Which passport standards carry a presumption of conformity

The short answer

When a vendor cites a standard at you, they are naming the document they say they built against. Two further things have to be true before that has any purchase on the law. The reference has to have been published in the Official Journal. And the thing being claimed has to sit inside what that standard actually covers.

For product passports, six of the eight standards from the joint technical committee have their references published by a Commission implementing decision of July 2026. The other two of the eight do not, so they carry no presumption of conformity at all, and the difference is invisible from a slide that says the word standard.

That count comes with a caveat we would rather state than bury. A direct route to the decision returned an access error, and its existence, its date and its content were confirmed through two independent secondary routes instead. Six of eight is what those routes agree on, and it is recorded here as a figure to be confirmed at the Official Journal rather than as a settled one.

What a presumption of conformity actually does

The decision that published the references opens by restating the mechanism. A passport in conformity with a harmonised standard, or with parts of one, whose reference has been published in the Official Journal is presumed to be in conformity with the framework requirements those standards cover. Presumed is the load-bearing word. It is a route to demonstrating something rather than a finding that it has been demonstrated, and an authority can still look behind it.

The presumption is then bounded twice. It is bounded by subject, because it runs to the framework's two passport articles, being the article on requirements and the article on technical design and operation, and to nothing else in the framework. It is bounded again by coverage, because it runs only so far as those requirements are covered by the standards or by the parts of them that were cited.

There is a third limit that has nothing to do with the standards. A presumption is only worth having where a duty exists, and the passport duty binds through a product-specific act. Which acts exist for which goods, and what state each one is in, is kept on the record of what has actually happened, which is the one destination here that carries dates.

The eight standards, and where each one stands

The subject column shortens each standard's own title as its publisher stated it. Every scope statement in this table is therefore second hand, because we hold no copy of any of the eight and none of these cells was taken from a standard. The read column says what this estate actually reached in each row.

Two of the eight rows are about the identifier and the carrier, which are the attributes set out on identifiers. Nothing on that page is taken from either standard, for the same reason nothing here is.

The two that were left out, and why the pairing matters

Read the last two rows together and the shape of the gap is hard to miss. The two standards outside the published references are the one on access rights management and information system security and the one on data authentication, reliability and integrity.

Consider what a passport has to be before it is worth anything. It has to be access tiered, because a consumer, a recycler and a market surveillance authority are entitled to different parts of it. It has to authenticate, because a value nobody can test is a claim rather than a record. And it has to persist, because a passport that stops answering has stopped being a passport. Two of those three properties are the subject matter of the two standards that carry no presumption of conformity. The third, persistence, sits inside the published six and is behind a purchase we have not made.

That is an observation about the titles of two standards and about which of them a decision did and did not list. It is not an observation about their contents, which we have not read. Nor is it a claim that a passport built without those two standards is defective. It is a claim about what a presumption of conformity currently covers, which is the mechanism this page exists to describe.

The position is also fresh enough to move. A Commission page indicated that the two remaining references were expected in September 2026. An indication on a Commission page is not a citation in the Official Journal, and on the day it becomes one this table is wrong. That is why this page is re-checked on a short cycle.

Whether either standard is cited by some other act, we have not established. We looked at the decision that published this list and at the committee's own account of its work, and found no citation of either. That is not found by us rather than a statement that none exists, and the difference between those two sentences is set out in how we know.

A reference can also go the other way

Everything above is about a standard arriving. A standard can also be withdrawn, and when that happens nothing tells the people who cited it. The international standard on self-declared environmental claims, ISO 14021, had its edition withdrawn on 24 June 2026 and replaced by a new one. The withdrawal is recorded on the catalogue entry and nowhere the citing party would look.

The consequence is worth being blunt about. If your claims policy, a supplier contract or a technical pack cites that standard by its old edition, it now cites a document that does not exist. The clause still reads the same. The obligation it creates between you and a supplier still binds. What has gone is the document at the other end of the reference, and with it the meaning the clause was relying on.

Nothing flagged this, and no mechanism anywhere would have. A standards catalogue does not know who cites it. A contract does not re-read its own references. A supplier answering a questionnaire that names the old edition will answer against whatever they think it means. This is the ordinary way a document quietly stops being true, and it happens without anybody doing anything wrong.

We have not read the new edition. It is behind a purchase we have not made, so this page says nothing about what changed, what the new edition requires or whether a claim built on the old one still holds. What we can tell you is which of your own documents to go and look at, and that the search term is the standard number with an edition year after it.

