Which Digital Product Passport standards carry a presumption of conformity?

What a presumption of conformity actually does

The decision that published the references opens by restating the mechanism. A passport in conformity with a harmonised standard, or with parts of one, whose reference has been published in the Official Journal is presumed to be in conformity with the framework requirements those standards cover. Presumed is the load-bearing word. It is a route to demonstrating something rather than a finding that it has been demonstrated, and an authority can still look behind it.

The presumption is then bounded twice. It is bounded by subject, because it runs to the framework's two passport articles, being the article on requirements and the article on technical design and operation, and to nothing else in the framework. It is bounded again by coverage, because it runs only so far as those requirements are covered by the standards or by the parts of them that were cited.

There is a third limit that has nothing to do with the standards. A presumption is only worth having where a duty exists, and the passport duty binds through a product-specific act. Which acts exist for which goods, and what state each one is in, is kept on the record of what has actually happened, which is the one destination here that carries dates.

In plain English

Following a cited standard buys a presumption that part of the framework has been met. It does not buy a certificate, it does not reach the parts of the framework the standard does not cover, and it does nothing at all for goods that no passport obligation reaches yet.

What this keeps: The difference between a route to demonstrating conformity and a finding of it; The two limits on what the presumption covers

Based on Commission Implementing Decision (EU) 2026/1736 of 14 July 2026 on harmonised standards for digital product passports drafted in support of Regulation (EU) 2024/1781Ecodesign for Sustainable Products Regulation (EU) 2024/1781, consolidated textChecked/revalidated 20 September 2026

Current citation is for ESPR, not every passport regime

Commission Implementing Decision (EU) 2026/1736 cites six DPP standards in support of Regulation (EU) 2024/1781, the ESPR framework. The Digital Circularity Vehicle Passport is required to use open standards and interoperate with relevant passports, so the same standards family may be technically useful. But current ESPR citation does not by itself give DCVP a presumption of conformity, and it should not automatically be extended to the Construction Products Regulation either.

As at 7 October 2026, six DPP standards are OJ-cited under Decision (EU) 2026/1736. The remaining two should not be described as cited merely because the Commission roadmap showed a September 2026 milestone. Citation changes when an official decision is adopted and published, not when the planning month arrives.

For the vehicle-specific legal boundary, see EU Digital Circularity Vehicle Passport (DCVP): What Changes for Cars and Vans from 2032?

Battery passports sit under their own regulation. See which batteries need a passport from February 2027 and EN 18060:2025 for batteries.

The six references we can now verify directly

The Annex to Decision (EU) 2026/1736 directly lists these six references:

• EN 18216
• EN 18219
• EN 18220
• EN 18221
• EN 18222
• EN 18223

The legal effect is bounded. OJEU citation does not certify a product, prove that a whole passport is correct or establish overall ESPR compliance. It gives a presumption only for the Article 10 and 11 requirements covered by the cited standard or part.

So “conforms to a DPP standard” is too broad a claim on its own. The question is always: which standard, which cited reference and which requirement?

The two remaining standards: what they cover and what is still missing

The two standards outside Decision 2026/1736 cover subjects that are easy to assume have already been settled horizontally.

EN 18239 covers access-rights management, information-system security, data protection and business confidentiality, plus transfer of responsibility between economic operators. Its official project/adoption record does not show an OJEU citation at this page’s cut-off.

EN 18246 covers data authentication, reliability and integrity, including secure signed-data constructs for multi-actor applications. Its published scope also states exclusions: it does not define the overall DPP system architecture, DPP use cases, secure elements related to data carriers or cryptographic security features for unique product identifiers.

Those scope statements are not a substitute for the full standards. They are enough to say what the standards are about and where their boundaries sit. They are not enough to claim detailed conformance requirements we have not read.

EN 18239 and EN 18246 are published European Standards. BSI issued them as BS EN 18239:2026 and BS EN 18246:2026 on 30 September 2026. The legal-citation question is separate. The Commission roadmap pointed to a September 2026 decision, and the evidence checked to 7 October 2026 did not locate an Official Journal decision adding their references. Until that citation event is verified, keep them outside the current ESPR presumption.

