Behind the QR code: where Digital Product Passport data comes from

The information a Digital Product Passport needs rarely sits in one place. It is scattered across departments, systems, and companies. No single team sees the whole picture, yet the passport has to present it as one consistent record. 

A Digital Product Passport (DPP) is a digital record linked to a physical product through a data carrier such as a QR code. The Ecodesign for Sustainable Products Regulation (ESPR) introduces passports by product group, while some groups are covered by standalone EU law. Batteries come first. From February 18, 2027, EV batteries, LMT batteries and industrial batteries above 2 kWh need a passport under the EU Battery Regulation. 

Whatever the product group, the ESPR requires passport information to be accurate, complete, and up to date (Article 9). A passport is only as reliable as the product record behind it, and that record draws on four sources: internal systems, suppliers, third-party evidence and lifecycle events. 

Your own systems already hold more than you think 

Most identity and specification data already exists inside the company, distributed across several systems: 

• ERP: product master data, item numbers, production sites
• PLM: bills of materials and design specifications
• PIM: product descriptions and attributes for sales channels
• Technical documentation: internal test data and performance values 

Each system was built for its own process, so the same attribute can live in three places with three different values. Product weight in the ERP system may include packaging for logistics, while PLM holds the design weight without it. Often nobody has decided which one counts. Naming an authoritative source for each attribute is work a company can do on its own, which makes it a manageable starting point. Much of what a passport needs, however, has to come from outside. 

Much of the data you need sits several tiers upstream

Material composition, substances of concern, recycled content, origin and due diligence information typically come from suppliers, and often from their suppliers as well. That second layer is where collection slows down. A company can ask its direct suppliers for data, but beyond tier 1 there is usually no contractual relationship. Requests travel through intermediaries, and each step adds time.

In KPMG's European Digital Product Passport Readiness Survey of more than 70 organizations, collecting data from suppliers and the wider value chain was the most frequently cited implementation challenge, named by 31 percent of respondents. Consumer-facing sectors such as textiles, electronics and furniture pointed in particular to data from tier 2 and beyond. 

Batteries show how specific these requests get. Under Annex XIII of the Battery Regulation, the passport covers the detailed composition of cathode, anode and electrolyte, information that largely originates with cell and material suppliers. The osapiens Battery Passport guide, developed with TÜV SÜD, shows who carries passport responsibility and how the data workload differs between EV, energy storage, LMT and industrial batteries. 

Supplier data fills many fields. How reliable each data point is depends on the evidence behind it, and much of that evidence comes from outside the supply chain. 

Third-party evidence decides whether a data point holds up 

Some data points rely on references from outside the company and its suppliers, for example: 

• emission factors from external databases for product carbon footprints
• regulated substance lists for checking material declarations
• certificates and lab reports from independent testing bodies 

Part of this evidence becomes passport content itself. For batteries, test reports belong to the information reserved for notified bodies, market surveillance authorities, and the European Commission. Other sources, such as emission factors, stay in the background as calculation inputs. In both cases, they are what a company points to when an authority asks how a declared figure was calculated or verified. Each data point should therefore stay linked to its evidence from the moment it enters the record. 

The record keeps growing after the sale

Everything so far describes a product on the day it reaches the market. After that, products get repaired, resold, refurbished, and recycled, and each step can create information the passport has to reflect. The Commission's guidance for economic operators states that passport information has to remain accurate throughout the product's lifecycle. 

For batteries, Article 77 and Annex XIII of the Battery Regulation require information resulting from the use of each individual battery, such as state of health and battery status, reported by battery management systems and service partners. Responsibility can also change hands. When a battery is repurposed or remanufactured, the economic operator placing it back on the market takes over responsibility for the passport. A record built for this needs a history of what changed, when and by whom. 

Four sources, each with its own owners, formats and timelines. The practical question is how much of this a company holds in usable form today. 

Start with one product to see where the gaps are

The osapiens DPP Implementation Guide recommends starting small. Take one representative product, list the attributes you expect will be needed and sort each one into three groups: 

• held internally
• held by a supplier
• held by nobody yet 

The second group tends to take longer than expected, since data a supplier already holds can need almost as much lead time as data that doesn't exist yet. The guide also walks through six common implementation pitfalls, a 90-day preparation plan and five questions worth asking any DPP vendor. 

Building the passport on data you already collect

Many companies already gather parts of this data for other obligations, such as PPWR, REACH, RoHS, or product carbon footprints. osapiens HUB for Digital Product Passport reuses that work instead of starting a separate project, so each data point is maintained once and serves several obligations. It supports in practical ways: 

• Supplier data at scale: Suppliers respond through the osapiens Supplier Portal, where more than 100,000 suppliers are already registered. Guidance in 27+ languages and free access for suppliers lower the barrier on the step that often takes longest.
• Evidence linked to each value: Every supplier response carries its responder and date, and attached certificates or lab reports stay linked to the value they support.
• Connection to existing systems: An SAP connector and a REST API bring in ERP, PLM and PIM data, so information stays where it's created and doesn't need to be copied between systems.
• Portable, standards-based passports: The passport and its QR code are generated from the live record using GS1 identifiers, which keeps the data usable if requirements or providers change. 

For companies whose product compliance or supplier data already runs on the osapiens HUB, the passport builds on an existing record. Explore how osapiens HUB for Digital Product Passport connects these sources in more detail.