A resolver claim is not a passport claim

A second kind of standards claim circulates in this market and it is easy to mistake for the first. It concerns the grammar of the web address that a scanned code resolves to, and the behaviour of the service that answers that address. Both of those are real specifications and neither is a product passport standard. What is being claimed is resolver conformance, which is real, narrower and a genuinely good thing to claim. It is simply an answer to a different question.

The resolver specification is maintained by an industry organisation rather than by a European standards body. Its reference is not among the six published ones, so it carries no presumption under the framework, and a business told that a product is built to it has been told something true about how a code behaves and nothing about conformity with the framework's passport articles.

The version is the cheapest test there is

That standard was ratified again in August 2026 at its publisher's reference site, which is the address in the source list at the foot of this page. Read it there and nowhere else. On the same day the reference site was current, the same publisher's marketing site was two ratifications behind. So a deck citing an older release is not evidence of an old build. It is evidence of which page the deck was written from, and it takes a minute to check.

What changed between the recent releases is something we cannot tell you, because the served pages truncate before the change logs. Anyone describing a new release as architecturally significant should be asked to produce that comparison rather than asserted at. What a resolver does when a code is scanned, and the things the resolver standard does not contain, are set out in what happens when you scan.

A vocabulary release from the same publisher added passport examples aligned to an international code list and a new credential class. A vocabulary term existing means a way of saying something now exists. It does not mean anything reads it, writes it or acts on it, and we hold no evidence of consumption in either direction. Availability is the weakest kind of evidence there is and it is often quoted as the strongest.

There is also an international standard on encoding and resolving identifiers over HTTP. We have confirmed its existence and its published scope and we have not read it. It is a resolver and identifier-encoding standard as well, and whatever a slide calls it, it is not a product passport standard either.

We assert no conformity of our own. Nothing on this site claims that our passport service conforms to any standard in the table above, and this page is not the place where that claim quietly gets made.

The architectures a vendor may be building on

Underneath a standards claim there is an architecture, and it is fair to ask which one. Four families turn up in published architecture material. They are not exclusive, and a working system usually combines two of them.

• Resolution first. The identifier is the address. A code carries an identifier, a resolver turns a scan of it into a request, and what comes back is whatever the holder of that identifier chose to serve. The specifications here are the resolver and identifier-encoding ones described above.
• A hosted record. The passport is a record in a provider's system served from the provider's domain, and the printed code points at that domain. The question this family raises is what the printed code points at once the provider is no longer there.
• Issued credentials. Parts of the passport are issued as signed statements that a recipient can check without asking the issuer's server whether they are genuine. The new credential class in the vocabulary release described above belongs to this family.
• A shared ledger. A record, or a fingerprint of one, is written somewhere several parties can read, so that a later reader can test whether what they are shown matches what was published.

We do not rank these and we do not say how common any of them is. A count of how often each appeared was attempted in earlier work here and did not survive a recount, so no count appears on this page. The architecture material behind the four families is largely unread by us. What is above is a description of four patterns and not an audit of anybody's implementation.

No vendor is named here and none is scored. The reason to know the families at all is that they answer different questions: where the data physically lives, who can verify it without the vendor's cooperation, and what remains readable when the party holding it stops.

What to ask when a standard is cited at you

Five questions in this order. The first two settle most conversations.

1. Which standard, by number and by release. A series name is not a standard. Eight documents share this one, and a release number can be checked against the publisher's reference site in a minute.
2. Is its reference published in the Official Journal. Two of the eight are not, and a business relying on one of those has a supplier's design choice rather than a presumption.
3. Which parts, covering which requirements. The presumption runs only so far as the cited standard covers the framework's two passport articles, so an unbounded claim of conformity to a standard is broader than the standard can support.
4. Who is claiming conformity, and who assessed it. A self declaration is a legitimate thing to make and a different thing from an assessment by somebody else.
5. What obligation it discharges for your goods. Where no product-specific act covers what you sell, the honest answer is none of them yet.

On the fourth question, we have found no published conformity statement against any of these standards from any vendor whose listing we surveyed, and what we surveyed was the passport applications published on two ecommerce platforms. That is a narrow place to look. It does not reach enterprise vendors and it is not evidence that no such statement exists anywhere.

What this page does not rest on

Every standard in the table is unread. The reference, the title and the citation state of the six were reached through secondary reproductions of the implementing decision after a direct route failed, and the contents of all eight are evidenced by nothing we hold. No sentence here describes what any of the eight requires, permits or defines. The one this estate has recorded as worth buying, on storage, archiving and persistence, has not been bought.