For the practical meaning of access rights, use who sees what in a Digital Product Passport. For the separate trust question, use what signing the record can and cannot prove.

Do not confuse three different statuses

A standards document can move through technical publication and adoption states without acquiring the same legal effect in every jurisdiction.

The emerging ISO/IEC JTC 5 and ISO 25534-1 work has its own page for the same reason. International standardisation can be technically influential without automatically changing the EU harmonised-standards route.

The eight standards, and where each one stands

The subject column shortens each standard's own title as its publisher stated it. Every scope statement in this table is second hand, because we hold no copy of any of the eight and none of these cells was taken from a standard. The read column says what this estate reached in each row. What the scope statements say, how far each one was read and the one place two accounts of the same standard disagree are set out under What each standard covers, below.

Digital product passport standards from the joint technical committee, by whether the reference is published in the Official Journal.

Two of the eight rows are about the identifier and the carrier, which are the attributes set out on identifiers. Nothing on that page is taken from either standard, for the same reason nothing here is.

What each standard covers

How far we read. The scope of EN 18220, the data carrier standard, was read at the national standards body that publishes it as BS EN 18220:2026. Scope summaries for EN 18216, EN 18219, EN 18221, EN 18222 and EN 18223 came from two independent secondary readings and support the subject of each standard, nothing about its requirements. None of the standard texts has been bought or read. Anybody telling you what one of these standards requires, rather than what it is about, should be asked whether they bought it.

EN 18220, data carriers. Its scope specifies symbology characteristics, format, error correction and encoding methods. It also covers durability and the quality of printing and production. It addresses machine readability and quality checking, and also carrier placement and graphical indicators that let a person recognise what a mark is for. It excludes architecture and use cases. It also excludes secure elements and any other cryptographic security features. So it governs whether a mark can be read reliably and survives. It says nothing about whether the mark can be trusted, which is a separate subject handled by a separate standard that is not in the Official Journal. The choices it does not make for you, including who owns the address the code resolves to, are on choosing a carrier that still works in five years.

EN 18221, storage, archiving and persistence: our sources disagree. One secondary account says it requires a passport to remain resolvable for a period of years after the product is placed on the market, independent of what happens to the issuer. The other says it specifies no retention period or resolvability timeframe at all. We have not read the standard, so we publish neither version. If the first is right it would put a duration on something the framework leaves to a contract, and what the framework does and does not require when the party answering stops is on when the link dies. If the second is right, the persistence question is still open and the answer still lives in whatever you sign. Until somebody reads it, treat any stated persistence period in this category as unverified.

EN 18219, unique identifiers. It describes three identifiers, not one: one for the product, one for the economic operator and one for the facility. Two of those are probably not in your catalogue, and the operator and facility identifiers have a page of their own. It also confirms that product identification is available at model, batch or item level. Which of those a textile act will require is not settled.

Scope is not product law. The standards answer how parts of a DPP system can conform. They do not decide which product groups need a DPP, from when, with which product data or at what granularity under product-specific law. That matters most for EN 18219 and EN 18220, because identifier and carrier choices are visible implementation decisions: a vendor can implement one of them correctly and still be unable to prove that a product is legally in scope or that its product-specific passport is complete. For product-law scope, see Digital Product Passport Requirements by Product Category.

Where the identifier and carrier standards lead in practice

For product, operator and facility identity, see Product, Operator and Facility Identifiers for a DPP. For the cross-layer 2D implementation choice, use the 2D Product Identity Map.

For physical carrier durability and placement, see QR, Data Matrix or NFC: Choosing a Lasting Carrier.

The two that were left out, and why the pairing matters

The two standards outside the published references are the one on access rights management and information system security and the one on data authentication, reliability and integrity.

Consider what a passport has to be before it is worth anything. It has to be access tiered, because a consumer, a recycler and a market surveillance authority are entitled to different parts of it. It has to authenticate, because a value nobody can test is a claim rather than a record. And it has to persist, because a passport that stops answering has stopped being a passport. Two of those three properties are the subject matter of the two standards that carry no presumption of conformity, and what the framework actually says about who sees what is a separate question from which standard answers it. The third, persistence, sits inside the published six and is behind a purchase we have not made. What a signature over passport data would settle, and the gap it leaves open whatever the drafting says, is on signing the record.

