interface and the API as equivalent routes |
| Can a provider register for me? | Yes, under Article 19(4). That provider is verified through the Article 5 process and you remain fully responsible |
| Who is responsible for what is in there? | The verified economic operator, at registration and continuously. It is also the controller of the data it submits. Article 19 |
| What does the registry check? | Structure, granularity, coherence, commodity code range and backup link validity. Article 8(7) |
| Does passing that check mean I comply? | No, and recital 16 says so |
| What does the semantic repository cost? | Nothing. Article 12(7) |
| How long does a proof of registration last? | 90 calendar days from generation, and it can be regenerated. Article 9(4) |
| How long is registration data kept? | 10 years after registration where Union law sets no period. Article 10(3) |
| Can a passport change hands? | Yes, to another verified operator or a verified value chain actor taking over the obligations. Article 6a |

## What else the registry keeps

Alongside the record about your product, the registry runs a log system under Article 14 that records access, modifications, administrative actions and data exchanges on three separate retention clocks, and Article 18 stores personal data about the named users behind them. Article 14(4) makes those logs available to national and customs authorities in the case of suspected incidents and for audits and random checks. [What the registry records about you](https://activatedigital.ai/knowledge/evidence/what-the-registry-records) sets that out, because it is a second record with a different reader.

## What is still open

Three things are unresolved, as distinct from things that merely have not been read.

**Who sees what.** The instrument builds the access machinery. Member States appoint a designated national administrator as the single contact point for managing [access rights](https://activatedigital.ai/knowledge/passport/who-sees-what) under Article 7, and that administrator can delegate to national authorities. The registry supports [customs authorities verifying electronically that an imported product has a valid registered passport and a commodity code, and market surveillance authorities getting access to registered passports for specific purposes](https://single-market-economy.ec.europa.eu/single-market/digital-product-passport/dpp-registry_en). That customs function is written in the framework and only half switched on, which is set out at [what actually happens to a passport at the EU border](https://activatedigital.ai/knowledge/regulation/customs-and-the-border). What the instrument does not do is settle the tiering of access to passport content itself, which the framework leaves to further acts. When Member States have to have appointed their administrator is a date on a duty, so it sits on the status record rather than here.

**Correction.** Article 10(1) requires any change to registration data, including creation, modification and deletion, to be logged and reflected in the status of the registration. That establishes that changes happen and are traced. It does not lay down a procedure for correcting or withdrawing a registration, and we did not find one in the enacting terms. Nor did we find an enumerated vocabulary of registration statuses, although Article 1(2)(g) lists statuses as one of the matters the arrangements cover. Who owns the problem when a published value turns out to be wrong is answered separately, and the answer does not come from this instrument.

**Standards.** The Commission's announcement records that eight harmonised standards underpinning the interoperability of the system were developed with CEN and CENELEC and that six of the eight are available and published. Published is not the same as cited in the Official Journal, and only a cited reference carries a [presumption of conformity](https://activatedigital.ai/knowledge/status/standards).

## DCVP is not automatically inside the current DPP Registry scope

The current Registry implementing regulation has a specific legal gateway for passport regimes outside ESPR: the other Union legislation must require both a DPP **and** its registration in the ESPR Registry.

Regulation (EU) 2026/1738 creates the Digital Circularity Vehicle Passport, but it does not currently add that Registry-registration requirement. DCVP storage and processing are also expressly left to the vehicle-specific Article 13(6) implementing layer.

So the current answer is **not established**, rather than “yes” or “never”. A future vehicle implementing act could reuse or interconnect with Registry infrastructure, but the adopted DCVP framework does not yet require it.

See [EU Digital Circularity Vehicle Passport (DCVP): What Changes for Cars and Vans from 2032?](https://activatedigital.ai/knowledge/vehicle-passports/digital-circularity-vehicle-passport) for the vehicle-specific passport boundary.

## What to do with this

For most readers, very little immediately. The registry creates no obligation of its own. The obligations that will eventually route through it belong to product acts, and the first hard deadline named in the Commission's launch announcement belongs to certain large batteries rather than to anything else.

Four things are worth doing, and none of them is a purchase.

- Establish where your passport data would be hosted, and by whom, before anybody discusses registration. The registry stores a pointer to it. It does not store it.
- Read Article 19 before signing anything with a vendor who offers to handle registration. The sentence that matters is the one saying you remain fully responsible.
- Look at the semantic repository against your existing product data now, while nothing depends on it. It is free, it is documented and the question of whether your fields map cleanly onto published definitions is answerable today and cheaper to answer today.
- Keep the distinction between a registered passport and a compliant product in the vocabulary your own team uses. The regulator declined to blur it. There is no reason for anybody downstream of the regulator to do it for them.
Most of the passport stays with you, which makes the state of your own product record the part worth knowing first. You can [check what that record currently supports](https://activatedigital.ai/dpp-readiness-checker) against the values the architecture expects you to hold.

## Related

- [Who Checks DPP Information? Registry, Conformity and Market Surveillance](https://activatedigital.ai/knowledge/evidence/who-checks-dpp-information) — What each DPP check proves
- [Digital Product Passports and Personal Data: Where GDPR May Apply](https://activatedigital.ai/knowledge/passport/personal-data-and-gdpr) — The privacy boundary between Registry data and passport content
- [Digital Product Passport vs Digital Twin vs Asset Administration Shell (AAS)](https://activatedigital.ai/knowledge/product-data/dpp-vs-digital-twin-aas) — a passport, a digital twin and an Asset Administration Shell compared
- [EU DPP vs UNTP DPP: What Is the Difference and Can They Work Together?](https://activatedigital.ai/knowledge/regulation/eu-dpp-vs-untp) — how the EU passport and the UNTP passport differ, and where they can work together

## Keep exploring

The question this one usually raises next.

- [CompareRules & scopeWhat a business has to be before it can register anythingThe entity level gate that sits in front of every provision on this page, and the one thing in this system a business has to buy.→](https://activatedigital.ai/knowledge/regulation/enrolling-in-the-registry)
Also worth reading

- [Another anglePassport technologyWhat has to be true before a passport changes a decisionThe registry now names repairers, refurbishers, remanufacturers and recyclers. Whether naming them changes an outcome is a different question, with measured evidence behind it.→](https://activatedigital.ai/knowledge/passport/what-changes-a-decision)
- [What to do nextImplementationWhat the EU's published definitions ask of your product dataThe gate in front of registration. Your data has to mean what the Commission's definitions mean, and for at least one product group the catalogue is not defined yet.→](https://activatedigital.ai/knowledge/guides/mapping-to-the-eu-definitions)