The standardisation request behind the series was not read either, so this page says nothing about what the Commission asked the committee to produce. The framework's annex that cross-refers to identifier and carrier standards was not readable. The new edition of the withdrawn environmental claims standard is unread, the change logs of the resolver specification truncate before the part that would show what moved, and the architecture material behind the four families is largely unread. Each of those gaps is recorded here rather than worked around, which is the same method the rest of this estate is written to.

Sources

• Commission Implementing Decision (EU) 2026/1736 of 14 July 2026 on harmonised standards for digital product passports drafted in support of Regulation (EU) 2024/1781
  Recitals 1 and 2, Arts. 1 and 2, AnnexCELEX 32026D1736In forceReached through a secondary reproduction, primary text not read

  The implementing decision that publishes the references. A direct route to the Official Journal text returned an access error, and the decision's existence, its date and its content were confirmed through two independent secondary routes. The count of six of the eight and the identity of the two left out rest on that, which is why the count is stated on this page as to be confirmed at the Official Journal rather than as settled.

  View official source

• CEN and CENELEC, standards for digital product passports, EN in the spotlight, 15 July 2026
  Institutional guidanceReviewed in full

  The standards bodies' own account of the work of their joint technical committee, and the source for the series running to eight standards rather than six and for the subject of each one. It is a publisher describing its own output, so it evidences what was produced and never what the law asks for.

  View official source

• EN 18219:2026, Digital product passport. Unique identifiers
  European StandardBehind a purchase, not bought, not read

  Registered so that the reference and its citation state can be stated. The text is sold by national standards bodies and we hold no copy, so nothing on this page describes what it says.

  View official source

• EN 18220:2026, Digital product passport. Data carriers
  European StandardBehind a purchase, not bought, not read

  As above. The reference is evidenced by the implementing decision. The content is not evidenced by anything we have read.

  View official source

• EN 18221, data storage, archiving and persistence for the Digital Product Passport
  European StandardBehind a purchase, not bought, not read

  The standard on data storage, archiving and persistence. Its reference is among the published six, so it carries a presumption of conformity, and it is the one standard in the series this estate has recorded as worth buying. It has not been bought and it has not been read, which is stated on the page rather than left to be inferred from this row.

• EN 18xxx Digital Product Passport standards and their Official Journal citation state
  Under watchOfficial source confirmed, detailed review pending

  The citation state of the series as a whole, which is the row this page is re-checked against. A further reference appearing in the Official Journal changes the table above, so the check runs on a short cycle rather than a long one.

  View official source

• Digital Product Passport (European Commission, DG GROW)
  Institutional guidanceReviewed in full

  The Commission's own programme page, used on this page for one thing only: its indication that the two remaining references were expected in September 2026. Regulator guidance rather than law, and an indication on it is not a citation in the Official Journal.

  View official source

• Ecodesign for Sustainable Products Regulation (EU) 2024/1781, consolidated text
  Arts. 4, 9 to 11CELEX 02024R1781-20240628In forceRelevant provisions reviewed

  The framework the presumption points into. Its two passport articles are the outer limit of what any of these standards can do for a business, and they bind only through a product-specific act. Annex III, which the framework cross-refers to for identifier and carrier standards, was not readable and nothing here rests on it.

  View official source

• ISO 14021, self-declared environmental claims, edition withdrawn 24 June 2026
  Withdrawn editionBehind a purchase, not bought, not read

  The international standard on self-declared environmental claims. What is evidenced here is the catalogue entry, which records the edition as withdrawn on 24 June 2026 and replaced. The text of neither edition has been read, because both are behind a purchase we have not made, so this page says what the withdrawal does to a document that cites the old edition and says nothing about what the new one contains.

• GS1 conformant resolver standard, at the reference site
  Industry standardRelevant provisions reviewed

  The conformant resolver standard, read at the publisher's reference site and never at its marketing site, which was two ratifications behind on the same day the reference site was current. Read for the required behaviours and read as an absence for what it does not contain. What changed between the recent releases is not established, because the served pages truncate before the change logs. The same reference site carries the vocabulary release noted on this page; the vocabulary itself is not read.

  View official source

• ISO/IEC 18975, encoding and resolving identifiers over HTTP
  International standardOfficial source confirmed, detailed review pending

  An international standard on encoding and resolving identifiers over HTTP. The address resolves and the document has not been read, so this page carries its existence and its published scope and nothing else. It is used here for one correction: it is a resolver and identifier-encoding standard and it is not a product passport standard.