That is an observation about the titles of two standards and about which of them a decision did and did not list. It is not an observation about their contents, which we have not read. Nor is it a claim that a passport built without those two standards is defective. It is a claim about what a presumption of conformity currently covers, which is the mechanism this page exists to describe.

The position is still moving. EN 18239 and EN 18246 are now published, and the September 2026 month the Commission roadmap gave for their citation decision has passed without one. A roadmap month is not an Official Journal citation. The next legal event is the publication of a decision that actually lists their references.

Whether either standard is cited by some other act, we have not established. We looked at the decision that published this list and at the committee's own account of its work, and found no citation of either. That is not found by us rather than a statement that none exists, and the difference between those two sentences is set out in how we know.

A reference can also go the other way

A standard can also be withdrawn, and nothing tells the people who cited it. The international standard on self-declared environmental claims, ISO 14021, had its edition withdrawn on 24 June 2026 and replaced by a new one. The withdrawal is recorded on the catalogue entry and nowhere the citing party would look. A claims policy, supplier contract or technical pack that cites the old edition now cites a document that does not exist. The clause still reads the same and the obligation it creates between you and a supplier still binds; what has gone is the document at the other end of the reference. A supplier answering a questionnaire that names the old edition will answer against whatever they think it means. We haven't read the new edition, so this page says nothing about what changed, what it requires or whether a claim built on the old one still holds. The search term for your own documents is the standard number with an edition year after it. What a silent withdrawal does to a published field is on owning a published field.

1. 24 June 2026In force

The edition of the international standard on self-declared environmental claims is withdrawn and replaced by a new one

Recorded on the catalogue entry. Nothing announced it to the parties citing it, and the new edition is behind a purchase we have not made.

SourceISO 14021, self-declared environmental claims, edition withdrawn 24 June 2026Checked/revalidated 20 September 2026

1. 14 July 2026In force

Six of the eight passport standard references are published by a Commission implementing decision

Directly verified in Commission Implementing Decision (EU) 2026/1736. The Annex lists six references.

SourceCommission Implementing Decision (EU) 2026/1736 of 14 July 2026 on harmonised standards for digital product passports drafted in support of Regulation (EU) 2024/1781Checked/revalidated 20 September 2026

1. August 2026In force

The conformant resolver standard is ratified again at its publisher's reference site

The same publisher's marketing site was two ratifications behind on the same day the reference site was current.

SourceGS1 conformant resolver standard, at the reference siteChecked/revalidated 20 September 2026

1. September 2026Indicative

A Commission page indicates that the remaining two standard references were expected

An indication on a Commission page is not a citation in the Official Journal, and the day it becomes one the table on this page is wrong.

SourceDigital Product Passport (European Commission, DG GROW)Checked/revalidated 7 October 2026

A resolver claim is not a passport claim

A second kind of standards claim circulates in this market and it is easy to mistake for the first. It concerns the grammar of the web address that a scanned code resolves to, and the behaviour of the service that answers that address. Both of those are real specifications and neither is a product passport standard. What is being claimed is resolver conformance, which is real, narrower and a good thing to claim. It answers a different question.

The resolver specification is maintained by an industry organisation rather than by a European standards body. Its reference is not among the six published ones, so it carries no presumption under the framework, and a business told that a product is built to it has been told something true about how a code behaves and nothing about conformity with the framework's passport articles.

The version is the cheapest test there is

That standard was ratified again in August 2026 at its publisher's reference site, which is the address in the source list at the foot of this page. Read it there and nowhere else. On the same day the reference site was current, the same publisher's marketing site was two ratifications behind. So a deck citing an older release is not evidence of an old build. It is evidence of which page the deck was written from, and it takes a minute to check.

What changed between the recent releases is something we cannot tell you, because the served pages truncate before the change logs. Anyone describing a new release as architecturally significant should be asked to produce that comparison rather than asserted at. What a resolver does when a code is scanned, and the things the resolver standard does not contain, are set out in what happens when you scan.

A vocabulary release from the same publisher added passport examples aligned to an international code list and a new credential class. A vocabulary term existing means a way of saying something now exists. It does not mean anything reads it, writes it or acts on it, and we hold no evidence of consumption in either direction. Availability is the weakest kind of evidence there is and it is often quoted as the strongest.

An international standard on encoding and resolving identifiers over HTTP, whose existence and published scope we have confirmed but which we have not read, is a resolver and identifier-encoding standard too and, whatever a slide calls it, not a product passport standard (a correction the estate owed its readers).

We assert no conformity of our own. Nothing on this site claims that our passport service conforms to any standard in the table above, and this page is not the place where that claim quietly gets made.

The architectures a vendor may be building on

Underneath a standards claim there is an architecture, and it is fair to ask which one. Four families turn up in published architecture material. They are not exclusive, and a working system usually combines two of them.

• Resolution first. The identifier is the address. A code carries an identifier, a resolver turns a scan of it into a request, and what comes back is whatever the holder of that identifier chose to serve. The specifications here are the resolver and identifier-encoding ones described above.
• A hosted record. The passport is a record in a provider's system served from the provider's domain, and the printed code points at that domain. The question this family raises is what the printed code points at once the provider is no longer there.
• Issued credentials. Parts of the passport are issued as signed statements that a recipient can check without asking the issuer's server whether they are genuine. The new credential class in the vocabulary release described above belongs to this family.
• A shared ledger. A record, or a fingerprint of one, is written somewhere several parties can read, so that a later reader can test whether what they are shown matches what was published.

We do not rank these and we do not say how common any of them is. A count of how often each appeared was attempted in earlier work here and did not survive a recount, so no count appears on this page. The architecture material behind the four families is largely unread by us. What is above is a description of four patterns and not an audit of anybody's implementation.

No vendor is named here and none is scored. The families matter because they answer different questions: where the data physically lives, who can verify it without the vendor's cooperation, and what remains readable when the party holding it stops.

What to ask when a standard is cited at you

Six questions in this order. The first two settle most conversations.

1. Which standard, by number and by release. A series name is not a standard. Eight documents share this one, and a release number can be checked against the publisher's reference site in a minute.
2. Is its reference published in the Official Journal. Two of the eight are not, and a business relying on one of those has a supplier's design choice rather than a presumption.
3. Which parts, covering which requirements. The presumption runs only so far as the cited standard covers the framework's two passport articles, so an unbounded claim of conformity to a standard is broader than the standard can support.
4. Who is claiming conformity, and who assessed it. A self declaration is a legitimate thing to make and a different thing from an assessment by somebody else.
5. What obligation it discharges for your goods. Where no product-specific act covers what you sell, the honest answer is none of them yet.
6. Have you read the standard, or are you describing only its public scope? A public scope can tell you what a standard addresses. It cannot tell you every normative requirement inside it.

On the fourth question, we have found no published conformity statement against any of these standards from any vendor whose listing we surveyed, and what we surveyed was the passport applications published on two ecommerce platforms. That is a narrow place to look. It does not reach enterprise vendors and it is not evidence that no such statement exists anywhere.

What this page does not rest on

The current count of six OJEU-cited references no longer rests on a secondary reproduction. Commission Implementing Decision (EU) 2026/1736 is directly accessible and its Annex lists the six references named above.

The evidence boundary on standard content remains narrower. This page does not claim to have read the full paid text of the eight horizontal standards. Scope-level statements for EN 18239 and EN 18246 come from official standards-body project records. Where the full normative text has not been read, the page should describe subject and scope rather than invent requirements.

Legal citation status can be verified from the Official Journal while detailed technical requirements may still sit behind the standard itself.

Sources

• Commission Implementing Decision (EU) 2026/1736 of 14 July 2026 on harmonised standards for digital product passports drafted in support of Regulation (EU) 2024/1781 Implementing Decision. Recitals 1 and 2, Articles 1 and 2 and Annex. CELEX 32026D1736. In force. Primary decision directly verified to 20 September 2026. The implementing decision directly establishes the six cited references. The completed 20 September 2026 audit verified the primary decision and did not locate a later OJ citation decision adding EN 18239 or EN 18246, and neither did a recheck on 7 October 2026.
  Delegated or implementing act
• CEN and CENELEC, standards for digital product passports, EN in the spotlight, 15 July 2026 Standards bodyInstitutional guidanceReviewed in full The standards bodies' own account of the work of their joint technical committee, and the source for the series running to eight standards rather than six and for the subject of each one. It is a publisher describing its own output, so it evidences what was produced and never what the law asks for.
  Standards body
• EN 18219:2026, Digital product passport. Unique identifiers Standards bodyEuropean StandardBehind a purchase, not bought, not read Registered so that the reference and its citation state can be stated. The text is sold by national standards bodies and we hold no copy, so nothing on this page describes what it says.
  Standards body
• EN 18220:2026, Digital product passport. Data carriers Standards bodyEuropean StandardBehind a purchase, not bought, not read As above. The reference is evidenced by the implementing decision. The content is not evidenced by anything we have read.
  Standards body
• BS EN 18220:2026, Digital product passport. Data carriers, published 31 May 2026 European standard adopted as a British Standard Scope read at the national standards body that publishes it. Used for the subject list and for the stated exclusions. The standard text was not bought and not read.
• EN 18216:2026, EN 18219:2026, EN 18221:2026, EN 18222:2026 and EN 18223:2026, scope summaries European standards Scope summaries reached through two independent secondary readings rather than at the standards themselves. Used only for the subject of each standard. Where the two readings disagree, on the persistence standard, neither version is published and the disagreement is stated in the body.
• EN 18221, data storage, archiving and persistence for the Digital Product Passport European StandardBehind a purchase, not bought, not read The standard on data storage, archiving and persistence. Its reference is among the published six, so it carries a presumption of conformity, and it is the one standard in the series this estate has recorded as worth buying. It has not been bought and it has not been read, which is stated on the page rather than left to be inferred from this row.
• EN 18xxx Digital Product Passport standards and their Official Journal citation state Under watchOfficial source confirmed, detailed review pending The citation state of the series as a whole, which is the row this page is re-checked against. A further reference appearing in the Official Journal changes the table above, so the check runs on a short cycle rather than a long one.
• Digital Product Passport (European Commission, DG GROW) European CommissionInstitutional guidanceReviewed in full The Commission's own programme page records the implementation roadmap. It still points to September 2026 for the remaining citation decision. Roadmap timing is guidance, not the legal citation event.
  European Commission
• Ecodesign for Sustainable Products Regulation (EU) 2024/1781, consolidated text EU lawArts. 4, 9 to 11CELEX 02024R1781-20240628In forceRelevant provisions reviewed The framework the presumption points into. Its two passport articles are the outer limit of what any of these standards can do for a business, and they bind only through a product-specific act. Annex III, which the framework cross-refers to for identifier and carrier standards, was not readable and nothing here rests on it.
  EU law
• ISO 14021, self-declared environmental claims, edition withdrawn 24 June 2026 Withdrawn editionBehind a purchase, not bought, not read The international standard on self-declared environmental claims. What is evidenced here is the catalogue entry, which records the edition as withdrawn on 24 June 2026 and replaced. The text of neither edition has been read, because both are behind a purchase we have not made, so this page says what the withdrawal does to a document that cites the old edition and says nothing about what the new one contains.
• GS1 conformant resolver standard, at the reference site Standards bodyIndustry standardRelevant provisions reviewed The conformant resolver standard, read at the publisher's reference site and never at its marketing site, which was two ratifications behind on the same day the reference site was current. Read for the required behaviours and read as an absence for what it does not contain. What changed between the recent releases is not established, because the served pages truncate before the change logs. The same reference site carries the vocabulary release noted on this page; the vocabulary itself is not read.
  Standards body
• ISO/IEC 18975, encoding and resolving identifiers over HTTP